(object, filter = lambda name: name[:1] != '_',
            name=None, bastionclass=BastionClass)
return bastionclass(get2, name)
Create a bastion for an object, using an optional filter.

    See the Bastion module's documentation for background.

    Arguments:

    object - the original object
    filter - a predicate that decides whether a function name is OK;
             by default all names are OK that don't start with '_'
    name - the name of the object; default repr(object)
    bastionclass - class used to create the bastion; default BastionClass
Create a bastion for an object, using an optional filter.
Create a bastion for an object using an optional filter .
def Bastion(object, filter = lambda name: name[:1] != '_',
            name=None, bastionclass=BastionClass):
    """Create a bastion for an object, using an optional filter.

    See the Bastion module's documentation for background.

    Arguments:

    object - the original object
    filter - a predicate that decides whether a function name is OK;
             by default all names are OK that don't start with '_'
    name - the name of the object; default repr(object)
    bastionclass - class used to create the bastion; default BastionClass

    """

    raise RuntimeError, "This code is not secure in Python 2.2 and later"

    # Note: we define *two* ad-hoc functions here, get1 and get2.
    # Both are intended to be called in the same way: get(name).
    # It is clear that the real work (getting the attribute
    # from the object and calling the filter) is done in get1.
    # Why can't we pass get1 to the bastion?  Because the user
    # would be able to override the filter argument!  With get2,
    # overriding the default argument is no security loophole:
    # all it does is call it.
    # Also notice that we can't place the object and filter as
    # instance variables on the bastion object itself, since
    # the user has full access to all instance variables!

    def get1(name, object=object, filter=filter):
        """Internal function for Bastion().  See source comments."""
        if filter(name):
            attribute = getattr(object, name)
            if type(attribute) == MethodType:
                return attribute
        raise AttributeError, name

    def get2(name, get1=get1):
        """Internal function for Bastion().  See source comments."""
        return get1(name)

    if name is None:
        name = repr(object)
    return bastionclass(get2, name)
def Bastion ( object , filter = lambda name : name [ : 1 ] != '_' , name = None , bastionclass = BastionClass ) : raise RuntimeError , "This code is not secure in Python 2.2 and later" # Note: we define *two* ad-hoc functions here, get1 and get2. # Both are intended to be called in the same way: get(name). # It is clear that the real work (getting the attribute # from the object and calling the filter) is done in get1. # Why can't we pass get1 to the bastion?  Because the user # would be able to override the filter argument!  With get2, # overriding the default argument is no security loophole: # all it does is call it. # Also notice that we can't place the object and filter as # instance variables on the bastion object itself, since # the user has full access to all instance variables! def get1 ( name , object = object , filter = filter ) : """Internal function for Bastion().  See source comments.""" if filter ( name ) : attribute = getattr ( object , name ) if type ( attribute ) == MethodType : return attribute raise AttributeError , name def get2 ( name , get1 = get1 ) : """Internal function for Bastion().  See source comments.""" return get1 ( name ) if name is None : name = repr ( object ) return bastionclass ( get2 , name )