Skip to content

mode="function" #318

Closed
Closed

Description

@zedzhen

BUG/PROBLEM REPORT

mode="function" is allowed for compile_restricted funcion (

if mode in ['exec', 'eval', 'single', 'function']:
result = _compile_restricted_mode(
source,
filename=filename,
mode=mode,
flags=flags,
dont_inherit=dont_inherit,
policy=policy)
), but _compile_restricted_mode simply passes mode to the ast.parse and built-in compile functions, which does not accept mode="function" (ast.parse allows "func_type", both allow "eval", "exec", "single")

from RestrictedPython.compile import compile_restricted

s = """
def f():
    pass
"""

compile_restricted(s, mode="function")

What version of Python and Zope/Addons I am using:

master branch without addons (python 3.10.11, 3.11.9, 3.12.10, 3.13.13, 3.14.5, 3.15.0b2)

Activity

  1. zedzhen commented on Jun 3, 2026

    @zedzhen
    ContributorAuthor

    I can create a PR, but I need to figure out what the solution is. Disallow "function" or, by analogy with compile_restricted_function, replace it with "exec" or something else?
    upd: just replacing it won't do any good.

  2. icemac commented on Jun 12, 2026

    @icemac
    Member

    @loechel Do you remember what this function mode was for?

  3. zedzhen commented on Jun 16, 2026

    @zedzhen
    ContributorAuthor

    it's not work on RestrictedPython 6.0 (03.11.2022) and python 3.6 (minimum version for RestrictedPython 6.0).

    It probably never worked.

    History:
    0) commit 0
    When developing the new api in version 4.0, compile_restricted_function had a signature matching the backward compile_restricted_* methods. compile_restricted called compile_restricted_[mode]

    1. commit 1
      The function _compile_restricted_mode is highlighted, compile_restricted_function calls it with mode='function', and the function compile_restricted starts calling _compile_restricted_mode directly with mode='exec'.
      1.1) commit 1.1
      The compile_restricted function starts calling _compile_restricted_mode directly with mode=mode.
    2. commit 2
      The signature of the compile_restricted_function function is changing.
    3. cimmit 3
      The function compile_restricted_function has an implementation.

    I think we should just delete it. And since it didn't actually work in any release, I think you don't need to increase the major version number.

    @icemac

  4. icemac commented on Jun 19, 2026

    @icemac
    Member

    @zedzhen Thank you for the analysis. Yes, let's delete compile_restricted_function and its mentionings in the documentation. If it never has worked, nobody ever could have used it.
    Would you mind to create an independent PR just for the removal?

  5. zedzhen commented on Jun 19, 2026

    @zedzhen
    ContributorAuthor

    The compile_restricted_function is working.
    When developing the new API in version 4.0, compile_restricted_function had a signature matching compile_restricted_* (and was equivalent to compile_restricted_exec) and it could be called as compile_restricted(..., mode='function'), but then (before the release) the signature was changed, and the call compile_restricted(..., mode='function'), stopped working.

    Therefore, compile_restricted_function should not be deleted, and compile_restricted(..., mode='function') is deleted in #326.

  6. icemac commented on Jun 19, 2026

    @icemac
    Member

    @zedzhen Thank you for the clarification. I just merged #326.

  7. added a commit that references this issue on Jun 19, 2026
    5a1518b
  8. added a commit that references this issue on Jun 19, 2026
    bd256e6
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions