zopefoundation / AccessControl / 41085348020

83%

push

github

Add freeze_security_declarations. (#172)

* Add freeze_security_declarations.

Call it once all code has been loaded, for example when Zope has started.
Afterwards, any change to module security declarations, for example with
allow_module or ModuleSecurityInfo, raises Forbidden.  The same is true for
allow_class, allow_type and other changes to ContainerAssertions.
Normal class security declarations with ClassSecurityInfo still work,
because classes may be imported later, for example when loading objects
from the database.  Calling it a second time does nothing, so both Zope
and Plone can call it on startup.

Dangerous modules like os, subprocess and AccessControl itself that are
fully accessible from restricted code are logged as a warning.  Use
check_dangerous_modules to check other modules, also after the freeze.

Also remove the module security declaration for sets, which only existed
in Python 2.

* Add third-party network libraries to the dangerous modules.

These are aiohttp, httpx, pycurl, requests and urllib3.  Requests from
the server itself can reach internal services, and httpx can use local
Unix sockets.

* Note that DANGEROUS_MODULES is not guaranteed to be complete or up to date.

Review comment by Jens.

Co-authored-by: Jens Vagelpohl <jens@plyp.com>

---------

Co-authored-by: Jens Vagelpohl <jens@plyp.com>

716 of 1220 branches covered (58.69%)

Branch coverage included in aggregate %.

291 of 293 new or added lines in 6 files covered. (99.32%)

5414 of 6252 relevant lines covered (86.6%)

4.33 hits per line