missing feature in inspect module: getmembers_static

[carljm]

BPO	30533
Nosy	@carljm, @DinoV, @kernc, @lisroach, @corona10, @hongweipeng, @tirkarthi, @isidentical, @itamaro
PRs	bpo-30533:Add function inspect.getmembers_static that does not call properties or dynamic properties. #20911 bpo-30533: Add docs for inspect.getmembers_static #29874

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2021-12-01.19:24:09.933>
created_at = <Date 2017-05-31.22:52:48.216>
labels = ['type-feature', 'library', '3.11']
title = 'missing feature in inspect module: getmembers_static'
updated_at = <Date 2021-12-01.19:24:09.932>
user = 'https://github.com/carljm'

bugs.python.org fields:

activity = <Date 2021-12-01.19:24:09.932>
actor = 'dino.viehland'
assignee = 'none'
closed = True
closed_date = <Date 2021-12-01.19:24:09.933>
closer = 'dino.viehland'
components = ['Library (Lib)']
creation = <Date 2017-05-31.22:52:48.216>
creator = 'carljm'
dependencies = []
files = []
hgrepos = []
issue_num = 30533
keywords = ['patch']
message_count = 7.0
messages = ['294876', '295029', '329255', '406072', '407393', '407423', '407483']
nosy_count = 9.0
nosy_names = ['carljm', 'dino.viehland', 'kernc', 'lisroach', 'corona10', 'hongweipeng', 'xtreak', 'BTaskaya', 'itamaro']
pr_nums = ['20911', '29874']
priority = 'normal'
resolution = None
stage = 'resolved'
status = 'closed'
superseder = None
type = 'enhancement'
url = 'https://bugs.python.org/issue30533'
versions = ['Python 3.11']

[carljm]

The inspect module contains a getattr_static() function, for accessing an arbitrary attribute on a Python object without risking descriptor or __getattr__ code execution. This is useful for introspection tools that don't want to trigger any side effects.

The inspect module also contains a getmembers() function, which returns a mapping of names to values for all the object's members. This function could also be very useful to introspection tools, except that internally it uses normal getattr, thus reintroduces the risk of arbitrary code execution.

It would be useful to have an equivalent to getmembers() that is descriptor-safe. This could be done either by introducing a new getmembers_static(), or possibly by adding a getattr optional keyword argument to getmembers, that would take a getattr-equivalent callable to use in fetching attributes from the object. (The latter option might render some internal assumptions of getmembers() incorrect, needs experimentation.)

[lisroach]

+1 to a new getmembers_static(), I don't see why this couldn't be implemented.

[tirkarthi]

+1 from me too. bpo-35108 could help from this implementation where properties execute code that might cause runtime exception. Initially I tried using getattr_static inside getmembers at msg329254 but I think a separate function or an option to use getattr_static only in getmembers is more clean.

Bumping the version to 3.8.

Thanks!

[itamaro]

interested in this too - came here to see if I can implement, but found that a patch is already available (GH-20911), and applies cleanly on latest main branch (see my PR comments)

would be great if it gets merged!

[DinoV]

New changeset af8c8ca by Weipeng Hong in branch 'main':
bpo-30533:Add function inspect.getmembers_static that does not call properties or dynamic properties. (bpo-20911)
af8c8ca