RestrictedPython 8.3a1.dev0__py3-none-any.whl → 8.4__py3-none-any.whl

RestrictedPython/transformer.py

@@ -19,8 +19,12 @@ the parsed python code to create a modified AST for a byte code generation.
 
 
 import ast
+import collections
 import contextlib
 import textwrap
+import typing
+
+from RestrictedPython._types import T_pos_ast
 
 
 # For AugAssign the operator must be converted to a string.
@@ -111,11 +115,15 @@ INSPECT_ATTRIBUTES = frozenset([
     "cr_origin",
 ])
 
+_T_visit_return: typing.TypeAlias = ast.AST | typing.Iterable[ast.AST] | None
+_T = typing.TypeVar('_T', bound=ast.AST)
 
 # When new ast nodes are generated they have no 'lineno', 'end_lineno',
 # 'col_offset' and 'end_col_offset'. This function copies these fields from the
 # incoming node:
-def copy_locations(new_node, old_node):
+
+
+def copy_locations(new_node: T_pos_ast, old_node: T_pos_ast) -> None:
     assert 'lineno' in new_node._attributes
     new_node.lineno = old_node.lineno
 
@@ -132,12 +140,12 @@ def copy_locations(new_node, old_node):
 
 
 class PrintInfo:
-    def __init__(self):
+    def __init__(self) -> None:
         self.print_used = False
         self.printed_used = False
 
     @contextlib.contextmanager
-    def new_print_scope(self):
+    def new_print_scope(self) -> collections.abc.Iterator[None]:
         old_print_used = self.print_used
         old_printed_used = self.printed_used
 
@@ -152,8 +160,14 @@ class PrintInfo:
 
 
 class RestrictingNodeTransformer(ast.NodeTransformer):
-
-    def __init__(self, errors=None, warnings=None, used_names=None):
+    errors: list[str]
+    warnings: list[str]
+    used_names: dict[str, bool]
+
+    def __init__(self,
+                 errors: list[str] | None = None,
+                 warnings: list[str] | None = None,
+                 used_names: dict[str, bool] | None = None):
         super().__init__()
         self.errors = [] if errors is None else errors
         self.warnings = [] if warnings is None else warnings
@@ -170,26 +184,26 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
 
         self.print_info = PrintInfo()
 
-    def gen_tmp_name(self):
+    def gen_tmp_name(self) -> str:
         # 'check_name' ensures that no variable is prefixed with '_'.
         # => Its safe to use '_tmp..' as a temporary variable.
         name = '_tmp%i' % self._tmp_idx
         self._tmp_idx += 1
         return name
 
-    def error(self, node, info):
+    def error(self, node: ast.AST, info: str) -> None:
         """Record a security error discovered during transformation."""
         lineno = getattr(node, 'lineno', None)
         self.errors.append(
             f'Line {lineno}: {info}')
 
-    def warn(self, node, info):
-        """Record a security error discovered during transformation."""
+    def warn(self, node: ast.AST, info: str) -> None:
+        """Record a security warning discovered during transformation."""
         lineno = getattr(node, 'lineno', None)
         self.warnings.append(
             f'Line {lineno}: {info}')
 
-    def guard_iter(self, node):
+    def guard_iter(self, node: ast.For | ast.comprehension) -> _T_visit_return:
         """
         Converts:
             for x in expr
@@ -220,10 +234,12 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
         node.iter = new_iter
         return node
 
-    def is_starred(self, ob):
+    def is_starred(self, ob: ast.AST) -> typing.TypeGuard[ast.Starred]:
+        # TODO: Change Type Annotation to typing.TypeIs[ast.Starred] when
+        #               Support for Python 3.12 is dropped.
         return isinstance(ob, ast.Starred)
 
-    def gen_unpack_spec(self, tpl):
+    def gen_unpack_spec(self, tpl: ast.Tuple) -> ast.Dict:
         """Generate a specification for 'guarded_unpack_sequence'.
 
         This spec is used to protect sequence unpacking.
@@ -271,7 +287,8 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
         spec = ast.Dict(keys=[], values=[])
 
         spec.keys.append(ast.Constant('childs'))
-        spec.values.append(ast.Tuple([], ast.Load()))
+        val0 = ast.Tuple([], ast.Load())
+        spec.values.append(val0)
 
         # starred elements in a sequence do not contribute into the min_len.
         # For example a, b, *c = g
@@ -292,21 +309,26 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
                 el = ast.Tuple([], ast.Load())
                 el.elts.append(ast.Constant(idx - offset))
                 el.elts.append(self.gen_unpack_spec(val))
-                spec.values[0].elts.append(el)
+                val0.elts.append(el)
 
         spec.keys.append(ast.Constant('min_len'))
         spec.values.append(ast.Constant(min_len))
 
         return spec
 
-    def protect_unpack_sequence(self, target, value):
+    def protect_unpack_sequence(
+            self,
+            target: ast.Tuple,
+            value: ast.expr) -> ast.Call:
         spec = self.gen_unpack_spec(target)
         return ast.Call(
             func=ast.Name('_unpack_sequence_', ast.Load()),
             args=[value, spec, ast.Name('_getiter_', ast.Load())],
             keywords=[])
 
-    def gen_unpack_wrapper(self, node, target):
+    def gen_unpack_wrapper(self,
+                           node: ast.stmt,
+                           target: ast.Tuple) -> tuple[ast.Name, ast.Try]:
         """Helper function to protect tuple unpacks.
 
         node: used to copy the locations for the new nodes.
@@ -342,8 +364,9 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
         #     arg = converter
         # finally:
         #     del tmp_arg
-        try_body = [ast.Assign(targets=[target], value=converter)]
-        finalbody = [self.gen_del_stmt(tmp_name)]
+        try_body: list[ast.stmt] = [ast.Assign(
+            targets=[target], value=converter)]
+        finalbody: list[ast.stmt] = [self.gen_del_stmt(tmp_name)]
         cleanup = ast.Try(
             body=try_body, finalbody=finalbody, handlers=[], orelse=[])
 
@@ -355,13 +378,17 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
 
         return (tmp_target, cleanup)
 
-    def gen_none_node(self):
+    def gen_none_node(self) -> ast.Constant:
         return ast.Constant(None)
 
-    def gen_del_stmt(self, name_to_del):
+    def gen_del_stmt(self, name_to_del: str) -> ast.Delete:
         return ast.Delete(targets=[ast.Name(name_to_del, ast.Del())])
 
-    def check_name(self, node, name, allow_magic_methods=False):
+    def check_name(
+            self,
+            node: T_pos_ast,
+            name: str | None,
+            allow_magic_methods: bool = False) -> None:
         """Check names if they are allowed.
 
         If ``allow_magic_methods is True`` names in `ALLOWED_FUNC_NAMES`
@@ -386,7 +413,12 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
         elif name in FORBIDDEN_FUNC_NAMES:
             self.error(node, f'"{name}" is a reserved name.')
 
-    def check_function_argument_names(self, node):
+    def check_function_argument_names(
+            self,
+            node: ast.FunctionDef | ast.AsyncFunctionDef | ast.Lambda) -> None:
+        for arg in node.args.posonlyargs:
+            self.check_name(node, arg.arg)
+
         for arg in node.args.args:
             self.check_name(node, arg.arg)
 
@@ -399,7 +431,7 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
         for arg in node.args.kwonlyargs:
             self.check_name(node, arg.arg)
 
-    def check_import_names(self, node):
+    def check_import_names(self, node: ast.ImportFrom | ast.Import) -> ast.AST:
         """Check the names being imported.
 
         This is a protection against rebinding dunder names like
@@ -416,7 +448,10 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
 
         return self.node_contents_visit(node)
 
-    def inject_print_collector(self, node, position=0):
+    def inject_print_collector(
+            self,
+            node: ast.Module | ast.FunctionDef,
+            position: int = 0) -> None:
         print_used = self.print_info.print_used
         printed_used = self.print_info.printed_used
 
@@ -449,7 +484,8 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
 
     # Special Functions for an ast.NodeTransformer
 
-    def generic_visit(self, node):
+    def generic_visit(self,  # type: ignore[override]
+                      node: ast.AST) -> _T_visit_return:
         """Reject ast nodes which do not have a corresponding `visit_` method.
 
         This is needed to prevent new ast nodes from new Python versions to be
@@ -464,18 +500,18 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
         )
         self.not_allowed(node)
 
-    def not_allowed(self, node):
+    def not_allowed(self, node: ast.AST) -> None:
         self.error(
             node,
             f'{node.__class__.__name__} statements are not allowed.')
 
-    def node_contents_visit(self, node):
+    def node_contents_visit(self, node: _T) -> _T:
         """Visit the contents of a node."""
-        return super().generic_visit(node)
+        return super().generic_visit(node)  # type: ignore[return-value]
 
     # ast for Literals
 
-    def visit_Constant(self, node):
+    def visit_Constant(self, node: ast.Constant) -> _T_visit_return:
         """Allow constant literals.
 
         Constant replaces Num, Str, Bytes, NameConstant and Ellipsis in
@@ -484,41 +520,46 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
         """
         return self.node_contents_visit(node)
 
-    def visit_Interactive(self, node):
+    def visit_Interactive(self, node: ast.Interactive) -> _T_visit_return:
         """Allow single mode without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_List(self, node):
+    def visit_List(self, node: ast.List) -> _T_visit_return:
         """Allow list literals without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_Tuple(self, node):
+    def visit_Tuple(self, node: ast.Tuple) -> _T_visit_return:
         """Allow tuple literals without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_Set(self, node):
+    def visit_Set(self, node: ast.Set) -> _T_visit_return:
         """Allow set literals without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_Dict(self, node):
+    def visit_Dict(self, node: ast.Dict) -> _T_visit_return:
         """Allow dict literals without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_FormattedValue(self, node):
+    def visit_FormattedValue(
+            self,
+            node: ast.FormattedValue) -> _T_visit_return:
         """Allow f-strings without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_TemplateStr(self, node):
+    def visit_TemplateStr(self, node: ast.AST) -> _T_visit_return:
         """Template strings are allowed by default.
 
         As Template strings are a very basic template mechanism, that needs
         additional rendering logic to be useful, they are not blocked by
         default.
         Those rendering logic would be affected by RestrictedPython as well.
+
+        TODO: Change Type Annotation to ast.TemplateStr when
+              Support for Python 3.13 is dropped.
         """
         return self.node_contents_visit(node)
 
-    def visit_Interpolation(self, node):
+    def visit_Interpolation(self, node: ast.AST) -> _T_visit_return:
         """Interpolations are allowed by default.
 
         As Interpolations are part of Template Strings, they are needed
@@ -526,16 +567,19 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
         are allowed. As a user has to provide additional rendering logic
         to make use of Template Strings, the security implications of
         Interpolations are limited in the context of RestrictedPython.
+
+        TODO: Change Type Annotation to ast.Interpolation when
+              Support for Python 3.13 is dropped.
         """
         return self.node_contents_visit(node)
 
-    def visit_JoinedStr(self, node):
+    def visit_JoinedStr(self, node: ast.JoinedStr) -> _T_visit_return:
         """Allow joined string without restrictions."""
         return self.node_contents_visit(node)
 
     # ast for Variables
 
-    def visit_Name(self, node):
+    def visit_Name(self, node: ast.Name) -> _T_visit_return:
         """Prevents access to protected names.
 
         Converts use of the name 'printed' to this expression: '_print()'
@@ -544,6 +588,7 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
         node = self.node_contents_visit(node)
 
         if isinstance(node.ctx, ast.Load):
+            new_node: T_pos_ast
             if node.id == 'printed':
                 self.print_info.printed_used = True
                 new_node = ast.Call(
@@ -569,25 +614,25 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
         self.check_name(node, node.id)
         return node
 
-    def visit_Load(self, node):
+    def visit_Load(self, node: ast.Load) -> _T_visit_return:
         """
 
         """
         return self.node_contents_visit(node)
 
-    def visit_Store(self, node):
+    def visit_Store(self, node: ast.Store) -> _T_visit_return:
         """
 
         """
         return self.node_contents_visit(node)
 
-    def visit_Del(self, node):
+    def visit_Del(self, node: ast.Del) -> _T_visit_return:
         """
 
         """
         return self.node_contents_visit(node)
 
-    def visit_Starred(self, node):
+    def visit_Starred(self, node: ast.Starred) -> _T_visit_return:
         """
 
         """
@@ -595,18 +640,18 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
 
     # Expressions
 
-    def visit_Expression(self, node):
+    def visit_Expression(self, node: ast.Expression) -> _T_visit_return:
         """Allow Expression statements without restrictions.
 
         They are in the AST when using the `eval` compile mode.
         """
         return self.node_contents_visit(node)
 
-    def visit_Expr(self, node):
+    def visit_Expr(self, node: ast.Expr) -> _T_visit_return:
         """Allow Expr statements (any expression) without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_UnaryOp(self, node):
+    def visit_UnaryOp(self, node: ast.UnaryOp) -> _T_visit_return:
         """
         UnaryOp (Unary Operations) is the overall element for:
         * Not --> which should be allowed
@@ -615,135 +660,135 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
         """
         return self.node_contents_visit(node)
 
-    def visit_UAdd(self, node):
+    def visit_UAdd(self, node: ast.UAdd) -> _T_visit_return:
         """Allow positive notation of variables. (e.g. +var)"""
         return self.node_contents_visit(node)
 
-    def visit_USub(self, node):
+    def visit_USub(self, node: ast.USub) -> _T_visit_return:
         """Allow negative notation of variables. (e.g. -var)"""
         return self.node_contents_visit(node)
 
-    def visit_Not(self, node):
+    def visit_Not(self, node: ast.Not) -> _T_visit_return:
         """Allow the `not` operator."""
         return self.node_contents_visit(node)
 
-    def visit_Invert(self, node):
+    def visit_Invert(self, node: ast.Invert) -> _T_visit_return:
         """Allow `~` expressions."""
         return self.node_contents_visit(node)
 
-    def visit_BinOp(self, node):
+    def visit_BinOp(self, node: ast.BinOp) -> _T_visit_return:
         """Allow binary operations."""
         return self.node_contents_visit(node)
 
-    def visit_Add(self, node):
+    def visit_Add(self, node: ast.Add) -> _T_visit_return:
         """Allow `+` expressions."""
         return self.node_contents_visit(node)
 
-    def visit_Sub(self, node):
+    def visit_Sub(self, node: ast.Sub) -> _T_visit_return:
         """Allow `-` expressions."""
         return self.node_contents_visit(node)
 
-    def visit_Mult(self, node):
+    def visit_Mult(self, node: ast.Mult) -> _T_visit_return:
         """Allow `*` expressions."""
         return self.node_contents_visit(node)
 
-    def visit_Div(self, node):
+    def visit_Div(self, node: ast.Div) -> _T_visit_return:
         """Allow `/` expressions."""
         return self.node_contents_visit(node)
 
-    def visit_FloorDiv(self, node):
+    def visit_FloorDiv(self, node: ast.FloorDiv) -> _T_visit_return:
         """Allow `//` expressions."""
         return self.node_contents_visit(node)
 
-    def visit_Mod(self, node):
+    def visit_Mod(self, node: ast.Mod) -> _T_visit_return:
         """Allow `%` expressions."""
         return self.node_contents_visit(node)
 
-    def visit_Pow(self, node):
+    def visit_Pow(self, node: ast.Pow) -> _T_visit_return:
         """Allow `**` expressions."""
         return self.node_contents_visit(node)
 
-    def visit_LShift(self, node):
+    def visit_LShift(self, node: ast.LShift) -> _T_visit_return:
         """Allow `<<` expressions."""
         return self.node_contents_visit(node)
 
-    def visit_RShift(self, node):
+    def visit_RShift(self, node: ast.RShift) -> _T_visit_return:
         """Allow `>>` expressions."""
         return self.node_contents_visit(node)
 
-    def visit_BitOr(self, node):
+    def visit_BitOr(self, node: ast.BitOr) -> _T_visit_return:
         """Allow `|` expressions."""
         return self.node_contents_visit(node)
 
-    def visit_BitXor(self, node):
+    def visit_BitXor(self, node: ast.BitXor) -> _T_visit_return:
         """Allow `^` expressions."""
         return self.node_contents_visit(node)
 
-    def visit_BitAnd(self, node):
+    def visit_BitAnd(self, node: ast.BitAnd) -> _T_visit_return:
         """Allow `&` expressions."""
         return self.node_contents_visit(node)
 
-    def visit_MatMult(self, node):
+    def visit_MatMult(self, node: ast.MatMult) -> _T_visit_return:
         """Allow multiplication (`@`)."""
         return self.node_contents_visit(node)
 
-    def visit_BoolOp(self, node):
+    def visit_BoolOp(self, node: ast.BoolOp) -> _T_visit_return:
         """Allow bool operator without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_And(self, node):
+    def visit_And(self, node: ast.And) -> _T_visit_return:
         """Allow bool operator `and` without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_Or(self, node):
+    def visit_Or(self, node: ast.Or) -> _T_visit_return:
         """Allow bool operator `or` without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_Compare(self, node):
+    def visit_Compare(self, node: ast.Compare) -> _T_visit_return:
         """Allow comparison expressions without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_Eq(self, node):
+    def visit_Eq(self, node: ast.Eq) -> _T_visit_return:
         """Allow == expressions."""
         return self.node_contents_visit(node)
 
-    def visit_NotEq(self, node):
+    def visit_NotEq(self, node: ast.NotEq) -> _T_visit_return:
         """Allow != expressions."""
         return self.node_contents_visit(node)
 
-    def visit_Lt(self, node):
+    def visit_Lt(self, node: ast.Lt) -> _T_visit_return:
         """Allow < expressions."""
         return self.node_contents_visit(node)
 
-    def visit_LtE(self, node):
+    def visit_LtE(self, node: ast.LtE) -> _T_visit_return:
         """Allow <= expressions."""
         return self.node_contents_visit(node)
 
-    def visit_Gt(self, node):
+    def visit_Gt(self, node: ast.Gt) -> _T_visit_return:
         """Allow > expressions."""
         return self.node_contents_visit(node)
 
-    def visit_GtE(self, node):
+    def visit_GtE(self, node: ast.GtE) -> _T_visit_return:
         """Allow >= expressions."""
         return self.node_contents_visit(node)
 
-    def visit_Is(self, node):
+    def visit_Is(self, node: ast.Is) -> _T_visit_return:
         """Allow `is` expressions."""
         return self.node_contents_visit(node)
 
-    def visit_IsNot(self, node):
+    def visit_IsNot(self, node: ast.IsNot) -> _T_visit_return:
         """Allow `is not` expressions."""
         return self.node_contents_visit(node)
 
-    def visit_In(self, node):
+    def visit_In(self, node: ast.In) -> _T_visit_return:
         """Allow `in` expressions."""
         return self.node_contents_visit(node)
 
-    def visit_NotIn(self, node):
+    def visit_NotIn(self, node: ast.NotIn) -> _T_visit_return:
         """Allow `not in` expressions."""
         return self.node_contents_visit(node)
 
-    def visit_Call(self, node):
+    def visit_Call(self, node: ast.Call) -> _T_visit_return:
         """Checks calls with '*args' and '**kwargs'.
 
         Note: The following happens only if '*args' or '**kwargs' is used.
@@ -785,17 +830,17 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
         copy_locations(node.func, node.args[0])
         return node
 
-    def visit_keyword(self, node):
+    def visit_keyword(self, node: ast.keyword) -> _T_visit_return:
         """
 
         """
         return self.node_contents_visit(node)
 
-    def visit_IfExp(self, node):
+    def visit_IfExp(self, node: ast.IfExp) -> _T_visit_return:
         """Allow `if` expressions without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_Attribute(self, node):
+    def visit_Attribute(self, node: ast.Attribute) -> _T_visit_return:
         """Checks and mutates attribute access/assignment.
 
         'a.b' becomes '_getattr_(a, "b")'
@@ -851,7 +896,7 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
 
     # Subscripting
 
-    def visit_Subscript(self, node):
+    def visit_Subscript(self, node: ast.Subscript) -> _T_visit_return:
         """Transforms all kinds of subscripts.
 
         'foo[bar]' becomes '_getitem_(foo, bar)'
@@ -896,7 +941,7 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
             raise NotImplementedError(
                 f"Unknown ctx type: {type(node.ctx)}")
 
-    def visit_Slice(self, node):
+    def visit_Slice(self, node: ast.Slice) -> _T_visit_return:
         """
 
         """
@@ -904,31 +949,31 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
 
     # Comprehensions
 
-    def visit_ListComp(self, node):
+    def visit_ListComp(self, node: ast.ListComp) -> _T_visit_return:
         """
 
         """
         return self.node_contents_visit(node)
 
-    def visit_SetComp(self, node):
+    def visit_SetComp(self, node: ast.SetComp) -> _T_visit_return:
         """
 
         """
         return self.node_contents_visit(node)
 
-    def visit_GeneratorExp(self, node):
+    def visit_GeneratorExp(self, node: ast.GeneratorExp) -> _T_visit_return:
         """
 
         """
         return self.node_contents_visit(node)
 
-    def visit_DictComp(self, node):
+    def visit_DictComp(self, node: ast.DictComp) -> _T_visit_return:
         """
 
         """
         return self.node_contents_visit(node)
 
-    def visit_comprehension(self, node):
+    def visit_comprehension(self, node: ast.comprehension) -> _T_visit_return:
         """
 
         """
@@ -936,7 +981,7 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
 
     # Statements
 
-    def visit_Assign(self, node):
+    def visit_Assign(self, node: ast.Assign) -> _T_visit_return:
         """
 
         """
@@ -985,7 +1030,7 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
 
         return new_nodes
 
-    def visit_AugAssign(self, node):
+    def visit_AugAssign(self, node: ast.AugAssign) -> _T_visit_return:
         """Forbid certain kinds of AugAssign
 
         According to the language reference (and ast.c) the following nodes
@@ -1036,75 +1081,79 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
             raise NotImplementedError(
                 f"Unknown target type: {type(node.target)}")
 
-    def visit_Raise(self, node):
+    def visit_Raise(self, node: ast.Raise) -> _T_visit_return:
         """Allow `raise` statements without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_Assert(self, node):
+    def visit_Assert(self, node: ast.Assert) -> _T_visit_return:
         """Allow assert statements without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_Delete(self, node):
+    def visit_Delete(self, node: ast.Delete) -> _T_visit_return:
         """Allow `del` statements without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_Pass(self, node):
+    def visit_Pass(self, node: ast.Pass) -> _T_visit_return:
         """Allow `pass` statements without restrictions."""
         return self.node_contents_visit(node)
 
     # Imports
 
-    def visit_Import(self, node):
+    def visit_Import(self, node: ast.Import) -> _T_visit_return:
         """Allow `import` statements with restrictions.
         See check_import_names."""
         return self.check_import_names(node)
 
-    def visit_ImportFrom(self, node):
+    def visit_ImportFrom(self, node: ast.ImportFrom) -> _T_visit_return:
         """Allow `import from` statements with restrictions.
         See check_import_names."""
         return self.check_import_names(node)
 
-    def visit_alias(self, node):
+    def visit_alias(self, node: ast.alias) -> _T_visit_return:
         """Allow `as` statements in import and import from statements."""
         return self.node_contents_visit(node)
 
     # Control flow
 
-    def visit_If(self, node):
+    def visit_If(self, node: ast.If) -> _T_visit_return:
         """Allow `if` statements without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_For(self, node):
+    def visit_For(self, node: ast.For) -> _T_visit_return:
         """Allow `for` statements with some restrictions."""
         return self.guard_iter(node)
 
-    def visit_While(self, node):
+    def visit_While(self, node: ast.While) -> _T_visit_return:
         """Allow `while` statements."""
         return self.node_contents_visit(node)
 
-    def visit_Break(self, node):
+    def visit_Break(self, node: ast.Break) -> _T_visit_return:
         """Allow `break` statements without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_Continue(self, node):
+    def visit_Continue(self, node: ast.Continue) -> _T_visit_return:
         """Allow `continue` statements without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_Try(self, node):
+    def visit_Try(self, node: ast.Try) -> _T_visit_return:
         """Allow `try` without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_TryStar(self, node):
-        """Disallow `ExceptionGroup` due to a potential sandbox escape."""
+    def visit_TryStar(self, node: ast.AST) -> _T_visit_return:
+        """Disallow `ExceptionGroup` due to a potential sandbox escape.
+
+        TODO: Change Type Annotation to ast.TryStar when
+              Support for Python 3.10 is dropped.
+        """
         self.not_allowed(node)
 
-    def visit_ExceptHandler(self, node):
+    def visit_ExceptHandler(self, node: ast.ExceptHandler) -> _T_visit_return:
         """Protect exception handlers."""
         node = self.node_contents_visit(node)
         self.check_name(node, node.name)
         return node
 
-    def visit_With(self, node):
+    def visit_With(self, node: ast.With) -> _T_visit_return:
         """Protect tuple unpacking on with statements."""
         node = self.node_contents_visit(node)
 
@@ -1119,13 +1168,13 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
 
         return node
 
-    def visit_withitem(self, node):
+    def visit_withitem(self, node: ast.withitem) -> _T_visit_return:
         """Allow `with` statements (context managers) without restrictions."""
         return self.node_contents_visit(node)
 
     # Function and class definitions
 
-    def visit_FunctionDef(self, node):
+    def visit_FunctionDef(self, node: ast.FunctionDef) -> _T_visit_return:
         """Allow function definitions (`def`) with some restrictions."""
         self.check_name(node, node.name, allow_magic_methods=True)
         self.check_function_argument_names(node)
@@ -1135,44 +1184,44 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
             self.inject_print_collector(node)
         return node
 
-    def visit_Lambda(self, node):
+    def visit_Lambda(self, node: ast.Lambda) -> _T_visit_return:
         """Allow lambda with some restrictions."""
         self.check_function_argument_names(node)
         return self.node_contents_visit(node)
 
-    def visit_arguments(self, node):
+    def visit_arguments(self, node: ast.arguments) -> _T_visit_return:
         """
 
         """
         return self.node_contents_visit(node)
 
-    def visit_arg(self, node):
+    def visit_arg(self, node: ast.arg) -> _T_visit_return:
         """
 
         """
         return self.node_contents_visit(node)
 
-    def visit_Return(self, node):
+    def visit_Return(self, node: ast.Return) -> _T_visit_return:
         """Allow `return` statements without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_Yield(self, node):
+    def visit_Yield(self, node: ast.Yield) -> _T_visit_return:
         """Allow `yield`statements without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_YieldFrom(self, node):
+    def visit_YieldFrom(self, node: ast.YieldFrom) -> _T_visit_return:
         """Allow `yield`statements without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_Global(self, node):
+    def visit_Global(self, node: ast.Global) -> _T_visit_return:
         """Allow `global` statements without restrictions."""
         return self.node_contents_visit(node)
 
-    def visit_Nonlocal(self, node):
+    def visit_Nonlocal(self, node: ast.Nonlocal) -> _T_visit_return:
         """Deny `nonlocal` statements."""
         self.not_allowed(node)
 
-    def visit_ClassDef(self, node):
+    def visit_ClassDef(self, node: ast.ClassDef) -> _T_visit_return:
         """Check the name of a class definition."""
         self.check_name(node, node.name)
         node = self.node_contents_visit(node)
@@ -1183,13 +1232,14 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
             class {0.name}(metaclass=__metaclass__):
                 pass
         '''.format(node))
-        new_class_node = ast.parse(CLASS_DEF).body[0]
+        new_class_node = typing.cast(
+            ast.ClassDef, ast.parse(CLASS_DEF).body[0])
         new_class_node.body = node.body
         new_class_node.bases = node.bases
         new_class_node.decorator_list = node.decorator_list
         return new_class_node
 
-    def visit_Module(self, node):
+    def visit_Module(self, node: ast.Module) -> _T_visit_return:
         """Add the print_collector (only if print is used) at the top."""
         node = self.node_contents_visit(node)
 
@@ -1207,25 +1257,26 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
 
     # Async und await
 
-    def visit_AsyncFunctionDef(self, node):
+    def visit_AsyncFunctionDef(
+            self, node: ast.AsyncFunctionDef) -> _T_visit_return:
         """Deny async functions."""
         self.not_allowed(node)
 
-    def visit_Await(self, node):
+    def visit_Await(self, node: ast.Await) -> _T_visit_return:
         """Deny async functionality."""
         self.not_allowed(node)
 
-    def visit_AsyncFor(self, node):
+    def visit_AsyncFor(self, node: ast.AsyncFor) -> _T_visit_return:
         """Deny async functionality."""
         self.not_allowed(node)
 
-    def visit_AsyncWith(self, node):
+    def visit_AsyncWith(self, node: ast.AsyncWith) -> _T_visit_return:
         """Deny async functionality."""
         self.not_allowed(node)
 
     # Assignment expressions (walrus operator ``:=``)
     # New in 3.8
-    def visit_NamedExpr(self, node):
+    def visit_NamedExpr(self, node: ast.NamedExpr) -> _T_visit_return:
         """Allow assignment expressions under some circumstances."""
         # while the grammar requires ``node.target`` to be a ``Name``
         # the abstract syntax is more permissive and allows an ``expr``.
@@ -1237,7 +1288,7 @@ class RestrictingNodeTransformer(ast.NodeTransformer):
         node = self.node_contents_visit(node)  # this checks ``node.target``
         target = node.target
         if not isinstance(target, ast.Name):
-            self.error(
+            self.error(  # type: ignore[unreachable]
                 node,
                 "Assignment expressions are only allowed for simple targets")
         return node