fix: Data leak in ThreadingIntegration between threads

[antonpirker]

It is possible to leak data from started threads into the main thread via the scopes. (Because the same scope object from the main thread could be changed in the started thread.)
This change always makes a fork (copy) of the scopes of the main thread before it propagates those scopes into the started thread.

[codecov]

❌ 2 Tests Failed:

Tests completed	Failed	Passed	Skipped
22033	2	22031	5561

View the top 2 failed test(s) by shortest run time

tests.integrations.django.asgi.test_asgi test_basic[application1]

Stack Traces | 0.538s run time

.../django/asgi/test_asgi.py:48: in test_basic
    await comm.wait()
E   Failed: DID NOT WARN. No warnings of type (<class 'UserWarning'>,) were emitted.
E    Emitted warnings: [ DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.')].

tests.integrations.django.asgi.test_asgi test_basic[application0]

Stack Traces | 0.583s run time

.../django/asgi/test_asgi.py:48: in test_basic
    await comm.wait()
E   Failed: DID NOT WARN. No warnings of type (<class 'UserWarning'>,) were emitted.
E    Emitted warnings: [ DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.'),
E     DeprecationWarning('The `same_process_as_parent` parameter is deprecated.')].

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[szokeasaurusrex]

lgtm, but check with @sl0thentr0py first (I was unclear about the outcome from the slack thread discussion)

[sentrivana]

Nice! Please check comments

[sentrivana]

Since this is happening in Thread.start, we might log this even if a thread is started outside of Django -- but I don't think we have a way of detecting that. And since this is warnings.warn message, it should only be printed once and not spam on every Thread.start, so hopefully this is fine.

[antonpirker]

the problem with the unawaited future is only happening if old python, django and channels are used in combination. on a vanilla python project on old python versions the threading works fine.

[sentrivana]

Yeah, my point was more that someone might have Django/channels installed in their venv but uses threads in an unrelated script that has nothing to do with their Django app and they would get this warning too. But as said, I don't see a way around this

[antonpirker]

now I get it. yes that is true. but as you said, the warning is only emitted once, so I think it is ok.