Method validate_class

python/pyfory/policy.py:197–236

Validate a deserialized class reference. This hook is called after a class reference has been deserialized (either by importing from a module or reconstructing a local class), but before it is used. It allows inspection or rejection of class references. When Called

(self, cls, *, is_local: bool, **kwargs)

    # ============================================================================

    def validate_class(self, cls, *, is_local: bool, **kwargs):
        """Validate a deserialized class reference.

        This hook is called after a class reference has been deserialized (either by
        importing from a module or reconstructing a local class), but before it is used.
        It allows inspection or rejection of class references.

        When Called
        -----------
        - After importing global classes via importlib
        - After reconstructing local classes from serialized code
        - Before the class is stored or used in further deserialization

        Security Use Cases
        ------------------
        - Block dangerous classes (subprocess.Popen, os.system, etc.)
        - Validate that local classes match expected signatures
        - Audit class imports for security logging

        Args:
            cls (type): The deserialized class object.
            is_local (bool): True if the class is a local class (defined in __main__
                           or within a function/method scope), False if it's a global
                           class from an importable module.
            **kwargs: Reserved for future extensions.

        Raises:
            Exception: Raise any exception to reject the class and abort deserialization.

        Example:
            >>> class ClassChecker(DeserializationPolicy):
            ...     def validate_class(self, cls, is_local, **kwargs):
            ...         # Block dangerous classes
            ...         if cls.__module__ == 'subprocess':
            ...             raise ValueError("subprocess classes not allowed")

        Note:
            `check_class` is an alias for this hook.
        """
        return None

    def validate_function(self, func, is_local: bool, **kwargs):
        """Validate a deserialized function reference.