Re: [Jython-dev] co_names

[Samuele P. <pe...@in...>]

> From: "Kevin Dangoor" <kda...@we...>
> To: "Samuele Pedroni" <pe...@in...>, 
<jyt...@li...>
> Subject: Re: [Jython-dev] co_names
> Date: Fri, 14 Sep 2001 15:27:34 -0400
> MIME-Version: 1.0
> Content-Transfer-Encoding: 7bit
> X-Priority: 3
> X-MSMail-Priority: Normal
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
> 
> Hi, Samuele
> 
> > If what you need is just co_names (although I don't get why and
> > how is that used/necessary) you should start looking at
> > org.python.compiler.CodeCompiler,...
> > and the functions to construct code in org.python.core.Py
> 
> OK... I'll look in that area.
The code is a bit convoluted, so don't hesitate if you have questions.

 
> >
> > It's just boring, and you should roughly get how the compiler works
> > but it is not difficult.
> >
> > To be honest jython does support co_names because it is not necessary,
> > in CPython co_names contains complementary info needed by the bytecode.
> >
> > Even inspect.py does not use it. In any case if the use of co_names is
> > related to security adding it to jython is not that useful, because
> > potentially forged java bytecode could be delivered together with an
> > irrelevant co_names.
> 
> Zope places some security restrictions on the code that is submitted through
> a web browser. Any method or variable that is not meant to be accessed by
> someone doing through the web development starts with an "_". So, they use
> co_names in a number of places to look for variable/method references that
> begin with "_".
> 
> This is the mechanism that prevents people from being able to alter their
> own security characteristics or access arbitrary Zope objects.
> 
I see, yes that way can work in jython too, if you have control
over compilation of code, ot the other hand the possible access to Java
code enters in the equation(?)

regards.