Avoid triggering @property methods on plugins when looking for hookimpls during registration

[pirate]

Hey all, thanks for making pluggy! I'm loving using it so far. 🥳

---

Currently pluggy fairly aggressively inspects every plugin's attrs upon registration in order to look for potential @hookimpl-marked methods.

Based on the existing implementation in PluginManager.register() -> ... -> parse_hookimpl_opts(), it's clear that the intention is to only look for Callable methods marked with the @hookimpl decorator (it skips over any non-methods / undecorated-methods it finds in the process).

If a plugin is class-based, the current implementation using inspect.isroutine(getattr(plugin, name)) has the unintended consequence of evaluating every single @property method on the passed plugin object, which can have side effects because property methods can execute arbitrary code upon access!

This PR corrects this by pre-checking if a given plugin attr is a @property (or pydantic field), before attempting to getattr(plugin, name) to pass it to inspect.isroutine(...).

[pirate]

Codecov is complaining about whitespace lines and comment lines not being covered?

[RonnyPfannschmidt]

Looks good to me, wondering if we should take static getattr from pytest for fetching declarations

[pirate]

Ok I've updated the PR:

• Removed pydantic-specific logic
• Abstracted @property check to helper function _attr_is_property(obj, name) -> bool
• Exhaustively tested the following situations:
  • proper handling of: modules, class, objects, Pydantic models, Django models being used as namespaces
  • namespaces containing: @property, @classproperty, @classmethod, @staticmethod, ClassVars, normal variables, and normal methods

For a full demo of the exhaustive tests showing that it works in those cases ^ (including pydantic-specific tests that I did not put in the PR) see here:

https://gist.github.com/pirate/66f12beac594c99c697cd5543a1cb77b

[RonnyPfannschmidt]

this looks good to me, Thanks!

i'd like to get a final ok from @bluetech

[RonnyPfannschmidt]

i recently re-discovered inspect.getattr_static
i wonder if that one may be nice for a followup change

[bluetech]

When I last looked at it, the main downside of getattr_static was that it was very slow. Though may this has improved (I think I saw mention of that).

[bluetech]

Thanks for removing the pydantic bit. I still have a question on the AttributeError case.