AccessControl 7.0__tar.gz → 7.2__tar.gz

{AccessControl-7.0 → accesscontrol-7.2}/.manylinux-install.sh

@@ -28,12 +28,12 @@ yum -y install libffi-devel
 
 tox_env_map() {
     case $1 in
-        *"cp313"*) echo 'py313';;
         *"cp38"*) echo 'py38';;
         *"cp39"*) echo 'py39';;
         *"cp310"*) echo 'py310';;
         *"cp311"*) echo 'py311';;
         *"cp312"*) echo 'py312';;
+        *"cp313"*) echo 'py313';;
         *) echo 'py';;
     esac
 }
@@ -41,19 +41,14 @@ tox_env_map() {
 # Compile wheels
 for PYBIN in /opt/python/*/bin; do
     if \
-       [[ "${PYBIN}" == *"cp313/"* ]] || \
-       [[ "${PYBIN}" == *"cp311/"* ]] || \
-       [[ "${PYBIN}" == *"cp312/"* ]] || \
        [[ "${PYBIN}" == *"cp38/"* ]] || \
        [[ "${PYBIN}" == *"cp39/"* ]] || \
-       [[ "${PYBIN}" == *"cp310/"* ]] ; then
-        if [[ "${PYBIN}" == *"cp313/"* ]] ; then
-            "${PYBIN}/pip" install --pre -e /io/
-            "${PYBIN}/pip" wheel /io/ --pre -w wheelhouse/
-        else
-            "${PYBIN}/pip" install -e /io/
-            "${PYBIN}/pip" wheel /io/ -w wheelhouse/
-        fi
+       [[ "${PYBIN}" == *"cp310/"* ]] || \
+       [[ "${PYBIN}" == *"cp311/"* ]] || \
+       [[ "${PYBIN}" == *"cp312/"* ]] || \
+       [[ "${PYBIN}" == *"cp313/"* ]] ; then
+        "${PYBIN}/pip" install -e /io/
+        "${PYBIN}/pip" wheel /io/ -w wheelhouse/
         if [ `uname -m` == 'aarch64' ]; then
           cd /io/
           ${PYBIN}/pip install tox

accesscontrol-7.2/.pre-commit-config.yaml

@@ -0,0 +1,28 @@
+# Generated from:
+# https://github.com/zopefoundation/meta/tree/master/config/c-code
+minimum_pre_commit_version: '3.6'
+repos:
+  - repo: https://github.com/pycqa/isort
+    rev: "5.13.2"
+    hooks:
+    - id: isort
+  - repo: https://github.com/hhatto/autopep8
+    rev: "v2.3.1"
+    hooks:
+    - id: autopep8
+      args: [--in-place, --aggressive, --aggressive]
+  - repo: https://github.com/asottile/pyupgrade
+    rev: v3.17.0
+    hooks:
+    - id: pyupgrade
+      args: [--py38-plus]
+  - repo: https://github.com/isidentical/teyit
+    rev: 0.4.3
+    hooks:
+    - id: teyit
+  - repo: https://github.com/PyCQA/flake8
+    rev: "7.1.1"
+    hooks:
+    - id: flake8
+      additional_dependencies:
+        - flake8-debugger == 4.1.2

{AccessControl-7.0 → accesscontrol-7.2}/CHANGES.rst

@@ -3,6 +3,28 @@ Changelog
 
 For changes before version 3.0, see ``HISTORY.rst``.
 
+7.2 (2024-11-03)
+----------------
+
+- Prevent untrusted access to ``AccessControl.userfolder.UserFolder.data``
+  (fixes `GHSA-g5vw-3h65-2q3v <https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v>`_).
+
+
+7.1 (2024-10-10)
+----------------
+
+- Add final support for Python 3.13.
+
+- Respect ``PURE_PYTHON`` environment variable set to ``0`` when running tests.
+
+- Let the roles access in ``rolesForPermissionOn`` interpret ``AttributeError``
+  and ``Unauthorized`` as "no roles definition for this permission at this
+  object" and report any other exception (for the Python and C implementation).
+  We have to treat ``Unauthorized`` like ``AttributeError`` to support
+  ``Shared.DC.Scripts.Bindings.UnauthorizedBinding`` which raises
+  ``Unauthorized`` for any access.
+
+
 7.0 (2024-05-30)
 ----------------
 

{AccessControl-7.0 → accesscontrol-7.2}/MANIFEST.in

@@ -5,7 +5,7 @@ include *.rst
 include *.txt
 include buildout.cfg
 include tox.ini
-include .coveragerc
+include .pre-commit-config.yaml
 
 recursive-include src *.py
 include *.sh

{AccessControl-7.0 → accesscontrol-7.2}/PKG-INFO

@@ -1,10 +1,10 @@
 Metadata-Version: 2.1
 Name: AccessControl
-Version: 7.0
+Version: 7.2
 Summary: Security framework for Zope.
 Home-page: https://github.com/zopefoundation/AccessControl
 Author: Zope Foundation and Contributors
-Author-email: zope-dev@zope.org
+Author-email: zope-dev@zope.dev
 License: ZPL 2.1
 Project-URL: Issue Tracker, https://github.com/zopefoundation/AccessControl/issues
 Project-URL: Sources, https://github.com/zopefoundation/AccessControl
@@ -25,6 +25,7 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Requires-Python: >=3.8
+Description-Content-Type: text/x-rst
 License-File: LICENSE.txt
 Requires-Dist: Acquisition
 Requires-Dist: AuthEncoding
@@ -32,7 +33,7 @@ Requires-Dist: BTrees
 Requires-Dist: DateTime
 Requires-Dist: ExtensionClass>=4.2.1
 Requires-Dist: Persistence>=3.0a3
-Requires-Dist: RestrictedPython>=5.1
+Requires-Dist: RestrictedPython>=7.4
 Requires-Dist: transaction
 Requires-Dist: zExceptions
 Requires-Dist: zope.component
@@ -43,7 +44,6 @@ Requires-Dist: zope.publisher
 Requires-Dist: zope.schema
 Requires-Dist: zope.security
 Requires-Dist: zope.testing
-Requires-Dist: funcsigs; python_version < "3.3"
 Provides-Extra: test
 Requires-Dist: zope.testrunner; extra == "test"
 
@@ -73,6 +73,28 @@ Changelog
 
 For changes before version 3.0, see ``HISTORY.rst``.
 
+7.2 (2024-11-03)
+----------------
+
+- Prevent untrusted access to ``AccessControl.userfolder.UserFolder.data``
+  (fixes `GHSA-g5vw-3h65-2q3v <https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v>`_).
+
+
+7.1 (2024-10-10)
+----------------
+
+- Add final support for Python 3.13.
+
+- Respect ``PURE_PYTHON`` environment variable set to ``0`` when running tests.
+
+- Let the roles access in ``rolesForPermissionOn`` interpret ``AttributeError``
+  and ``Unauthorized`` as "no roles definition for this permission at this
+  object" and report any other exception (for the Python and C implementation).
+  We have to treat ``Unauthorized`` like ``AttributeError`` to support
+  ``Shared.DC.Scripts.Bindings.UnauthorizedBinding`` which raises
+  ``Unauthorized`` for any access.
+
+
 7.0 (2024-05-30)
 ----------------
 

accesscontrol-7.2/pyproject.toml

@@ -0,0 +1,25 @@
+# 
+# Generated from:
+# https://github.com/zopefoundation/meta/tree/master/config/c-code
+
+[build-system]
+requires = ["setuptools<74"]
+build-backend = "setuptools.build_meta"
+
+[tool.coverage.run]
+branch = true
+source = ["AccessControl"]
+relative_files = true
+
+[tool.coverage.report]
+fail_under = 80
+precision = 2
+ignore_errors = true
+show_missing = true
+exclude_lines = ["pragma: no cover", "pragma: nocover", "except ImportError:", "raise NotImplementedError", "if __name__ == '__main__':", "self.fail", "raise AssertionError", "raise unittest.Skip"]
+
+[tool.coverage.html]
+directory = "parts/htmlcov"
+
+[tool.coverage.paths]
+source = ["src/", ".tox/*/lib/python*/site-packages/", ".tox/pypy*/site-packages/"]

{AccessControl-7.0 → accesscontrol-7.2}/setup.py

@@ -32,7 +32,7 @@ ext_modules = [
                  join('include', 'Acquisition', 'Acquisition.h')]),
 ]
 
-version = '7.0'
+version = '7.2'
 
 
 setup(name='AccessControl',
@@ -47,8 +47,9 @@ setup(name='AccessControl',
       description='Security framework for Zope.',
       keywords='security access authorization',
       author='Zope Foundation and Contributors',
-      author_email='zope-dev@zope.org',
+      author_email='zope-dev@zope.dev',
       long_description=README + '\n\n' + CHANGES,
+      long_description_content_type='text/x-rst',
       packages=find_packages('src'),
       package_dir={'': 'src'},
       classifiers=[
@@ -76,7 +77,7 @@ setup(name='AccessControl',
           'DateTime',  # optional dependency of RestrictedPython
           'ExtensionClass >= 4.2.1',
           'Persistence >= 3.0a3',
-          'RestrictedPython >= 5.1',
+          'RestrictedPython >= 7.4',
           'transaction',
           'zExceptions',
           'zope.component',
@@ -87,7 +88,6 @@ setup(name='AccessControl',
           'zope.schema',
           'zope.security',
           'zope.testing',
-          'funcsigs;python_version<"3.3"',
       ],
       python_requires='>=3.8',
       include_package_data=True,

{AccessControl-7.0 → accesscontrol-7.2}/src/AccessControl/ImplPython.py

@@ -31,6 +31,7 @@ from Acquisition import aq_inner
 from Acquisition import aq_parent
 from ExtensionClass import Base
 from zope.interface import implementer
+from zExceptions import Unauthorized as zExceptions_Unauthorized
 
 PURE_PYTHON = int(os.environ.get('PURE_PYTHON', '0'))
 if PURE_PYTHON:
@@ -71,8 +72,11 @@ def rolesForPermissionOn(perm, object, default=_default_roles, n=None):
     r = None
 
     while True:
-        if hasattr(object, n):
+        try:
             roles = getattr(object, n)
+        except (AttributeError, zExceptions_Unauthorized):
+            pass
+        else:
             if roles is None:
                 if _embed_permission_in_roles:
                     return (('Anonymous',), n)

{AccessControl-7.0 → accesscontrol-7.2}/src/AccessControl/SecurityInfo.py

@@ -140,7 +140,7 @@ class SecurityInfo(Implicit):
         # the decorator returned is remembered in a set and will
         # remove itself upon call. self.apply will check for an empty
         # set and raise an AssertionError otherwise.
-        key = "'{}':{}".format(permission_name, id(lambda x: x))
+        key = f"'{permission_name}':{id(lambda x: x)}"
 
         def decor(func):
             self.declareProtected(permission_name, func.__name__)  # NOQA: D001
@@ -148,7 +148,7 @@ class SecurityInfo(Implicit):
             return func
         # make sure our key algo creates unique-enough keys
         if key in self._unused_protected_decorators:
-            raise KeyError("Duplicate key: {}".format(key))
+            raise KeyError(f"Duplicate key: {key}")
         self._unused_protected_decorators.add(key)
         return decor
 

{AccessControl-7.0 → accesscontrol-7.2}/src/AccessControl/ZopeGuards.py

@@ -491,7 +491,7 @@ def load_module(module, mname, mnameparts, validate, globals, locals):
         if mname is None:
             mname = nextname
         else:
-            mname = '{}.{}'.format(mname, nextname)
+            mname = f'{mname}.{nextname}'
         # import (if not already imported) and  check for MSI
         nextmodule = secureModule(mname, globals, locals)
         if nextmodule is None:  # not allowed

{AccessControl-7.0 → accesscontrol-7.2}/src/AccessControl/cAccessControl.c

@@ -652,6 +652,7 @@ static PyExtensionClass imPermissionRoleType = {
 static PyObject *Containers = NULL;
 static PyObject *ContainerAssertions = NULL;
 static PyObject *Unauthorized = NULL;
+static PyObject *zExceptions_Unauthorized = NULL;
 static PyObject *warn= NULL;
 static PyObject *NoSequenceFormat = NULL;
 static PyObject *_what_not_even_god_should_do = NULL;
@@ -1847,15 +1848,27 @@ c_rolesForPermissionOn(PyObject *perm, PyObject *object,
   Py_INCREF(r);
 
   /*
-    while 1:
+    while True:
   */
   while (1)
     {
       /*
-        if hasattr(object, n):
+        try:
             roles = getattr(object, n)
+        except (AttributeError, zExceptions_Unauthorized):
+            pass
+        else:
       */
       PyObject *roles = PyObject_GetAttr(object, n);
+      if (roles == NULL)
+        {
+          if (! (PyErr_ExceptionMatches(PyExc_AttributeError)
+              || PyErr_ExceptionMatches(zExceptions_Unauthorized)))
+            {
+              /* re-raise */
+              return NULL;
+            }
+        }
       if (roles != NULL)
         {
 
@@ -2313,6 +2326,7 @@ static struct PyMethodDef dtml_methods[] = {
 */
 #define IMPORT(module, name) if ((module = PyImport_ImportModule(name)) == NULL) return NULL;
 #define GETATTR(module, name) if ((name = PyObject_GetAttrString(module, #name)) == NULL) return NULL;
+#define GETATTR_AS(module, name, as_name) if ((as_name = PyObject_GetAttrString(module, name)) == NULL) return NULL;
 
 static struct PyModuleDef moduledef =
 {
@@ -2400,6 +2414,14 @@ module_init(void) {
 	Py_DECREF(tmp);
 	tmp = NULL;
 
+	/*| from zExceptions import Unauthorized as zExceptions_Unauthorized
+	*/
+
+	IMPORT(tmp, "zExceptions");
+	GETATTR_AS(tmp, "Unauthorized", zExceptions_Unauthorized);
+	Py_DECREF(tmp);
+	tmp = NULL;
+
 	/*| from AccessControl.SecurityManagement import getSecurityManager
 	*/
 

{AccessControl-7.0 → accesscontrol-7.2}/src/AccessControl/tests/testClassSecurityInfo.py

@@ -102,10 +102,10 @@ class ClassSecurityInfoTests(unittest.TestCase):
         self.assertEqual(object.private__roles__, ())
         imPermissionRole = [r for r in object.protected__roles__
                             if not r.endswith('_Permission')]
-        self.assertTrue(len(imPermissionRole) == 4)
+        self.assertEqual(len(imPermissionRole), 4)
 
         for item in ('Manager', 'Role A', 'Role B', 'Role C'):
-            self.assertTrue(item in imPermissionRole)
+            self.assertIn(item, imPermissionRole)
 
         # functions exist, i.e. decorators returned them
         self.assertEqual(object.public_new.__name__, 'public_new')
@@ -117,10 +117,10 @@ class ClassSecurityInfoTests(unittest.TestCase):
         self.assertEqual(object.private_new__roles__, ())
         imPermissionRole = [r for r in object.protected_new__roles__
                             if not r.endswith('_Permission')]
-        self.assertTrue(len(imPermissionRole) == 4)
+        self.assertEqual(len(imPermissionRole), 4)
 
         for item in ('Manager', 'Role A', 'Role B', 'Role C'):
-            self.assertTrue(item in imPermissionRole)
+            self.assertIn(item, imPermissionRole)
 
         # Make sure that a permission defined without accompanying method
         # is still reflected in __ac_permissions__
@@ -160,7 +160,7 @@ class ClassSecurityInfoTests(unittest.TestCase):
         # Do class initialization.
         exc = self.assertRaises(AssertionError,
                                 InitializeClass, Test)
-        self.assertTrue('has 2 non-decorator' in str(exc))
+        self.assertIn('has 2 non-decorator', str(exc))
 
     def test_aq_context_in_decorators(self):
         from Acquisition import Implicit

{AccessControl-7.0 → accesscontrol-7.2}/src/AccessControl/tests/testModuleSecurity.py

@@ -98,12 +98,12 @@ class ModuleSecurityTests(unittest.TestCase):
         from AccessControl.SecurityInfo import _moduleSecurity as MS
         from AccessControl.ZopeGuards import guarded_import
         MSI('AccessControl.tests.nonesuch').declarePublic('pub')  # NOQA: D001
-        self.assertTrue('AccessControl.tests.nonesuch' in MS)
+        self.assertIn('AccessControl.tests.nonesuch', MS)
         self.assertRaises(ImportError,
                           guarded_import,
                           'AccessControl.tests.nonesuch',
                           ())
-        self.assertTrue('AccessControl.tests.nonesuch' in MS)
+        self.assertIn('AccessControl.tests.nonesuch', MS)
 
     def test_level_default(self):
         self.assertAuth('AccessControl.tests.public_module', (),

accesscontrol-7.2/src/AccessControl/tests/testPermissionRole.py

@@ -0,0 +1,170 @@
+##############################################################################
+#
+# Copyright (c) 2002 Zope Foundation and Contributors.
+#
+# This software is subject to the provisions of the Zope Public License,
+# Version 2.1 (ZPL).  A copy of the ZPL should accompany this distribution.
+# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY AND ALL EXPRESS OR IMPLIED
+# WARRANTIES ARE DISCLAIMED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF TITLE, MERCHANTABILITY, AGAINST INFRINGEMENT, AND FITNESS
+# FOR A PARTICULAR PURPOSE
+#
+##############################################################################
+"""Tests of PermissionRole
+"""
+
+import unittest
+
+from Acquisition import Explicit
+from Acquisition import Implicit
+from Acquisition import aq_base
+
+from ..Implementation import PURE_PYTHON
+
+
+ViewPermission = 'View'
+EditThingsPermission = 'Edit Things!'
+DeletePermission = 'Delete'
+
+
+class AppRoot(Explicit):
+    _View_Permission = None
+    _Edit_Things__Permission = ('Manager', 'Owner')
+    # No default for delete permission.
+
+
+class ImplicitContainer(Implicit):
+    pass
+
+
+class ExplicitContainer(Explicit):
+    pass
+
+
+class RestrictiveObject(Implicit):
+    _View_Permission = ('Manager',)
+    _Delete_Permission = ()  # Nobody
+
+
+class PermissiveObject(Explicit):
+    _Edit_Things__Permission = ['Anonymous']
+
+
+class PermissionRoleTestBase:
+
+    def assertPRoles(self, ob, permission, expect):
+        """
+        Asserts that in the context of ob, the given permission maps to
+        the given roles.
+        """
+        pr = self._getTargetClass()(permission)
+        roles = pr.__of__(ob)
+        roles2 = aq_base(pr).__of__(ob)
+        assert roles == roles2 or tuple(roles) == tuple(roles2), (
+            'Different methods of checking roles computed unequal results')
+        same = 0
+        if roles:
+            # When verbose security is enabled, permission names are
+            # embedded in the computed roles.  Remove the permission
+            # names.
+            roles = [r for r in roles if not r.endswith('_Permission')]
+
+        if roles is None or expect is None:
+            if (roles is None or tuple(roles) == ('Anonymous', )) and \
+                    (expect is None or tuple(expect) == ('Anonymous', )):
+                same = 1
+        else:
+            got = {}
+            for r in roles:
+                got[r] = 1
+            expected = {}
+            for r in expect:
+                expected[r] = 1
+            if got == expected:  # Dict compare does the Right Thing.
+                same = 1
+        self.assertTrue(same, f'Expected roles: {expect!r}, got: {roles!r}')
+
+    def testRestrictive(self, explicit=0):
+        app = AppRoot()
+        if explicit:
+            app.c = ExplicitContainer()
+        else:
+            app.c = ImplicitContainer()
+        app.c.o = RestrictiveObject()
+        o = app.c.o
+        self.assertPRoles(o, ViewPermission, ('Manager', ))
+        self.assertPRoles(o, EditThingsPermission, ('Manager', 'Owner'))
+        self.assertPRoles(o, DeletePermission, ())
+
+    def testPermissive(self, explicit=0):
+        app = AppRoot()
+        if explicit:
+            app.c = ExplicitContainer()
+        else:
+            app.c = ImplicitContainer()
+        app.c.o = PermissiveObject()
+        o = app.c.o
+        self.assertPRoles(o, ViewPermission, ('Anonymous', ))
+        self.assertPRoles(o, EditThingsPermission, ('Anonymous',
+                                                    'Manager',
+                                                    'Owner'))
+        self.assertPRoles(o, DeletePermission, ('Manager', ))
+
+    def testExplicit(self):
+        self.testRestrictive(1)
+        self.testPermissive(1)
+
+    def testAppDefaults(self):
+        o = AppRoot()
+        self.assertPRoles(o, ViewPermission, ('Anonymous', ))
+        self.assertPRoles(o, EditThingsPermission, ('Manager', 'Owner'))
+        self.assertPRoles(o, DeletePermission, ('Manager', ))
+
+    def testPermissionRoleSupportsGetattr(self):
+        a = self._getTargetClass()('a')
+        self.assertEqual(getattr(a, '__roles__'), ('Manager', ))
+        self.assertEqual(getattr(a, '_d'), ('Manager', ))
+        self.assertEqual(getattr(a, '__name__'), 'a')
+        self.assertEqual(getattr(a, '_p'), '_a_Permission')
+
+    def testErrorsDuringGetattr(self):
+        pr = self._getTargetClass()('View')
+
+        class AttributeErrorObject(Implicit):
+            pass
+        self.assertEqual(
+            tuple(pr.__of__(AttributeErrorObject())), ('Manager', ))
+
+        # Unauthorized errors are tolerated and equivalent to no
+        # permission declaration
+        class UnauthorizedErrorObject(Implicit):
+            def __getattr__(self, name):
+                from zExceptions import Unauthorized
+                if name == '_View_Permission':
+                    raise Unauthorized(name)
+                raise AttributeError(name)
+        self.assertEqual(
+            tuple(pr.__of__(UnauthorizedErrorObject())), ('Manager', ))
+
+        # other exceptions propagate
+        class ErrorObject(Implicit):
+            def __getattr__(self, name):
+                if name == '_View_Permission':
+                    raise RuntimeError("Error raised during getattr")
+                raise AttributeError(name)
+        with self.assertRaisesRegex(
+                RuntimeError, "Error raised during getattr"):
+            tuple(pr.__of__(ErrorObject()))
+
+
+class Python_PermissionRoleTests(PermissionRoleTestBase, unittest.TestCase):
+    def _getTargetClass(self):
+        from AccessControl.ImplPython import PermissionRole
+        return PermissionRole
+
+
+@unittest.skipIf(PURE_PYTHON, reason="Test expects C impl.")
+class C__PermissionRoleTests(PermissionRoleTestBase, unittest.TestCase):
+    def _getTargetClass(self):
+        from AccessControl.ImplC import PermissionRole
+        return PermissionRole