From b50b6f95a1afacf76cc6ec3da4229cdeb33a7cf6 Mon Sep 17 00:00:00 2001
From: "Miss Islington (bot)"
 <31488909+miss-islington@users.noreply.github.com>
Date: Mon, 21 Nov 2022 13:06:01 -0800
Subject: [3.8] gh-87604: Avoid publishing list of active per-interpreter audit
 hooks via the gc module (GH-99373) (GH-99661)

(cherry picked from commit 7b98207aa46bd637d07a7c4a84e998726b74acde)

Co-authored-by: Steve Dower <steve.dower@python.org>
---
 Lib/test/audit-tests.py                                       | 11 +++++++++++
 Lib/test/test_audit.py                                        |  5 +++++
 .../Security/2022-11-11-12-50-28.gh-issue-87604.OtwH5L.rst    |  2 ++
 Python/sysmodule.c                                            |  2 ++
 4 files changed, 20 insertions(+)
 create mode 100644 Misc/NEWS.d/next/Security/2022-11-11-12-50-28.gh-issue-87604.OtwH5L.rst

diff --git a/Lib/test/audit-tests.py b/Lib/test/audit-tests.py
index 8e66594..45cd0d1 100644
--- a/Lib/test/audit-tests.py
+++ b/Lib/test/audit-tests.py
@@ -341,6 +341,17 @@ def test_gc():
     gc.get_referents(y)
 
 
+def test_not_in_gc():
+    import gc
+
+    hook = lambda *a: None
+    sys.addaudithook(hook)
+
+    for o in gc.get_objects():
+        if isinstance(o, list):
+            assert hook not in o
+
+
 if __name__ == "__main__":
     from test.support import suppress_msvcrt_asserts
 
diff --git a/Lib/test/test_audit.py b/Lib/test/test_audit.py
index a9ac6fe..fe3d0e0 100644
--- a/Lib/test/test_audit.py
+++ b/Lib/test/test_audit.py
@@ -127,6 +127,11 @@ class AuditTest(unittest.TestCase):
             ["gc.get_objects", "gc.get_referrers", "gc.get_referents"]
         )
 
+    def test_not_in_gc(self):
+        returncode, _, stderr = self.run_python("test_not_in_gc")
+        if returncode:
+            self.fail(stderr)
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/Misc/NEWS.d/next/Security/2022-11-11-12-50-28.gh-issue-87604.OtwH5L.rst b/Misc/NEWS.d/next/Security/2022-11-11-12-50-28.gh-issue-87604.OtwH5L.rst
new file mode 100644
index 0000000..c931409
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2022-11-11-12-50-28.gh-issue-87604.OtwH5L.rst
@@ -0,0 +1,2 @@
+Avoid publishing list of active per-interpreter audit hooks via the
+:mod:`gc` module
diff --git a/Python/sysmodule.c b/Python/sysmodule.c
index ffda714..eb3245a 100644
--- a/Python/sysmodule.c
+++ b/Python/sysmodule.c
@@ -356,6 +356,8 @@ sys_addaudithook_impl(PyObject *module, PyObject *hook)
         if (is->audit_hooks == NULL) {
             return NULL;
         }
+        /* Avoid having our list of hooks show up in the GC module */
+        PyObject_GC_UnTrack(is->audit_hooks);
     }
 
     if (PyList_Append(is->audit_hooks, hook) < 0) {
-- 
cgit v0.12