parameters: (object, filter = lambda name: name[:1] != '_',
              name=None, bastionclass=BastionClass)
return_statement: return bastionclass(get2, name)
docstring: Create a bastion for an object, using an optional filter.
  
      See the Bastion module's documentation for background.
  
      Arguments:
  
      object - the original object
      filter - a predicate that decides whether a function name is OK;
               by default all names are OK that don't start with '_'
      name - the name of the object; default repr(object)
      bastionclass - class used to create the bastion; default BastionClass
docstring_summary: Create a bastion for an object, using an optional filter.
docstring_tokens: Create a bastion for an object using an optional filter .
function: def Bastion(object, filter = lambda name: name[:1] != '_',
              name=None, bastionclass=BastionClass):
      """Create a bastion for an object, using an optional filter.
  
      See the Bastion module's documentation for background.
  
      Arguments:
  
      object - the original object
      filter - a predicate that decides whether a function name is OK;
               by default all names are OK that don't start with '_'
      name - the name of the object; default repr(object)
      bastionclass - class used to create the bastion; default BastionClass
  
      """
  
      raise RuntimeError, "This code is not secure in Python 2.2 and later"
  
      # Note: we define *two* ad-hoc functions here, get1 and get2.
      # Both are intended to be called in the same way: get(name).
      # It is clear that the real work (getting the attribute
      # from the object and calling the filter) is done in get1.
      # Why can't we pass get1 to the bastion?  Because the user
      # would be able to override the filter argument!  With get2,
      # overriding the default argument is no security loophole:
      # all it does is call it.
      # Also notice that we can't place the object and filter as
      # instance variables on the bastion object itself, since
      # the user has full access to all instance variables!
  
      def get1(name, object=object, filter=filter):
          """Internal function for Bastion().  See source comments."""
          if filter(name):
              attribute = getattr(object, name)
              if type(attribute) == MethodType:
                  return attribute
          raise AttributeError, name
  
      def get2(name, get1=get1):
          """Internal function for Bastion().  See source comments."""
          return get1(name)
  
      if name is None:
          name = repr(object)
      return bastionclass(get2, name)
function_tokens: def Bastion ( object , filter = lambda name : name [ : 1 ] != '_' , name = None , bastionclass = BastionClass ) : raise RuntimeError , "This code is not secure in Python 2.2 and later" # Note: we define *two* ad-hoc functions here, get1 and get2. # Both are intended to be called in the same way: get(name). # It is clear that the real work (getting the attribute # from the object and calling the filter) is done in get1. # Why can't we pass get1 to the bastion?  Because the user # would be able to override the filter argument!  With get2, # overriding the default argument is no security loophole: # all it does is call it. # Also notice that we can't place the object and filter as # instance variables on the bastion object itself, since # the user has full access to all instance variables! def get1 ( name , object = object , filter = filter ) : """Internal function for Bastion().  See source comments.""" if filter ( name ) : attribute = getattr ( object , name ) if type ( attribute ) == MethodType : return attribute raise AttributeError , name def get2 ( name , get1 = get1 ) : """Internal function for Bastion().  See source comments.""" return get1 ( name ) if name is None : name = repr ( object ) return bastionclass ( get2 , name )