dbus-fast 4.2.0__tar.gz → 4.2.2__tar.gz

{dbus_fast-4.2.0 → dbus_fast-4.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dbus-fast
-Version: 4.2.0
+Version: 4.2.2
 Summary: A faster version of dbus-next
 License: MIT
 License-File: LICENSE

{dbus_fast-4.2.0 → dbus_fast-4.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "dbus-fast"
-version = "4.2.0"
+version = "4.2.2"
 description = "A faster version of dbus-next"
 authors = ["Bluetooth Devices Authors <bluetooth@koston.org>"]
 license = "MIT"

{dbus_fast-4.2.0 → dbus_fast-4.2.2}/setup.py

@@ -12,7 +12,7 @@ package_data = \
 
 setup_kwargs = {
     'name': 'dbus-fast',
-    'version': '4.2.0',
+    'version': '4.2.2',
     'description': 'A faster version of dbus-next',
     'long_description': '# dbus-fast\n\n<p align="center">\n  <a href="https://github.com/bluetooth-devices/dbus-fast/actions?query=workflow%3ACI">\n    <img src="https://img.shields.io/github/workflow/status/bluetooth-devices/dbus-fast/CI/main?label=CI&logo=github&style=flat-square" alt="CI Status" >\n  </a>\n  <a href="https://dbus-fast.readthedocs.io">\n    <img src="https://img.shields.io/readthedocs/dbus-fast.svg?logo=read-the-docs&logoColor=fff&style=flat-square" alt="Documentation Status">\n  </a>\n  <a href="https://codecov.io/gh/bluetooth-devices/dbus-fast">\n    <img src="https://img.shields.io/codecov/c/github/bluetooth-devices/dbus-fast.svg?logo=codecov&logoColor=fff&style=flat-square" alt="Test coverage percentage">\n  </a>\n</p>\n<p align="center">\n  <a href="https://python-poetry.org/">\n    <img src="https://img.shields.io/badge/packaging-poetry-299bd7?style=flat-square&logo=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAA4AAAASCAYAAABrXO8xAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAJJSURBVHgBfZLPa1NBEMe/s7tNXoxW1KJQKaUHkXhQvHgW6UHQQ09CBS/6V3hKc/AP8CqCrUcpmop3Cx48eDB4yEECjVQrlZb80CRN8t6OM/teagVxYZi38+Yz853dJbzoMV3MM8cJUcLMSUKIE8AzQ2PieZzFxEJOHMOgMQQ+dUgSAckNXhapU/NMhDSWLs1B24A8sO1xrN4NECkcAC9ASkiIJc6k5TRiUDPhnyMMdhKc+Zx19l6SgyeW76BEONY9exVQMzKExGKwwPsCzza7KGSSWRWEQhyEaDXp6ZHEr416ygbiKYOd7TEWvvcQIeusHYMJGhTwF9y7sGnSwaWyFAiyoxzqW0PM/RjghPxF2pWReAowTEXnDh0xgcLs8l2YQmOrj3N7ByiqEoH0cARs4u78WgAVkoEDIDoOi3AkcLOHU60RIg5wC4ZuTC7FaHKQm8Hq1fQuSOBvX/sodmNJSB5geaF5CPIkUeecdMxieoRO5jz9bheL6/tXjrwCyX/UYBUcjCaWHljx1xiX6z9xEjkYAzbGVnB8pvLmyXm9ep+W8CmsSHQQY77Zx1zboxAV0w7ybMhQmfqdmmw3nEp1I0Z+FGO6M8LZdoyZnuzzBdjISicKRnpxzI9fPb+0oYXsNdyi+d3h9bm9MWYHFtPeIZfLwzmFDKy1ai3p+PDls1Llz4yyFpferxjnyjJDSEy9CaCx5m2cJPerq6Xm34eTrZt3PqxYO1XOwDYZrFlH1fWnpU38Y9HRze3lj0vOujZcXKuuXm3jP+s3KbZVra7y2EAAAAAASUVORK5CYII=" alt="Poetry">\n  </a>\n  <a href="https://github.com/astral-sh/ruff">\n    <img src="https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json" alt="Ruff">\n  </a>\n  <a href="https://github.com/pre-commit/pre-commit">\n    <img src="https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit&logoColor=white&style=flat-square" alt="pre-commit">\n  </a>\n  <a href="https://codspeed.io/Bluetooth-Devices/dbus-fast"><img src="https://img.shields.io/endpoint?url=https://codspeed.io/badge.json" alt="CodSpeed Badge"/></a>\n</p>\n<p align="center">\n  <a href="https://pypi.org/project/dbus-fast/">\n    <img src="https://img.shields.io/pypi/v/dbus-fast.svg?logo=python&logoColor=fff&style=flat-square" alt="PyPI Version">\n  </a>\n  <img src="https://img.shields.io/pypi/pyversions/dbus-fast.svg?style=flat-square&logo=python&amp;logoColor=fff" alt="Supported Python versions">\n  <img src="https://img.shields.io/pypi/l/dbus-fast.svg?style=flat-square" alt="License">\n</p>\n\nA faster version of dbus-next originally from the [great DBus next library](https://github.com/altdesktop/python-dbus-next) ❤️\n\n## Installation\n\nInstall this via pip (or your favourite package manager):\n\n`pip install dbus-fast`\n\n[Documentation](https://dbus-fast.readthedocs.io/en/latest/)\n\ndbus-fast is a Python library for DBus that aims to be a performant fully featured high level library primarily geared towards integration of applications into Linux desktop and mobile environments.\n\nDesktop application developers can use this library for integrating their applications into desktop environments by implementing common DBus standard interfaces or creating custom plugin interfaces.\n\nDesktop users can use this library to create their own scripts and utilities to interact with those interfaces for customization of their desktop environment.\n\ndbus-fast plans to improve over other DBus libraries for Python in the following ways:\n\n- Zero dependencies and pure Python 3\n- An optional cython extension is available to speed up (un)marshalling\n- Focus on performance\n- Support for multiple IO backends including asyncio and the GLib main loop.\n- Nonblocking IO suitable for GUI development.\n- Target the latest language features of Python for beautiful services and clients.\n- Complete implementation of the DBus type system without ever guessing types.\n- Integration tests for all features of the library.\n- Completely documented public API.\n\n## Installing\n\nThis library is available on PyPi as [dbus-fast](https://pypi.org/project/dbus-fast/).\n\n```\npip3 install dbus-fast\n```\n\n## The Client Interface\n\nTo use a service on the bus, the library constructs a proxy object you can use to call methods, get and set properties, and listen to signals.\n\nFor more information, see the [overview for the high-level client](https://dbus-fast.readthedocs.io/en/latest/high-level-client/index.html).\n\nThis example connects to a media player and controls it with the [MPRIS](https://specifications.freedesktop.org/mpris-spec/latest/) DBus interface.\n\n```python\nfrom dbus_fast.aio import MessageBus\n\nimport asyncio\n\n\nasync def main():\n    bus = await MessageBus().connect()\n    # the introspection xml would normally be included in your project, but\n    # this is convenient for development\n    introspection = await bus.introspect(\'org.mpris.MediaPlayer2.vlc\', \'/org/mpris/MediaPlayer2\')\n\n    obj = bus.get_proxy_object(\'org.mpris.MediaPlayer2.vlc\', \'/org/mpris/MediaPlayer2\', introspection)\n    player = obj.get_interface(\'org.mpris.MediaPlayer2.Player\')\n    properties = obj.get_interface(\'org.freedesktop.DBus.Properties\')\n\n    # call methods on the interface (this causes the media player to play)\n    await player.call_play()\n\n    volume = await player.get_volume()\n    print(f\'current volume: {volume}, setting to 0.5\')\n\n    await player.set_volume(0.5)\n\n    # listen to signals\n    def on_properties_changed(interface_name, changed_properties, invalidated_properties):\n        for changed, variant in changed_properties.items():\n            print(f\'property changed: {changed} - {variant.value}\')\n\n    properties.on_properties_changed(on_properties_changed)\n\n    await asyncio.Event().wait()\n\nasyncio.run(main())\n```\n\n## The Service Interface\n\nTo define a service on the bus, use the `ServiceInterface` class and decorate class methods to specify DBus methods, properties, and signals with their type signatures.\n\nFor more information, see the [overview for the high-level service](https://dbus-fast.readthedocs.io/en/latest/high-level-service/index.html).\n\n```python\nfrom dbus_fast.annotations import DBusStr, DBusDict\nfrom dbus_fast.service import ServiceInterface, dbus_method, dbus_property, dbus_signal\nfrom dbus_fast import Variant\nfrom dbus_fast.aio import MessageBus\n\nimport asyncio\n\nclass ExampleInterface(ServiceInterface):\n    def __init__(self, name):\n        super().__init__(name)\n        self._string_prop = \'kevin\'\n\n    @dbus_method()\n    def Echo(self, what: DBusStr) -> DBusStr:\n        return what\n\n    @dbus_method()\n    def GetVariantDict(self) -> DBusDict:\n        return {\n            \'foo\': Variant(\'s\', \'bar\'),\n            \'bat\': Variant(\'x\', -55),\n            \'a_list\': Variant(\'as\', [\'hello\', \'world\'])\n        }\n\n    @dbus_property()\n    def string_prop(self) -> DBusStr:\n        return self._string_prop\n\n    @string_prop.setter\n    def string_prop_setter(self, val: DBusStr):\n        self._string_prop = val\n\n    @dbus_signal()\n    def signal_simple(self) -> DBusStr:\n        return \'hello\'\n\nasync def main():\n    bus = await MessageBus().connect()\n    interface = ExampleInterface(\'test.interface\')\n    bus.export(\'/test/path\', interface)\n    # now that we are ready to handle requests, we can request name from D-Bus\n    await bus.request_name(\'test.name\')\n    # wait indefinitely\n    await asyncio.Event().wait()\n\nasyncio.run(main())\n```\n\n## The Low-Level Interface\n\nThe low-level interface works with DBus messages directly.\n\nFor more information, see the [overview for the low-level interface](https://dbus-fast.readthedocs.io/en/latest/low-level-interface/index.html).\n\n```python\nfrom dbus_fast.message import Message, MessageType\nfrom dbus_fast.aio import MessageBus\n\nimport asyncio\nimport json\n\n\nasync def main():\n    bus = await MessageBus().connect()\n\n    reply = await bus.call(\n        Message(destination=\'org.freedesktop.DBus\',\n                path=\'/org/freedesktop/DBus\',\n                interface=\'org.freedesktop.DBus\',\n                member=\'ListNames\'))\n\n    if reply.message_type == MessageType.ERROR:\n        raise Exception(reply.body[0])\n\n    print(json.dumps(reply.body[0], indent=2))\n\n\nasyncio.run(main())\n```\n\n## Projects that use dbus-fast\n\n- [Bluetooth Adapters](https://github.com/bluetooth-devices/bluetooth-adapters)\n\n## Contributing\n\nContributions are welcome. Development happens on [Github](https://github.com/Bluetooth-Devices/dbus-fast).\n\nBefore you commit, run `pre-commit run --all-files` to run the linter, code formatter, and the test suite.\n\n## Copyright\n\nYou can use this code under an MIT license (see LICENSE).\n\n- © 2019, Tony Crisci\n- © 2022, Bluetooth Devices authors\n\n## Contributors ✨\n\nThanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):\n\n<!-- prettier-ignore-start -->\n<!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section -->\n<!-- markdownlint-disable -->\n<!-- markdownlint-enable -->\n<!-- ALL-CONTRIBUTORS-LIST:END -->\n<!-- prettier-ignore-end -->\n\nThis project follows the [all-contributors](https://github.com/all-contributors/all-contributors) specification. Contributions of any kind welcome!\n\n## Credits\n\nThis package was created with\n[Cookiecutter](https://github.com/audreyr/cookiecutter) and the\n[browniebroke/cookiecutter-pypackage](https://github.com/browniebroke/cookiecutter-pypackage)\nproject template.\n',
     'author': 'Bluetooth Devices Authors',

{dbus_fast-4.2.0 → dbus_fast-4.2.2}/src/dbus_fast/__version__.py

@@ -3,7 +3,7 @@ __description__ = (
     "A performant zero-dependency DBus library for Python with asyncio support"
 )
 __url__ = "https://github.com/bluetooth-devices/dbus-fast"
-__version__ = "4.2.0"
+__version__ = "4.2.2"
 __author__ = "Bluetooth Devices authors, Tony Crisci"
 __author_email__ = "bluetooth@koston.org"
 __license__ = "MIT"

{dbus_fast-4.2.0 → dbus_fast-4.2.2}/src/dbus_fast/introspection.py

@@ -1,4 +1,5 @@
 import xml.etree.ElementTree as ET
+import xml.parsers.expat as _expat
 
 from .constants import ArgDirection, PropertyAccess
 from .errors import InvalidIntrospectionError
@@ -8,6 +9,51 @@ from .validators import assert_interface_name_valid, assert_member_name_valid
 # https://dbus.freedesktop.org/doc/dbus-specification.html#introspection-format
 
 
+def _reject_internal_subset(
+    _name: str,
+    _sysid: str | None,
+    _pubid: str | None,
+    has_internal_subset: bool,
+) -> None:
+    # The standard D-Bus introspection DOCTYPE is PUBLIC-only with no
+    # internal subset. Any `[ ... ]` block in the DOCTYPE is therefore
+    # either the billion-laughs / quadratic-blowup ENTITY vector, an
+    # ATTLIST default-value amplification, or an XXE attempt from a
+    # hostile peer — reject the whole subset as a single boundary.
+    if has_internal_subset:
+        raise InvalidIntrospectionError(
+            "internal DTD subsets are not allowed in introspection XML"
+        )
+
+
+def _parse_introspection_xml(data: str) -> ET.Element:
+    """Parse introspection XML with the DTD-based amplification vectors closed."""
+    # namespace_separator="}" mirrors ElementTree's expat config so a
+    # namespaced root (`<node xmlns="urn:x">`) still surfaces with a
+    # non-"node" tag and gets rejected by the root-element check below
+    # rather than slipping through this stricter parser.
+    parser = _expat.ParserCreate(namespace_separator="}")
+    builder = ET.TreeBuilder()
+    parser.StartElementHandler = builder.start
+    parser.EndElementHandler = builder.end
+    parser.CharacterDataHandler = builder.data
+    parser.StartDoctypeDeclHandler = _reject_internal_subset
+    # Defense-in-depth: refuse to expand parameter entities, which is the
+    # path expat would otherwise take to fetch external DTDs.
+    parser.SetParamEntityParsing(_expat.XML_PARAM_ENTITY_PARSING_NEVER)
+    try:
+        parser.Parse(data.encode("utf-8") if isinstance(data, str) else data, True)
+    except _expat.ExpatError as e:
+        # Preserve the code / position metadata ElementTree attaches to
+        # ParseError so callers that inspect them (e.position, e.code) keep
+        # working as they did with ET.fromstring.
+        err = ET.ParseError(e)
+        err.code = e.code
+        err.position = (e.lineno, e.offset)
+        raise err from e
+    return builder.close()
+
+
 def _fetch_annotations(element: ET.Element) -> dict[str, str]:
     annotations: dict[str, str] = {}
 
@@ -532,7 +578,7 @@ class Node:
         :raises:
             - :class:`InvalidIntrospectionError <dbus_fast.InvalidIntrospectionError>` - If the string is not valid introspection data.
         """
-        element = ET.fromstring(data)
+        element = _parse_introspection_xml(data)
         if element.tag != "node":
             raise InvalidIntrospectionError(
                 'introspection data must have a "node" for the root element'

{dbus_fast-4.2.0 → dbus_fast-4.2.2}/src/dbus_fast/signature.py

@@ -473,7 +473,12 @@ class Variant:  # noqa: PLW1641
         return f"<dbus_fast.signature.Variant ('{self.type.signature}', {self.value})>"
 
 
-get_signature_tree = lru_cache(maxsize=None)(SignatureTree)
+# Bound the cache so a peer streaming messages with unique attacker-chosen
+# signatures (signatures up to 255 bytes, body-side signatures pass through
+# get_signature_tree in the unmarshaller) cannot grow this dict without
+# limit and OOM the process. 4096 entries covers every signature emitted
+# by real-world D-Bus services many times over.
+get_signature_tree = lru_cache(maxsize=4096)(SignatureTree)
 """Get a signature tree for the given signature.
 
 :param signature: The signature to get a tree for.