Dunder variables as well as methods forbidden in pydash.get
AndyKilpatrick opened this issue · comments
Got some code using pydash.get(callable, "__name__")
to aid logging. pydash 6.0.0 forbids using dunder methods.
I'm not fully clear on security issue which required this change, but wondering if dunder variables (as opposed to methods) could be allowed.
Though looking at code I think this may be tricky without coding a list of allowed or disallowed options, so perhaps current method is the best - if so please reject this.
The main thing v6 was trying to prevent was access to the global namespace via attributes like some_obj.__init__.__globals__
, some_obj.some_method.__globals__
and some_func.__globals__
which are automatically set when creating those objects. But perhaps v6 is being too aggressive here and blocking just __globals__
(and maybe __locals__
? not sure if that ever gets set on things) would be sufficient.
This is fixed in 6.0.2.