diff --git a/Lib/test/audit-tests.py b/Lib/test/audit-tests.py index 8e66594e52429b..45cd0d12c6509f 100644 --- a/Lib/test/audit-tests.py +++ b/Lib/test/audit-tests.py @@ -341,6 +341,17 @@ def hook(event, args): gc.get_referents(y) +def test_not_in_gc(): + import gc + + hook = lambda *a: None + sys.addaudithook(hook) + + for o in gc.get_objects(): + if isinstance(o, list): + assert hook not in o + + if __name__ == "__main__": from test.support import suppress_msvcrt_asserts diff --git a/Lib/test/test_audit.py b/Lib/test/test_audit.py index a9ac6fee446f87..fe3d0e0eaea51f 100644 --- a/Lib/test/test_audit.py +++ b/Lib/test/test_audit.py @@ -127,6 +127,11 @@ def test_gc(self): ["gc.get_objects", "gc.get_referrers", "gc.get_referents"] ) + def test_not_in_gc(self): + returncode, _, stderr = self.run_python("test_not_in_gc") + if returncode: + self.fail(stderr) + if __name__ == "__main__": unittest.main() diff --git a/Misc/NEWS.d/next/Security/2022-11-11-12-50-28.gh-issue-87604.OtwH5L.rst b/Misc/NEWS.d/next/Security/2022-11-11-12-50-28.gh-issue-87604.OtwH5L.rst new file mode 100644 index 00000000000000..c931409b817122 --- /dev/null +++ b/Misc/NEWS.d/next/Security/2022-11-11-12-50-28.gh-issue-87604.OtwH5L.rst @@ -0,0 +1,2 @@ +Avoid publishing list of active per-interpreter audit hooks via the +:mod:`gc` module diff --git a/Python/sysmodule.c b/Python/sysmodule.c index ffda71446712cc..eb3245a33298cd 100644 --- a/Python/sysmodule.c +++ b/Python/sysmodule.c @@ -356,6 +356,8 @@ sys_addaudithook_impl(PyObject *module, PyObject *hook) if (is->audit_hooks == NULL) { return NULL; } + /* Avoid having our list of hooks show up in the GC module */ + PyObject_GC_UnTrack(is->audit_hooks); } if (PyList_Append(is->audit_hooks, hook) < 0) {