Don't allow setting real attributes on ns objects

https://github.com/pallets/jinja/pull/684#issuecomment-291958060

diff --git a/jinja2/compiler.py b/jinja2/compiler.py
index 2cdec84bd46b5055a44fac0463389ebf16b5fa5e..e69e5f1becaec00b90c2687fb080af2b5207e8cf 100644 (file)
--- a/jinja2/compiler.py
+++ b/jinja2/compiler.py
@@ -1413,7 +1413,7 @@ class CodeGenerator(NodeVisitor):
         self.writeline('raise TemplateRuntimeError(%r)' %
                        'cannot assign attribute on non-namespace object')
         self.outdent()
-        self.writeline('%s.%s' % (ref, node.attr))
+        self.writeline('%s[%r]' % (ref, node.attr))
 
     def visit_Const(self, node, frame):
         val = node.as_const(frame.eval_ctx)

diff --git a/jinja2/utils.py b/jinja2/utils.py
index 3cece1a6b2d0bc00be15f63f13f51ef27ac16e25..133eac084a7f15ed3efe7feb065dd496680dfc1c 100644 (file)
--- a/jinja2/utils.py
+++ b/jinja2/utils.py
@@ -618,10 +618,21 @@ class Namespace(object):
 
     def __init__(*args, **kwargs):
         self, args = args[0], args[1:]
-        self.__dict__.update(dict(*args, **kwargs))
+        self.__attrs = dict(*args, **kwargs)
+
+    def __getattribute__(self, name):
+        if name == '_Namespace__attrs':
+            return object.__getattribute__(self, name)
+        try:
+            return self.__attrs[name]
+        except KeyError:
+            raise AttributeError(name)
+
+    def __setitem__(self, name, value):
+        self.__attrs[name] = value
 
     def __repr__(self):
-        return '<Namespace %r>' % self.__dict__
+        return '<Namespace %r>' % self.__attrs
 
 
 # does this python version support async for in and async generators?