Security breach on objects' functions access through OSC message
Situation
When started and playing, we can send the following OSC message:
oscsend localhost 8765 /chainsaw/instruments/1 ss '__init__' 'my_new_name'
that totally break consistency.
Other examples are very relevant:
oscsend localhost 8765 /chainsaw/instruments ss 'removeChild' '1'
oscsend localhost 8765 /chainsaw/instruments s '__del__'
oscsend localhost 8765 /chainsaw s 'dumpOscTree'
Another interesting case:
./chainsaw.py --jack --instrument-number 1 --length 1 --log INFO
...
INFO:osc.py: ==== BEGIN DUMP OSC TREE ====
INFO:osc.py: chainsaw
INFO:osc.py: instruments
INFO:osc.py: 1
INFO:osc.py: looperTrack
INFO:osc.py: chain
INFO:osc.py: disto
INFO:osc.py: waveguide
INFO:osc.py: freeverb
INFO:osc.py: freqshift
INFO:osc.py: particleTrack
INFO:osc.py: chain
INFO:osc.py: disto
INFO:osc.py: waveguide
INFO:osc.py: freeverb
INFO:osc.py: freqshift
INFO:osc.py: Monitor
INFO:osc.py: ==== END DUMP OSC TREE ====
and now if we send the following OSC message:
oscsend localhost 8765 /chainsaw/instruments s 'view'
chainsaw
crash like that:
[xcb] Unknown request in queue while dequeuing
[xcb] Most likely this is a multi-threaded client and XInitThreads has not been called
[xcb] Aborting, sorry about that.
chainsaw.py: Fatal IO error 11 (Resource temporarily unavailable) on X server :0.
python: ../../src/xcb_io.c:179: dequeue_pending_request: Assertion `!xcb_xlib_unknown_req_in_deq' failed.
Proposal
OSC processor MUST process only exposed functions instead of all.