fix(auth): resolve LazyBasesMeta subclassing, thread safety, and recursion bugs

Author: hebaalazzeh

packages/google-auth/google/auth/_helpers.py

@@ -22,6 +22,7 @@
 import json
 import logging
 import sys
+import threading
 from typing import Any, Dict, Mapping, Optional, Union
 import urllib
 
@@ -545,15 +546,49 @@ class LazyBasesMeta(type):
     class is first instantiated, subclassed, or has its attributes inspected.
     """
 
+    _lock = threading.RLock()
+
+    def __new__(mcls, name, bases, attrs):
+        # Automatically resolve lazy bases of any base classes at subclass definition time.
+        for base in bases:
+            if isinstance(base, LazyBasesMeta):
+                type(base)._resolve_bases(base)
+
+        cls = super(LazyBasesMeta, mcls).__new__(mcls, name, bases, attrs)
+        type.__setattr__(cls, "_lazy_bases_resolved", False)
+        return cls
+
     def __call__(cls, *args, **kwargs):
         type(cls)._resolve_bases(cls)
         return super(LazyBasesMeta, cls).__call__(*args, **kwargs)
 
     def __getattribute__(cls, name):
-        type(cls)._resolve_bases(cls)
+        if name not in (
+            "_lazy_bases_resolved",
+            "_resolve_bases",
+            "_perform_resolve_bases",
+        ):
+            type(cls)._resolve_bases(cls)
         return super(LazyBasesMeta, cls).__getattribute__(name)
 
     def _resolve_bases(cls):
+        try:
+            resolved = type.__getattribute__(cls, "_lazy_bases_resolved")
+        except AttributeError:
+            resolved = False
+
+        if not resolved:
+            with type(cls)._lock:
+                try:
+                    resolved = type.__getattribute__(cls, "_lazy_bases_resolved")
+                except AttributeError:
+                    resolved = False
+
+                if not resolved:
+                    type(cls)._perform_resolve_bases(cls)
+                    type.__setattr__(cls, "_lazy_bases_resolved", True)
+
+    def _perform_resolve_bases(cls):
         pass
 
 

packages/google-auth/google/auth/transport/requests.py

@@ -63,7 +63,7 @@
 
 
 class _LazyBasesMeta(_helpers.LazyBasesMeta):
-    def _resolve_bases(cls):
+    def _perform_resolve_bases(cls):
         current_bases = type.__getattribute__(cls, "__bases__")
         if current_bases == (_helpers.HeapDummy,):
             cls_name = type.__getattribute__(cls, "__name__")

packages/google-auth/google/auth/transport/urllib3.py

@@ -74,7 +74,7 @@
 
 
 class _LazyBasesMeta(_helpers.LazyBasesMeta):
-    def _resolve_bases(cls):
+    def _perform_resolve_bases(cls):
         current_bases = type.__getattribute__(cls, "__bases__")
         if current_bases == (_helpers.HeapDummy,):
             if version.parse(urllib3.__version__) >= version.parse("2.0.0"):