Guard against custom properties

IPython/core/guarded_eval.py

@@ -3,6 +3,7 b' from typing import ('
     Callable,
     Dict,
     Set,
+    Sequence,
     Tuple,
     NamedTuple,
     Type,
@@ -113,18 +114,30 b' class EvaluationPolicy:'
             return True
 
 
+def _get_external(module_name: str, access_path: Sequence[str]):
+    """Get value from external module given a dotted access path.
+
+    Raises:
+    * `KeyError` if module is removed not found, and
+    * `AttributeError` if acess path does not match an exported object
+    """
+    member_type = sys.modules[module_name]
+    for attr in access_path:
+        member_type = getattr(member_type, attr)
+    return member_type
+
+
 def _has_original_dunder_external(
     value,
-    module_name,
-    access_path,
-    method_name,
+    module_name: str,
+    access_path: Sequence[str],
+    method_name: str,
 ):
-    try:
         if module_name not in sys.modules:
+        # LBYLB as it is faster
             return False
-        member_type = sys.modules[module_name]
-        for attr in access_path:
-            member_type = getattr(member_type, attr)
+    try:
+        member_type = _get_external(module_name, access_path)
         value_type = type(value)
         if type(value) == member_type:
             return True
@@ -199,12 +212,42 b' class SelectivePolicy(EvaluationPolicy):'
             method_name="__getattr__",
         )
 
+        accept = False
+
         # Many objects do not have `__getattr__`, this is fine
         if has_original_attr is None and has_original_attribute:
+            accept = True
+        else:
+            # Accept objects without modifications to `__getattr__` and `__getattribute__`
+            accept = has_original_attr and has_original_attribute
+
+        if accept:
+            # We still need to check for overriden properties.
+
+            value_class = type(value)
+            if not hasattr(value_class, attr):
             return True
 
-        # Accept objects without modifications to `__getattr__` and `__getattribute__`
-        return has_original_attr and has_original_attribute
+            class_attr_val = getattr(value_class, attr)
+            is_property = isinstance(class_attr_val, property)
+
+            if not is_property:
+                return True
+
+            # Properties in allowed types are ok
+            if type(value) in self.allowed_getattr:
+                return True
+
+            # Properties in subclasses of allowed types may be ok if not changed
+            for module_name, *access_path in self.allowed_getattr_external:
+                try:
+                    external_class = _get_external(module_name, access_path)
+                    external_class_attr_val = getattr(external_class, attr)
+                except (KeyError, AttributeError):
+                    return False  # pragma: no cover
+                return class_attr_val == external_class_attr_val
+
+        return False
 
     def can_get_item(self, value, item):
         """Allow accessing `__getiitem__` of allow-listed instances unless it was not modified."""

IPython/core/tests/test_guarded_eval.py

@@ -1,3 +1,4 b''
+from contextlib import contextmanager
 from typing import NamedTuple
 from functools import partial
 from IPython.core.guarded_eval import (
@@ -25,6 +26,21 b' LIMITED_OR_HIGHER = [limited, unsafe, dangerous]'
 MINIMAL_OR_HIGHER = [minimal, *LIMITED_OR_HIGHER]
 
 
+@contextmanager
+def module_not_installed(module: str):
+    import sys
+
+    try:
+        to_restore = sys.modules[module]
+        del sys.modules[module]
+    except KeyError:
+        to_restore = None
+    try:
+        yield
+    finally:
+        sys.modules[module] = to_restore
+
+
 @dec.skip_without("pandas")
 def test_pandas_series_iloc():
     import pandas as pd
@@ -34,6 +50,32 b' def test_pandas_series_iloc():'
     assert guarded_eval("data.iloc[0]", context) == 1
 
 
+def test_rejects_custom_properties():
+    class BadProperty:
+        @property
+        def iloc(self):
+            return [None]
+
+    series = BadProperty()
+    context = limited(data=series)
+
+    with pytest.raises(GuardRejection):
+        guarded_eval("data.iloc[0]", context)
+
+
[e-mail]_without("pandas")
+def test_accepts_non_overriden_properties():
+    import pandas as pd
+
+    class GoodProperty(pd.Series):
+        pass
+
+    series = GoodProperty([1], index=["a"])
+    context = limited(data=series)
+
+    assert guarded_eval("data.iloc[0]", context) == 1
+
+
 @dec.skip_without("pandas")
 def test_pandas_series():
     import pandas as pd
@@ -472,9 +514,12 b' def test_assumption_instance_attr_do_not_matter():'
         def __getattr__(self, k):
             return "a"
 
+    def f(self):
+        return "b"
+
     t = T()
-    t.__getitem__ = lambda f: "b"
-    t.__getattr__ = lambda f: "b"
+    t.__getitem__ = f
+    t.__getattr__ = f
     assert t[1] == "a"
     assert t[1] == "a"