From: Adrian Moennich <adrian@planetcoding.net>
Date: Wed, 5 Apr 2017 18:57:22 +0000 (+0200)
Subject: Don't allow setting real attributes on ns objects
X-Git-Tag: 2.10~24^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e0475f94fcfd9b30f96c90aa46d91c1a558c081d;p=thirdparty%2Fjinja.git

Don't allow setting real attributes on ns objects

https://github.com/pallets/jinja/pull/684#issuecomment-291958060
---

diff --git a/jinja2/compiler.py b/jinja2/compiler.py
index 2cdec84b..e69e5f1b 100644
--- a/jinja2/compiler.py
+++ b/jinja2/compiler.py
@@ -1413,7 +1413,7 @@ class CodeGenerator(NodeVisitor):
         self.writeline('raise TemplateRuntimeError(%r)' %
                        'cannot assign attribute on non-namespace object')
         self.outdent()
-        self.writeline('%s.%s' % (ref, node.attr))
+        self.writeline('%s[%r]' % (ref, node.attr))
 
     def visit_Const(self, node, frame):
         val = node.as_const(frame.eval_ctx)
diff --git a/jinja2/utils.py b/jinja2/utils.py
index 3cece1a6..133eac08 100644
--- a/jinja2/utils.py
+++ b/jinja2/utils.py
@@ -618,10 +618,21 @@ class Namespace(object):
 
     def __init__(*args, **kwargs):
         self, args = args[0], args[1:]
-        self.__dict__.update(dict(*args, **kwargs))
+        self.__attrs = dict(*args, **kwargs)
+
+    def __getattribute__(self, name):
+        if name == '_Namespace__attrs':
+            return object.__getattribute__(self, name)
+        try:
+            return self.__attrs[name]
+        except KeyError:
+            raise AttributeError(name)
+
+    def __setitem__(self, name, value):
+        self.__attrs[name] = value
 
     def __repr__(self):
-        return '<Namespace %r>' % self.__dict__
+        return '<Namespace %r>' % self.__attrs
 
 
 # does this python version support async for in and async generators?