ForbiddenAttribute: why subclass AttributeError?

[Christian Theune-2]

Hi,

Why is a ForbiddenAttribute also an AttributeError? Is this intended to
avoid 'information leaks'?

We found a nasty side-effect together with getattr and annotations: a
user that didn't have read-access to __annotations__ would end up trying
to create the annotations container again and again because getattr(obj
'__annotations__', None) would return None instead of propagating the
ForbiddenAttribute exception.

Christian and Wolfgang

--
Christian Theune · ct@...
gocept gmbh & co. kg · forsterstraße 29 · 06112 halle (saale) · germany
http://gocept.com · tel [phone] · fax [phone]
Zope and Plone consulting and development


_______________________________________________
Zope-Dev maillist  -  Zope-Dev@...
http://mail.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists -
 http://mail.zope.org/mailman/listinfo/zope-announce
 http://mail.zope.org/mailman/listinfo/zope )

[Christian Zagrodnick]

On 2008-10-15 17:49:30 +0200, Christian Theune <ct@...> said:

>
> Why is a ForbiddenAttribute also an AttributeError? Is this intended to
> avoid 'information leaks'?
>
> We found a nasty side-effect together with getattr and annotations: a
> user that didn't have read-access to __annotations__ would end up trying
> to create the annotations container again and again because getattr(obj
> '__annotations__', None) would return None instead of propagating the
> ForbiddenAttribute exception.

On a proxied object you'd never get an AttributeError but only
ForbidenAttribute, wouldn't you? So I think an ForbiddenAttribute as
subclass of AttributeError is the right thing.


--
Christian Zagrodnick · cz@...
gocept gmbh & co. kg · forsterstraße 29 · 06112 halle (saale) · germany
http://gocept.com · tel [phone] · fax [phone]
Zope and Plone consulting and development


_______________________________________________
Zope-Dev maillist  -  Zope-Dev@...
http://mail.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists -
 http://mail.zope.org/mailman/listinfo/zope-announce
 http://mail.zope.org/mailman/listinfo/zope )