gh-152405: Fix crash of rich-comparing MappingProxyType objects

Author: sobolevn

Lib/test/test_types.py

@@ -1392,14 +1392,19 @@ def __hash__(self):
         self.assertEqual(hash(view), hash(mapping))
 
     def test_richcompare(self):
-        mp1 = self.mappingproxy({'a': 1})
+        dt1 = {'a': 1}
+        mp1 = self.mappingproxy(dt1)
         mp1_2 = self.mappingproxy({'a': 1})
         mp2 = self.mappingproxy({'a': 2})
 
         self.assertTrue(mp1 == mp1_2)
         self.assertFalse(mp1 != mp1_2)
         self.assertFalse(mp1 == mp2)
         self.assertTrue(mp1 != mp2)
+        self.assertTrue(mp1 == dt1)
+        self.assertTrue(mp1_2 == dt1)
+        self.assertFalse(mp2 == dt1)
+        self.assertTrue(mp2 != dt1)
 
         msg = "not supported between instances of 'mappingproxy' and 'mappingproxy'"
 
@@ -1411,6 +1416,67 @@ def test_richcompare(self):
             mp2 >= mp2
         with self.assertRaisesRegex(TypeError, msg):
             mp1_2 <= mp1
+        with self.assertRaisesRegex(
+            TypeError,
+            "not supported between instances of 'mappingproxy' and 'dict'",
+        ):
+            mp1_2 <= dt1
+
+    def test_richcompare_mapping(self):
+        class CustomMapping(collections.abc.Mapping):
+            def __init__(self, data):
+                self._data = data
+
+            def __getitem__(self, key):
+                return self._data[key]
+
+            def __iter__(self):
+                return iter(self._data)
+
+            def __len__(self):
+                return len(self._data)
+
+            def __contains__(self, item):
+                return item in self._data
+
+        dt1 = {'a': 1}
+        mp1 = self.mappingproxy(CustomMapping(dt1))
+        mp1_2 = self.mappingproxy(dt1)
+        mp2 = self.mappingproxy({'a': 2})
+
+        self.assertTrue(mp1 == mp1_2)
+        self.assertTrue(mp1 == dt1)
+        self.assertTrue(mp1_2 == dt1)
+        self.assertTrue(dt1 == mp1)
+        self.assertTrue(dt1 == mp1_2)
+        self.assertFalse(mp2 == dt1)
+        self.assertFalse(dt1 == mp2)
+        self.assertFalse(mp1 != dt1)
+        self.assertFalse(dt1 != mp1)
+
+        class Evil:
+            def __eq__(self, other):
+                return other
+
+        leaked = mp1 == Evil()
+        self.assertIs(type(leaked), dict)
+
+    def test_richcompare_evil(self):
+        # https://github.com/python/cpython/issues/152405
+        class Evil:
+            def __eq__(self, other):
+                return other
+
+        # exposes the internals of `MappingProxyType` via richcompare:
+        leaked = vars(list) == Evil()
+        self.assertIs(type(leaked), dict)
+        name = "__mappingproxy_crash_probe__"
+        leaked[name] = lambda self: "probe"
+        self.assertIn(name, leaked)
+        self.assertNotHasAttr(list, name)  # it used to return `True`
+        del leaked[name]
+        self.assertNotIn(name, leaked)
+        self.assertNotHasAttr(list, name)  # it used to crash
 
 
 class ClassCreationTests(unittest.TestCase):

Misc/NEWS.d/next/Core_and_Builtins/2026-06-28-14-39-05.gh-issue-152405.-_3YRo.rst

@@ -0,0 +1,6 @@
+Fixes a crash, when modifing :class:`types.MappingProxyType` exposed via a
+rich-compare operation with :func:`vars` function. It was possible to mutate
+the internals of builtins types via this technique.
+
+It changes the object that is passed to rich-compare methods
+from the real internal mapping type to be always :class:`dict`.

Objects/descrobject.c

@@ -1232,9 +1232,22 @@ mappingproxy_traverse(PyObject *self, visitproc visit, void *arg)
 static PyObject *
 mappingproxy_richcompare(PyObject *self, PyObject *w, int op)
 {
-    mappingproxyobject *v = (mappingproxyobject *)self;
     if (op == Py_EQ || op == Py_NE) {
-        return PyObject_RichCompare(v->mapping, w, op);
+        mappingproxyobject *v = (mappingproxyobject *)self;
+        // We can't expose the `v->mapping` itself, so we create a dict copy:
+        // it was possible to mutate `v->mapping` in rich-compare methods.
+        // See gh-152405 on the details.
+        PyObject *copy = PyDict_New();
+        if (copy == NULL) {
+            return NULL;
+        }
+        if (PyDict_Update(copy, v->mapping)) {
+            Py_DECREF(copy);
+            return NULL;
+        }
+        PyObject *res = PyObject_RichCompare(copy, w, op);
+        Py_DECREF(copy);
+        return res;
     }
     Py_RETURN_NOTIMPLEMENTED;
 }