The review's remaining non-blocking suggestion: dispatch's call_failure(str(exc)) resolved the builtin str at call time, so a program rebinding __main__.str could run a hostile callable when the binding-rejection message is formatted. Bind _str into _run locals and use it in dispatch. |
||
|---|---|---|
| .. | ||
| bootstrap.py | ||
| protocol.py | ||