...but I want to access 'a particular tuple' in that context!
Try this in a PythonScript: d = {1:2} for t in d.iteritems(): pass Annoyingly, it raises Unauthorized: You are not allowed to access 'a particular tuple' in this context Is there a reason for this, or is it just part of AccessControl/RestrictedPython that hasn't been fleshed out yet? -- Jamie Heilman http://audible.transient.net/~jamie/ "I was in love once -- a Sinclair ZX-81. People said, "No, Holly, she's not for you." She was cheap, she was stupid and she wouldn't load -- well, not for me, anyway." -Holly
Jamie Heilman wrote:
Try this in a PythonScript:
d = {1:2} for t in d.iteritems(): pass
Annoyingly, it raises Unauthorized: You are not allowed to access 'a particular tuple' in this context
Is there a reason for this, or is it just part of AccessControl/RestrictedPython that hasn't been fleshed out yet?
The 'iteritems' method of a dictionary returns an object of type 'dictionary-iterator'; AccessControl.ZopeGuards makes no container assertions about that type, although it *does* permit calling the 'iteritems' method which returns an instance of it. I find it interesting that that module wraps 'iterkeys' and 'itervalues' in its 'get_iter' checker, but allows unrestricted access to 'iteritems'. The following patch will make your use case work (it would need to be prettied up for Python < 2.3): --- lib/python/AccessControl/ZopeGuards.py 16 Jan 2004 18:18:51 -0000 1.18 +++ lib/python/AccessControl/ZopeGuards.py 23 Mar 2004 16:41:19 -0000 @@ -161,6 +161,8 @@ 'iterkeys': get_iter, 'itervalues':get_iter, 'pop':get_dict_pop, 'popitem':1, 'setdefault':1, 'update':1, 'values':1} +ContainerAssertions[type({}.iteritems())] = 1 + ContainerAssertions[type([])] = { 'append':1, 'count':1, 'extend':1, 'index':1, 'insert':1, 'pop':get_list_pop, 'remove':1, 'reverse':1, 'sort':1} Tres. -- =============================================================== Tres Seaver tseaver@zope.com Zope Corporation "Zope Dealers" http://www.zope.com
Tres Seaver wrote:
The 'iteritems' method of a dictionary returns an object of type 'dictionary-iterator'; AccessControl.ZopeGuards makes no container assertions about that type, although it *does* permit calling the 'iteritems' method which returns an instance of it.
I find it interesting that that module wraps 'iterkeys' and 'itervalues' in its 'get_iter' checker, but allows unrestricted access to 'iteritems'.
Yeah I saw that, which is why I asked about it, I couldn't decide if it was left sort of half-baked on purpose or not. I assume not, but I wanted to make sure.
The following patch will make your use case work (it would need to be prettied up for Python < 2.3):
OK, but really I'm more interested in having this supported in Zope proper, I can always use .items() instead of .iteritems() and soak the associated costs if I have to. Surely making iteritems use a guarded interator is the Right thing, yes? -- Jamie Heilman http://audible.transient.net/~jamie/ "Most people wouldn't know music if it came up and bit them on the ass." -Frank Zappa
[Tres Seaver]
The 'iteritems' method of a dictionary returns an object of type 'dictionary-iterator'; AccessControl.ZopeGuards makes no container assertions about that type, although it *does* permit calling the 'iteritems' method which returns an instance of it.
I find it interesting that that module wraps 'iterkeys' and 'itervalues' in its 'get_iter' checker, but allows unrestricted access to 'iteritems'.
[Jamie Heilman]
Yeah I saw that, which is why I asked about it, I couldn't decide if it was left sort of half-baked on purpose or not. I assume not, but I wanted to make sure.
It was deliberate. iterkeys() and itervalues() reveal objects held by the dict directly, and so require security checks before handing those objects out. iteritems() returns 2-tuples, though, and there's no security implication there until you do something to extract the contained keys and values from the 2-tuples. The security checks in the iteritems() case occur in all the ways of picking apart the 2-tuples.
The following patch will make your use case work (it would need to be prettied up for Python < 2.3):
[a patch that inserted ContainerAssertions[type({}.iteritems())] = 1 ] Unfortunately, type({}.iteritems()) is type({}.iterkeys()) is type({}.itervalues()) They all return a dictionary-iterator object. The .next() method of a dictionary-iterator object is safe to hand out for the iteritems flavor (again because it returns 2-tuples), but the .next() methods of the others aren't safe (again because they reveal contained objects directly).
OK, but really I'm more interested in having this supported in Zope proper,
Sure -- I'm sure Tres was just trying to get you unstuck in a hurry.
I can always use .items() instead of .iteritems() and soak the associated costs if I have to. Surely making iteritems use a guarded interator is the Right thing, yes?
The thing going wrong here is subtler than that. For example, change iteritems() to itervalues() in your original example, and I bet it still won't work. OTOH, if you use list(yourdict.iterkeys()) instead, I bet it will work.
participants (3)
-
Jamie Heilman -
Tim Peters -
Tres Seaver