Question

假设我有一个对象，该对象是另一个对象的属性。

import Pyro4

@Pyro4.expose
class ClassB:
    def foo(self):
        return 'Hello from ClassB::foo()'

@Pyro4.expose
class ClassA:
    def __init__(self):
        self._b = ClassB()

    def foo(self):
        return 'Hello from ClassA::foo()'

    @property
    def b(self):
        return self._b

if __name__ == '__main__':
    daemon = Pyro4.Daemon(host='localhost')

    ns = Pyro4.locateNS(host='localhost', port=9090)
    ns.register('ClassA', daemon.register(ClassA))

    daemon.requestLoop()

然后在本地计算机上运行

import Pyro4

if __name__ == '__main__':
    ns = Pyro4.locateNS(host='localhost', port=9090)
    uri = ns.lookup('ClassA')
    a = Pyro4.Proxy(uri)

    print(a.foo())
    print(a.b.foo()) # Fails here

当我尝试调用a.b.foo时，它正在尝试序列化a.b并在本地对其调用foo，但是我想在远程ClassA实例上已经存在的ClassB实例上调用foo。

当然，我可以向ClassA添加一个方法，该方法委托给b.foo（），例如

def classA:
    # ...
    def foo_on_b(self):
        return self._b.foo()

但我不想这样做。

Answer 1

根据设计，这是不可能的。这是一个安全漏洞。 https://pyro4.readthedocs.io/en/stable/security.html#dotted-names-object-traversal

Answer 2

设法破解了它。

remote.py

import Pyro4

class C:
    def __init__(self):
        self.val = 123

class B:
    def __init__(self):
        self.c = C()

class A:
    def __init__(self):
        self.b = B()

def getattr_r(obj, *attrs):
    return getattr_r(getattr(obj, attrs[0]), *attrs[1:]) if attrs else obj

class ClassC:
    def foo(self, x, y):
        return 'Hello from ClassC::foo()! {} + {} = {}'.format(x, y, x + y)

class ClassB:
    def __init__(self):
        self.c = ClassC()

    def foo(self, x, y):
        return 'Hello from ClassB::foo()! {} + {} = {}'.format(x, y, x + y)

@Pyro4.expose
class ClassA:
    def __init__(self):
        self.b = ClassB()

    def foo(self, x, y):
        return 'Hello from ClassA::foo()! {} + {} = {}'.format(x, y, x + y)

    def invoke_on_subobj(self, obj_chain, *args, **kwargs):   
        return getattr_r(self, *obj_chain)(*args, **kwargs)

if __name__ == '__main__':
    daemon = Pyro4.Daemon(host='localhost')

    ns = Pyro4.locateNS(host='localhost', port=9090)
    ns.register('ClassA', daemon.register(ClassA))

    daemon.requestLoop()

local.py

import Pyro4

class ObjTraversableProxy:
    def __init__(self, proxy, bound_attrs=[]):
        self._proxy = proxy
        self._bound_attrs = bound_attrs

    def __getattr__(self, attr):
        return ObjTraversableProxy(self._proxy, self._bound_attrs + [attr])

    def __call__(self, *args, **kwargs):
        if len(self._bound_attrs) > 1:
            return self._proxy.invoke_on_subobj(self._bound_attrs, *args, **kwargs)
        else:
            return getattr(self._proxy, self._bound_attrs[0])(*args, **kwargs)

if __name__ == '__main__':
    ns = Pyro4.locateNS(host='localhost', port=9090)
    uri = ns.lookup('ClassA')
    a = ObjTraversableProxy(Pyro4.Proxy(uri))

    print(a.foo(3, 4))
    print(a.b.foo(5, 6))
    print(a.b.c.foo(6, 7))

结果

Hello from ClassA::foo()! 3 + 4 = 7
Hello from ClassB::foo()! 5 + 6 = 11
Hello from ClassC::foo()! 6 + 7 = 13

Pyro4：远程子对象上的调用方法，而无需尝试返回子对象

2 个答案: