Method intercept_setstate

python/pyfory/policy.py:472–525

Intercept and validate __setstate__ protocol before state restoration. This hook is called when deserializing an object that implements __setstate__, right before the state is restored to the object. It allows inspection and modification of the state dictionary. Whe

(self, obj, state, **kwargs)

        return self.inspect_reduced_object(obj, **kwargs)

    def intercept_setstate(self, obj, state, **kwargs):
        """Intercept and validate __setstate__ protocol before state restoration.

        This hook is called when deserializing an object that implements __setstate__,
        right before the state is restored to the object. It allows inspection and
        modification of the state dictionary.

        When Called
        -----------
        - Before obj.__setstate__(state) is called
        - After the object has been instantiated (via __new__)
        - After the state dict has been deserialized

        Security Use Cases
        ------------------
        - Inspect state for malicious values
        - Sanitize or filter dangerous state attributes
        - Validate state against expected schema
        - Modify state to enforce security policies
        - Audit state restoration for logging

        Args:
            obj (object): The object whose state is about to be restored.
            state (dict or other): The state to be restored (typically a dict, but can
                                  be any object depending on __setstate__ implementation).
            **kwargs: Reserved for future extensions.

        Returns:
            None: Always return None. Modify the state dict in-place if needed.

        Raises:
            Exception: Raise any exception to reject the state and abort deserialization.

        Example:
            >>> class SetStateChecker(DeserializationPolicy):
            ...     def intercept_setstate(self, obj, state, **kwargs):
            ...         # Block if state contains dangerous attributes
            ...         if isinstance(state, dict):
            ...             dangerous_attrs = {'__code__', '__globals__', '_eval'}
            ...             if any(attr in state for attr in dangerous_attrs):
            ...                 raise ValueError("State contains dangerous attributes")
            ...
            ...             # Sanitize: remove private attributes
            ...             state.clear()
            ...             state.update({k: v for k, v in state.items()
            ...                          if not k.startswith('_')})

        Note:
            This hook can modify the state dict in-place. Changes will be reflected
            when __setstate__ is called.

            `check_setstate` is an alias for this hook.
        """
        pass

    # Hook alias
    def check_setstate(self, obj, state, **kwargs):