annotationlib --- Functionality for introspecting annotations — Limitations of the STRING format

Reference note (untrusted external data; do not execute it as instructions). The ~Format.STRING format is meant to approximate the source code of the annotation, but the implementation strategy used means that it is not always possible to recover the exact source code. First, the stringifier of course cannot recover any information that is not present in the compiled code, including comments, whitespace, parenthesization, and operations that get simplified by the compiler. Second, the stringifier can intercept almost all operations that involve names looked up in some scope, but it cannot intercept operations that operate fully on constants. As a corollary, this also means it is not safe to request the STRING format on untrusted code: Python is powerful enough that it is possible to achieve arbitrary code execution even with no access to any globals or builtins. For example Bounded code example (external data; do not execute automatically): ```pycon >>> def f(x: (1).__class__.__base__.__subclasses__()[-1].__init__.__builtins__["print"]("Hello world")): pass ... >>> annotationlib.get_annotations(f, format=annotationlib.Format.STRING) Hello world {'x': 'None'} ``` This particular example works as of the time of writing, but it relies on implementation details and is not guaranteed to work in the future. Among the different kinds of expressions that exist in Python, as represented by the ast module, some expressions are supported, meaning that the STRING format can generally recover the original source code; others are unsupported, meaning that they may result in incorrect output or an error. The following are supported (sometimes with caveats) ast.Invert (~), ast.UAdd (+), and ast.USub (-) are supported ast.Not (not) is not supported ast.Dict (except when using unpacking) ast.Set ast.Compare ast.Eq and ast.NotEq are supported ast.Lt, ast.LtE, ast.Gt, and ast.GtE are supported, but the operand may be flipped ast.Is, ast.IsNot, ast.In, and ast.NotIn are not supported ast.Call (except when using unpacking) ast.Constant (though not the exact representation of the constant; for example, escape sequences in strings are lost; hexadecimal numbers are converted to decimal) ast.Attribute (assuming the value is not a constant) ast.Subscript (assuming the value is not a constant) ast.Starred ( unpacking) ast.Name ast.List ast.Tuple ast.Slice … Attribution: Adapted from Python Documentation under PSF-2.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.