11251390227

Committed 09 Oct 2024 07:10AM UTC coverage: 81.668% (+0.09%) from 81.58%

Build # 11251390227

Build Type

push

github

Committed by

perrinjerome

Commit Message

Align behavior with objects raising in `__getattr__`

The observed problem was a behavior different between C and python
implementation on python 3, happening with Zope python script. When the
context can not be accessed by the current user, Zope binds a
`Shared.DC.Scripts.Bindings.UnauthorizedBinding`, a class that raises an
Unauthorized error when the context is actually accessed, in order to
postpone the Unauthorized if something is actually accessed. This class
does implements this by raising Unauthorized in `__getattr__`.

The python implementation of `rolesForPermissionOn` used `hasattr` and
`hasattr` has changed between python2 and python3, on python2 it was
ignoring all exceptions, including potential Unauthorized errors and
just returning False, but on python3 these errors are now raised.
This change of behavior of python causes `rolesForPermissionOn` to
behave differently: when using python implementation on python2 or when
using C implementation, such Unauthorized errors were gracefully handled
and caused `checkPermission` to return False, but on python3 the
Unauthorized is raised.

The C implementation of `rolesForPermissionOn` uses a construct
equivalent to the python2 version of `hasattr`. For consistency - and
because ignoring errors is usually not good - we also want to change it
to be have like the python3 implementation.

This change make this scenario behave the same between python and C
implementations:
 - `Unauthorized` errors raised in `__getattr__` are supported on py3.
 - Other errors  than `AttributeError` and `Unauthorized` raised in
    `__getattr__` are no longer ignored in the C implementation.

Run Details

1004 of 1526 branches covered (65.79%)

Branch coverage included in aggregate %.

32 of 32 new or added lines in 3 files covered. (100.0%)

81 existing lines in 3 files now uncovered.

5095 of 5942 relevant lines covered (85.75%)

5.14 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

95.31

/src/AccessControl/tests/testPermissionRole.py

##############################################################################
#
# Copyright (c) 2002 Zope Foundation and Contributors.
#
# This software is subject to the provisions of the Zope Public License,
# Version 2.1 (ZPL).  A copy of the ZPL should accompany this distribution.
# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY AND ALL EXPRESS OR IMPLIED
# WARRANTIES ARE DISCLAIMED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF TITLE, MERCHANTABILITY, AGAINST INFRINGEMENT, AND FITNESS
# FOR A PARTICULAR PURPOSE
#
##############################################################################
"""Tests of PermissionRole
"""

import unittest

from Acquisition import Explicit
from Acquisition import Implicit
from Acquisition import aq_base

from ..Implementation import PURE_PYTHON


ViewPermission = 'View'
EditThingsPermission = 'Edit Things!'
DeletePermission = 'Delete'


class AppRoot(Explicit):
    _View_Permission = None
    _Edit_Things__Permission = ('Manager', 'Owner')
    # No default for delete permission.


class ImplicitContainer(Implicit):
    pass


class ExplicitContainer(Explicit):
    pass


class RestrictiveObject(Implicit):
    _View_Permission = ('Manager',)
    _Delete_Permission = ()  # Nobody


class PermissiveObject(Explicit):
    _Edit_Things__Permission = ['Anonymous']


class PermissionRoleTestBase:

    def assertPRoles(self, ob, permission, expect):
        """
        Asserts that in the context of ob, the given permission maps to
        the given roles.
        """
        pr = self._getTargetClass()(permission)
        roles = pr.__of__(ob)
        roles2 = aq_base(pr).__of__(ob)
        assert roles == roles2 or tuple(roles) == tuple(roles2), (
            'Different methods of checking roles computed unequal results')
        same = 0
        if roles:
            # When verbose security is enabled, permission names are
            # embedded in the computed roles.  Remove the permission
            # names.
            roles = [r for r in roles if not r.endswith('_Permission')]

        if roles is None or expect is None:
            if (roles is None or tuple(roles) == ('Anonymous', )) and \
                    (expect is None or tuple(expect) == ('Anonymous', )):
                same = 1
        else:
            got = {}
            for r in roles:
                got[r] = 1
            expected = {}
            for r in expect:
                expected[r] = 1
            if got == expected:  # Dict compare does the Right Thing.
                same = 1
        self.assertTrue(same, f'Expected roles: {expect!r}, got: {roles!r}')

    def testRestrictive(self, explicit=0):
        app = AppRoot()
        if explicit:
            app.c = ExplicitContainer()
        else:
            app.c = ImplicitContainer()
        app.c.o = RestrictiveObject()
        o = app.c.o
        self.assertPRoles(o, ViewPermission, ('Manager', ))
        self.assertPRoles(o, EditThingsPermission, ('Manager', 'Owner'))
        self.assertPRoles(o, DeletePermission, ())

    def testPermissive(self, explicit=0):
        app = AppRoot()
        if explicit:
            app.c = ExplicitContainer()
        else:
            app.c = ImplicitContainer()
        app.c.o = PermissiveObject()
        o = app.c.o
        self.assertPRoles(o, ViewPermission, ('Anonymous', ))
        self.assertPRoles(o, EditThingsPermission, ('Anonymous',
                                                    'Manager',
                                                    'Owner'))
        self.assertPRoles(o, DeletePermission, ('Manager', ))

    def testExplicit(self):
        self.testRestrictive(1)
        self.testPermissive(1)

    def testAppDefaults(self):
        o = AppRoot()
        self.assertPRoles(o, ViewPermission, ('Anonymous', ))
        self.assertPRoles(o, EditThingsPermission, ('Manager', 'Owner'))
        self.assertPRoles(o, DeletePermission, ('Manager', ))

    def testPermissionRoleSupportsGetattr(self):
        a = self._getTargetClass()('a')
        self.assertEqual(getattr(a, '__roles__'), ('Manager', ))
        self.assertEqual(getattr(a, '_d'), ('Manager', ))
        self.assertEqual(getattr(a, '__name__'), 'a')
        self.assertEqual(getattr(a, '_p'), '_a_Permission')

    def testErrorsDuringGetattr(self):
        pr = self._getTargetClass()('View')

        class AttributeErrorObject(Implicit):
            pass
        self.assertEqual(
            tuple(pr.__of__(AttributeErrorObject())), ('Manager', ))

        # Unauthorized errors are tolerated and equivalent to no
        # permission declaration
        class UnauthorizedErrorObject(Implicit):
            def __getattr__(self, name):
                from zExceptions import Unauthorized
                if name == '_View_Permission':
                    raise Unauthorized(name)
                raise AttributeError(name)
        self.assertEqual(
            tuple(pr.__of__(UnauthorizedErrorObject())), ('Manager', ))

        # other exceptions propagate
        class ErrorObject(Implicit):
            def __getattr__(self, name):
                if name == '_View_Permission':
                    raise RuntimeError("Error raised during getattr")
                raise AttributeError(name)
        with self.assertRaisesRegex(RuntimeError, "Error raised during getattr"):
            tuple(pr.__of__(ErrorObject()))


class Python_PermissionRoleTests(PermissionRoleTestBase, unittest.TestCase):
    def _getTargetClass(self):
        from AccessControl.ImplPython import PermissionRole
        return PermissionRole


@unittest.skipIf(PURE_PYTHON, reason="Test expects C impl.")
class C__PermissionRoleTests(PermissionRoleTestBase, unittest.TestCase):
    def _getTargetClass(self):
        from AccessControl.ImplC import PermissionRole
        return PermissionRole

1	##############################################################################
2	#
3	# Copyright (c) 2002 Zope Foundation and Contributors.
4	#
5	# This software is subject to the provisions of the Zope Public License,
6	# Version 2.1 (ZPL). A copy of the ZPL should accompany this distribution.
7	# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY AND ALL EXPRESS OR IMPLIED
8	# WARRANTIES ARE DISCLAIMED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
9	# WARRANTIES OF TITLE, MERCHANTABILITY, AGAINST INFRINGEMENT, AND FITNESS
10	# FOR A PARTICULAR PURPOSE
11	#
12	##############################################################################
13	"""Tests of PermissionRole	6✔
14	"""
15
16	import unittest	6✔
17
18	from Acquisition import Explicit	6✔
19	from Acquisition import Implicit	6✔
20	from Acquisition import aq_base	6✔
21
22	from ..Implementation import PURE_PYTHON	6✔
23
24
25	ViewPermission = 'View'	6✔
26	EditThingsPermission = 'Edit Things!'	6✔
27	DeletePermission = 'Delete'	6✔
28
29
30	class AppRoot(Explicit):	6✔
31	_View_Permission = None	6✔
32	_Edit_Things__Permission = ('Manager', 'Owner')	6✔
33	# No default for delete permission.
34
35
36	class ImplicitContainer(Implicit):	6✔
37	pass	6✔
38
39
40	class ExplicitContainer(Explicit):	6✔
41	pass	6✔
42
43
44	class RestrictiveObject(Implicit):	6✔
45	_View_Permission = ('Manager',)	6✔
46	_Delete_Permission = () # Nobody	6✔
47
48
49	class PermissiveObject(Explicit):	6✔
50	_Edit_Things__Permission = ['Anonymous']	6✔
51
52
53	class PermissionRoleTestBase:	6✔
54
55	def assertPRoles(self, ob, permission, expect):	6✔
56	"""
57	Asserts that in the context of ob, the given permission maps to
58	the given roles.
59	"""
60	pr = self._getTargetClass()(permission)	6✔
61	roles = pr.__of__(ob)	6✔
62	roles2 = aq_base(pr).__of__(ob)	6✔
63	assert roles == roles2 or tuple(roles) == tuple(roles2), (	6✔
64	'Different methods of checking roles computed unequal results')
65	same = 0	6✔
66	if roles:	6✔
67	# When verbose security is enabled, permission names are
68	# embedded in the computed roles. Remove the permission
69	# names.
70	roles = [r for r in roles if not r.endswith('_Permission')]	6✔
71
72	if roles is None or expect is None:	6!
73	if (roles is None or tuple(roles) == ('Anonymous', )) and \	×
74	(expect is None or tuple(expect) == ('Anonymous', )):
UNCOV 75	same = 1	×
76	else:
77	got = {}	6✔
78	for r in roles:	6✔
79	got[r] = 1	6✔
80	expected = {}	6✔
81	for r in expect:	6✔
82	expected[r] = 1	6✔
83	if got == expected: # Dict compare does the Right Thing.	6!
84	same = 1	6✔
85	self.assertTrue(same, f'Expected roles: {expect!r}, got: {roles!r}')	6✔
86
87	def testRestrictive(self, explicit=0):	6✔
88	app = AppRoot()	6✔
89	if explicit:	6✔
90	app.c = ExplicitContainer()	6✔
91	else:
92	app.c = ImplicitContainer()	6✔
93	app.c.o = RestrictiveObject()	6✔
94	o = app.c.o	6✔
95	self.assertPRoles(o, ViewPermission, ('Manager', ))	6✔
96	self.assertPRoles(o, EditThingsPermission, ('Manager', 'Owner'))	6✔
97	self.assertPRoles(o, DeletePermission, ())	6✔
98
99	def testPermissive(self, explicit=0):	6✔
100	app = AppRoot()	6✔
101	if explicit:	6✔
102	app.c = ExplicitContainer()	6✔
103	else:
104	app.c = ImplicitContainer()	6✔
105	app.c.o = PermissiveObject()	6✔
106	o = app.c.o	6✔
107	self.assertPRoles(o, ViewPermission, ('Anonymous', ))	6✔
108	self.assertPRoles(o, EditThingsPermission, ('Anonymous',	6✔
109	'Manager',
110	'Owner'))
111	self.assertPRoles(o, DeletePermission, ('Manager', ))	6✔
112
113	def testExplicit(self):	6✔
114	self.testRestrictive(1)	6✔
115	self.testPermissive(1)	6✔
116
117	def testAppDefaults(self):	6✔
118	o = AppRoot()	6✔
119	self.assertPRoles(o, ViewPermission, ('Anonymous', ))	6✔
120	self.assertPRoles(o, EditThingsPermission, ('Manager', 'Owner'))	6✔
121	self.assertPRoles(o, DeletePermission, ('Manager', ))	6✔
122
123	def testPermissionRoleSupportsGetattr(self):	6✔
124	a = self._getTargetClass()('a')	6✔
125	self.assertEqual(getattr(a, '__roles__'), ('Manager', ))	6✔
126	self.assertEqual(getattr(a, '_d'), ('Manager', ))	6✔
127	self.assertEqual(getattr(a, '__name__'), 'a')	6✔
128	self.assertEqual(getattr(a, '_p'), '_a_Permission')	6✔
129
130	def testErrorsDuringGetattr(self):	6✔
131	pr = self._getTargetClass()('View')	6✔
132
133	class AttributeErrorObject(Implicit):	6✔
134	pass	6✔
135	self.assertEqual(	6✔
136	tuple(pr.__of__(AttributeErrorObject())), ('Manager', ))
137
138	# Unauthorized errors are tolerated and equivalent to no
139	# permission declaration
140	class UnauthorizedErrorObject(Implicit):	6✔
141	def __getattr__(self, name):	6✔
142	from zExceptions import Unauthorized	6✔
143	if name == '_View_Permission':	6✔
144	raise Unauthorized(name)	6✔
145	raise AttributeError(name)	6✔
146	self.assertEqual(	6✔
147	tuple(pr.__of__(UnauthorizedErrorObject())), ('Manager', ))
148
149	# other exceptions propagate
150	class ErrorObject(Implicit):	6✔
151	def __getattr__(self, name):	6✔
152	if name == '_View_Permission':	6✔
153	raise RuntimeError("Error raised during getattr")	6✔
154	raise AttributeError(name)	6✔
155	with self.assertRaisesRegex(RuntimeError, "Error raised during getattr"):	6✔
156	tuple(pr.__of__(ErrorObject()))	6✔
157
158
159	class Python_PermissionRoleTests(PermissionRoleTestBase, unittest.TestCase):	6✔
160	def _getTargetClass(self):	6✔
161	from AccessControl.ImplPython import PermissionRole	6✔
162	return PermissionRole	6✔
163
164
165	@unittest.skipIf(PURE_PYTHON, reason="Test expects C impl.")	6✔
166	class C__PermissionRoleTests(PermissionRoleTestBase, unittest.TestCase):	6✔
167	def _getTargetClass(self):	6✔
168	from AccessControl.ImplC import PermissionRole	6✔
169	return PermissionRole	6✔

zopefoundation / AccessControl / 11251390227

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous