pkgutil-resolve-name

1.3.10 · active · verified Sun Mar 29

pkgutil-resolve-name is a Python library that provides a backport of the `pkgutil.resolve_name` function, originally introduced in Python 3.9. It allows resolving a string-based name (e.g., 'module.submodule:ClassName' or 'module.function_name') to its corresponding Python object. The current version is 1.3.10, with an infrequent release cadence as it primarily backports a standard library feature.

Warnings

gotcha This library is a backport of `pkgutil.resolve_name` from Python 3.9. If your project targets Python 3.9 or newer, you can directly use `pkgutil.resolve_name` from the standard library without needing this external package.
Fix: For Python 3.9+, use `from pkgutil import resolve_name` directly. For older Python versions, continue using this backport.
breaking The `resolve_name` function (both this backport and the standard library version) allows resolving arbitrary Python objects by string. This can be a security footgun, especially in contexts involving untrusted input or deserialization (e.g., `pickle`). An attacker could potentially use this to load and execute dangerous functions or modules, bypassing blocklists.
Fix: Avoid using `resolve_name` with untrusted input strings. Implement robust validation or an allow-list for acceptable object paths if dynamic resolution is absolutely necessary in security-sensitive applications. Consider alternative approaches that do not rely on dynamic string-to-object resolution for critical operations.

Install

pip install pkgutil-resolve-name Install with pip

Imports

resolve_name

from pkgutil_resolve_name import resolve_name

Quickstart

Demonstrates resolving a class, a function, and a module by their string names using `resolve_name`.

from pkgutil_resolve_name import resolve_name

# Resolve a class from a standard library module
Path = resolve_name('pathlib:Path')
print(f"Resolved object: {Path}")
print(f"Is it the pathlib.Path class? {Path.__name__ == 'Path' and Path.__module__ == 'pathlib'}")

# Resolve a function
sys_exit = resolve_name('sys:exit')
print(f"Resolved object: {sys_exit}")
print(f"Is it the sys.exit function? {sys_exit.__name__ == 'exit' and sys_exit.__module__ == 'sys'}")

# Resolve a module directly
collections_module = resolve_name('collections')
print(f"Resolved object: {collections_module}")
print(f"Is it the collections module? {collections_module.__name__ == 'collections'}")

view raw JSON →