homepage

The documentation of getattr_static says:
"The only known case that can cause getattr_static to trigger code execution, and cause it to return incorrect results (or even break), is where a class uses __slots__ and provides a __dict__ member using a property or descriptor. If you find other cases please report them so they can be fixed or documented."
I'd like to report another case: when an object's __dict__ is an instance of a dict subclass which overrides dict.get:
>>> _sentinel = object()
>>> 
>>> class MyDict(dict):
... def get(self, key, default=_sentinel):
... print('Hello World!') # This code will execute
... if default is _sentinel:
... return super().get(key)
... else:
... return super().get(key, default)
... 
>>> class X:
... def __init__(self):
... self.__dict__ = MyDict()
... 
>>> x = X()
>>> inspect.getattr_static(x, 'foo', 0)
Hello World!
0
>>> 
(In line 1072. _check_instance calls MyDict.get: instance_dict.get(attr, _sentinel).)