Our security researchers are still investigating, but there have been early reports that a description of Python 3.0 (codenamed Python 3000) reveals a potentially dangerous vulnerability in the brains of Object-Oriented programmers.
This exploit was detected when an unpatched brain was used to read the following text:
- You can specify the bases dynamically, e.g.:
bases = (B1, B2)class C(*bases):
...
As a result of reading this text, the brain of the test subject (codenamed Julian), formally trained in Object-Oriented Methods, entered an infinite loop. He was live-locked considering the implications, implementations and possible driving forces for this feature. Fortunately, he was found, still gibbering on the floor, in under 3 hours after the exploit event, and was able to be rebooted successfully, without lasting damage.
We hope to find the corresponding PEP documentation soon to see the justification for being about to dynamically choose base classes. (Caution: Do not think about this too carefully, until appropriate patches are made available!)
We urge users to take precautions to only read Python 3000 documentation under appropriate medical supervision until tools are made available in Python to properly represent UML class diagrams as animated GIFs.
We look forward to seeing the new applications that are enabled by this change, including [[Security Alert! Text quarantined.]]
Comment by Alastair on July 23, 2007
Ignoring your warnings, I put a few minutes thought into this. Would this be the dynamic-language equivalent of generics in Java or templates in C++?
Hypothetical example: a codec class that overrides the read and write methods to convert text strings to/from the correct encoding type. Given a class that support read and write, you could pass it in as a base class to the codec class. This would allow encoding and decoding of text from files, networks, pipes, etc etc.
Not saying this is an ideal design for the problem of text encoding, but maybe it’s enough to avoid developer livelock about the general concept?
Comment by Julian on July 26, 2007
Well, Alastair,
You have broken the livelock but every time I think about it, I still feel a little dirty.
The Zen of Python tells us “There should be one– and preferably only one –obvious way to do it.” So my tactic has been to think about what that one obvious way to do this would be. The longer I think about it, the more “obvious” it will have to be when I discover it.
The problem we are solving is to create a class that can encapsulate an arbitrary file-like class, called
flc
, behind a proxy class that adds text coding and encoding.Obvious solution candidate # 1:
Inherit from
flc
and add the codec handling (perhaps by encapsulating a codec object.)Problem: Requires significant custom code for each
flc
class we come across.Obvious solution candidate # 2:
Multiple base classes: codec class then
flc
class.Problem: Can the codec class’s
read
method successfully refer to, and call, theflc
class’sread
method? I suspect not, but am not sure. It it is possible, it certainly isn’t obvious.Obvious solution candidate # 3:
Common or garden encapsulation – pass the
flc
instance to the codec class’s constructor.Problem: Only permits (transparent) access to the pre-agreed methods. Any other methods on
flc
will be hidden.The good news is that Python 3000 has some clearer definitions of what methods are required to be considered “file-like”, but this might still be a problem if your particular class offers an obscure operation.
Obvious solution candidate # 4:
Encapsulation, but add fake proxy methods into the class’s dictionary during the instance’s construction, based on introspection on the encapsulation class.
Problem: Ugh, now see what you’ve made me do! I have to stop now, before I go too far.
I need a shower!
Comment by Alastair on July 27, 2007
Interestingly, the Python codec module uses obvious solution #3, and the problem you mentioned is solved by decree:
Not sure how it does this! Maybe some magic with dir() ?
Anyway, just out of interest, how does your OO Brain cope with function/method/class decorators? These are current Python features which I find mildly confusing…