Why is access to macros of a template disallowed in RestrictedPython?

[pbauer]

Following up from https://github.com/plone/Products.CMFPlone/pull/2839:

Why does RestrictedPython not allow to use python:mytemplate.macros['master'] in a template but mytemplate/macros/master is allowed? macros is the property chameleon.zpt.program.import.macros which returns a chameleon.zpt.template.Macros object.

Allowed:

<pre tal:define="template python:context.restrictedTraverse('@@main_template')"
     tal:content="template/macros"></pre>

Not allowed:

<pre tal:define="template python:context.restrictedTraverse('@@main_template')"
     tal:content="python:template.macros"></pre>

[dataflake]

In Zope itself we solved this issue here: https://github.com/zopefoundation/Zope/pull/503

[pbauer]

@dataflake thanks for the info. I don't get why tal:content="python:template.macros" does not work in Plone (we use Zope 4.0b10 which has the mentioned fix).

[dataflake]

Running this in a Zope instance with security-policy-implementation python and verbose-security on helped me debug the original issue in Zope