[issue41180] marshal load bypass code.__new__ audit event

Change by Steve Dower : -- resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker ___ ___

[issue41180] marshal load bypass code.__new__ audit event

Steve Dower added the comment: New changeset 95919b0d2744adb87acf696ae1de905cf02a95a6 by Steve Dower in branch 'main': bpo-41180: Fixes documentation to specify correct event name and add versionchanged (GH-26972)

[issue41180] marshal load bypass code.__new__ audit event

Steve Dower added the comment: New changeset 863e3d5c7e037b24b8294b041ed7686b522973d8 by Steve Dower in branch '3.9': bpo-41180: Replace marshal code.__new__ audit event with marshal.load[s] and marshal.dumps (GH-26971)

[issue41180] marshal load bypass code.__new__ audit event

Steve Dower added the comment: New changeset a5764d3d96341441d3f70fb5c96a82610a3f4842 by Steve Dower in branch '3.10': bpo-41180: Replace marshal code.__new__ audit event with marshal.load[s] and marshal.dumps (GH-26970)

[issue41180] marshal load bypass code.__new__ audit event

Change by Steve Dower : -- pull_requests: +25536 pull_request: https://github.com/python/cpython/pull/26972 ___ Python tracker ___

[issue41180] marshal load bypass code.__new__ audit event

Change by Steve Dower : -- pull_requests: +25535 pull_request: https://github.com/python/cpython/pull/26971 ___ Python tracker ___

[issue41180] marshal load bypass code.__new__ audit event

Change by Steve Dower : -- pull_requests: +25534 pull_request: https://github.com/python/cpython/pull/26970 ___ Python tracker ___

[issue41180] marshal load bypass code.__new__ audit event

Steve Dower added the comment: New changeset 139de04518bd98a975b7c98ab8a38e570dc585e4 by Steve Dower in branch 'main': bpo-41180: Replace marshal code.__new__ audit event with marshal.load[s] and marshal.dumps (GH-26961)

[issue41180] marshal load bypass code.__new__ audit event

Change by Steve Dower : -- pull_requests: +25527 stage: needs patch -> patch review pull_request: https://github.com/python/cpython/pull/26961 ___ Python tracker ___

[issue41180] marshal load bypass code.__new__ audit event

Steve Dower added the comment: I'm going to revert this and replace it with a marshal.loads (and dumps) event instead. The performance impact on loading .pyc files is too great, as it triggers the hook for each function. Without severely modifying importlib we can't bypass the call that's

[issue41180] marshal load bypass code.__new__ audit event

Change by Yunfan Zhan : -- resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker ___ ___

[issue41180] marshal load bypass code.__new__ audit event

miss-islington added the comment: New changeset 1c776541a8805576c0a4363ca28c1d29423f02f6 by Miss Islington (bot) in branch '3.9': bpo-41180: Audit code.__new__ when unmarshalling (GH-21271) https://github.com/python/cpython/commit/1c776541a8805576c0a4363ca28c1d29423f02f6 --

[issue41180] marshal load bypass code.__new__ audit event

miss-islington added the comment: New changeset c1d916595eb6979d4d87cc3e5216e26b3c6fac25 by Miss Islington (bot) in branch '3.8': bpo-41180: Audit code.__new__ when unmarshalling (GH-21271) https://github.com/python/cpython/commit/c1d916595eb6979d4d87cc3e5216e26b3c6fac25 --

[issue41180] marshal load bypass code.__new__ audit event

Change by miss-islington : -- pull_requests: +20450 pull_request: https://github.com/python/cpython/pull/21301 ___ Python tracker ___

[issue41180] marshal load bypass code.__new__ audit event

Steve Dower added the comment: New changeset d160e0f8e283d0a8737644588b38e8c6a07c134f by tkmikan in branch 'master': bpo-41180: Audit code.__new__ when unmarshalling (GH-21271) https://github.com/python/cpython/commit/d160e0f8e283d0a8737644588b38e8c6a07c134f --

[issue41180] marshal load bypass code.__new__ audit event

Change by miss-islington : -- nosy: +miss-islington nosy_count: 2.0 -> 3.0 pull_requests: +20449 pull_request: https://github.com/python/cpython/pull/21300 ___ Python tracker

[issue41180] marshal load bypass code.__new__ audit event

Steve Dower added the comment: Ah, you're right. Thanks for double checking me :) I'll merge the PR and do the backports. Thanks! -- ___ Python tracker ___

[issue41180] marshal load bypass code.__new__ audit event

Yunfan Zhan added the comment: Before this, we only audit code.__new__ and code.replace, as these methods allow constructing arbitrary code objects, and we don't audit code object coming from the normal way (like compile,exec,eval). If the event is raised in PyCode_NewWithPosOnlyArgs, is it

[issue41180] marshal load bypass code.__new__ audit event

Steve Dower added the comment: Actually, a quick search of codeobject.c and a look at tkmk's PR makes it seem like the audit event should be being raised from inside PyCode_NewWithPosOnlyArgs anyway (which IIRC didn't exist when I first added the event, though it was probably there before

[issue41180] marshal load bypass code.__new__ audit event

Change by Yunfan Zhan : -- keywords: +patch pull_requests: +20421 stage: -> patch review pull_request: https://github.com/python/cpython/pull/21271 ___ Python tracker ___

[issue41180] marshal load bypass code.__new__ audit event

Steve Dower added the comment: I like using the existing event for unmarshalling code objects, assuming we have all the arguments available. I'm not sure whether it's worth auditing all marshal.load() calls (just as we don't audit all pickle.load() calls). But depending on the code paths we

[issue41180] marshal load bypass code.__new__ audit event

New submission from Yunfan Zhan : While `code.__new__` is being audited, using `marshal.loads` to create a code object will trigger no events. Therefore, either `marshal.load(s)` event itself should be audited, or `code.__new__` should be triggered when marshal type is TYPE_CODE.