dgilland / pydash

The kitchen sink of Python utility libraries for doing "stuff" in a functional way. Based on the Lo-Dash Javascript library.

Home Page:http://pydash.readthedocs.io

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Dunder variables as well as methods forbidden in pydash.get

AndyKilpatrick opened this issue · comments

commented

Got some code using pydash.get(callable, "__name__") to aid logging. pydash 6.0.0 forbids using dunder methods.

I'm not fully clear on security issue which required this change, but wondering if dunder variables (as opposed to methods) could be allowed.
Though looking at code I think this may be tricky without coding a list of allowed or disallowed options, so perhaps current method is the best - if so please reject this.

The main thing v6 was trying to prevent was access to the global namespace via attributes like some_obj.__init__.__globals__, some_obj.some_method.__globals__ and some_func.__globals__ which are automatically set when creating those objects. But perhaps v6 is being too aggressive here and blocking just __globals__ (and maybe __locals__? not sure if that ever gets set on things) would be sufficient.

This is fixed in 6.0.2.