pyoxidizer: validate attribute name before calling set_attr_add_collection_context()

This prevents a runtime panic due to bad argument validation.

Closes #561.

Author: indygreg

pyoxidizer/docs/pyoxidizer_history.rst

@@ -50,6 +50,9 @@ Bug Fixes
 * PyO3 Rust crates upgraded from 0.16.4 to 0.16.5. The upgrade fixes compatibility
   issues with Python 3.10 that could lead to runtime crashes or incorrect behavior
   in many configurations.
+* Fixed a runtime panic when incorrect attribute assignments were attempted on the
+  ``PythonExtensionModule``, ``PythonPackageDistributionResource``, and
+  ``PythonPackageResource`` Starlark types. (#561)
 
 New Features
 ^^^^^^^^^^^^

pyoxidizer/src/starlark/python_extension_module.rs

@@ -133,6 +133,14 @@ impl TypedValue for PythonExtensionModuleValue {
     }
 
     fn set_attr(&mut self, attribute: &str, value: Value) -> Result<(), ValueError> {
-        self.set_attr_add_collection_context(attribute, value)
+        if self.add_collection_context_attrs().contains(&attribute) {
+            self.set_attr_add_collection_context(attribute, value)
+        } else {
+            Err(ValueError::OperationNotSupported {
+                op: UnsupportedOperation::SetAttr(attribute.to_string()),
+                left: Self::TYPE.to_owned(),
+                right: None,
+            })
+        }
     }
 }

pyoxidizer/src/starlark/python_package_distribution_resource.rs

@@ -149,6 +149,14 @@ impl TypedValue for PythonPackageDistributionResourceValue {
     }
 
     fn set_attr(&mut self, attribute: &str, value: Value) -> Result<(), ValueError> {
-        self.set_attr_add_collection_context(attribute, value)
+        if self.add_collection_context_attrs().contains(&attribute) {
+            self.set_attr_add_collection_context(attribute, value)
+        } else {
+            Err(ValueError::OperationNotSupported {
+                op: UnsupportedOperation::SetAttr(attribute.to_string()),
+                left: Self::TYPE.to_owned(),
+                right: None,
+            })
+        }
     }
 }

pyoxidizer/src/starlark/python_package_resource.rs

@@ -145,6 +145,14 @@ impl TypedValue for PythonPackageResourceValue {
     }
 
     fn set_attr(&mut self, attribute: &str, value: Value) -> Result<(), ValueError> {
-        self.set_attr_add_collection_context(attribute, value)
+        if self.add_collection_context_attrs().contains(&attribute) {
+            self.set_attr_add_collection_context(attribute, value)
+        } else {
+            Err(ValueError::OperationNotSupported {
+                op: UnsupportedOperation::SetAttr(attribute.to_string()),
+                left: Self::TYPE.to_owned(),
+                right: None,
+            })
+        }
     }
 }

pyoxidizer/src/starlark/python_resource.rs

@@ -160,6 +160,8 @@ pub trait ResourceCollectionContext {
         })
     }
 
+    // The caller should validate that the attribute is an add collection attribute
+    // before calling. Otherwise a panic can occur.
     fn set_attr_add_collection_context(
         &mut self,
         attribute: &str,