Inspect and validate an object after __reduce__ protocol reconstruction. This hook is called after an object has been reconstructed using the __reduce__ protocol, allowing final inspection, modification, or replacement. When Called ----------- - After callab
(self, obj, **kwargs)
| 419 | return self.intercept_reduce_call(callable_obj, args, **kwargs) |
| 420 | |
| 421 | def inspect_reduced_object(self, obj, **kwargs): |
| 422 | """Inspect and validate an object after __reduce__ protocol reconstruction. |
| 423 | |
| 424 | This hook is called after an object has been reconstructed using the __reduce__ |
| 425 | protocol, allowing final inspection, modification, or replacement. |
| 426 | |
| 427 | When Called |
| 428 | ----------- |
| 429 | - After callable_obj(*args) has been executed |
| 430 | - After state has been restored (if applicable) |
| 431 | - After list/dict items have been added (if applicable) |
| 432 | - Before the object is returned to the deserializer |
| 433 | |
| 434 | Security Use Cases |
| 435 | ------------------ |
| 436 | - Validate reconstructed object's state |
| 437 | - Replace objects that pass callable checks but are still unsafe |
| 438 | - Sanitize object attributes |
| 439 | - Audit reconstructed objects for security logging |
| 440 | |
| 441 | Args: |
| 442 | obj (object): The reconstructed object. |
| 443 | **kwargs: Reserved for future extensions. |
| 444 | |
| 445 | Returns: |
| 446 | None: Return None to accept the object as-is. |
| 447 | object: Return a different object to replace the original. |
| 448 | |
| 449 | Raises: |
| 450 | Exception: Raise any exception to reject the object. |
| 451 | |
| 452 | Example: |
| 453 | >>> class PostReduceChecker(DeserializationPolicy): |
| 454 | ... def inspect_reduced_object(self, obj, **kwargs): |
| 455 | ... # Validate that file handles are read-only |
| 456 | ... if isinstance(obj, io.IOBase) and obj.writable(): |
| 457 | ... raise ValueError("Writable file handles not allowed") |
| 458 | ... return None |
| 459 | |
| 460 | Note: |
| 461 | This hook provides a last line of defense after reduce reconstruction. |
| 462 | |
| 463 | `check_restored_reduced_object` is an alias for this hook. |
| 464 | """ |
| 465 | pass |
| 466 | |
| 467 | # Hook aliases |
| 468 | def check_restored_reduced_object(self, obj, **kwargs): |
no outgoing calls
no test coverage detected