zopefoundation / Zope / 42505111324

82%

push

github

Freeze security declarations when Zope has started. (#1307)

* Freeze security declarations when Zope has started.

Use freeze_security_declarations from AccessControl, when available.
After this, no code can make more modules, classes or types accessible
from restricted code, for example with allow_module or allow_class.
Dangerous modules like os and subprocess that are fully accessible from
restricted code are logged as a warning.

* Use pinned AccessControl for security declaration freeze

* Rename freeze_security_declarations to freeze_security_declarations_after_startup.

This is the name of our event handler.

---------

Co-authored-by: Jens Vagelpohl <jens@plyp.com>

3534 of 6006 branches covered (58.84%)

Branch coverage included in aggregate %.

29 of 29 new or added lines in 2 files covered. (100.0%)

28210 of 32533 relevant lines covered (86.71%)

0.87 hits per line