Fix Context in-place mutability bypass via inherited dict methods (open-telemetry#5399)

pranaysb · lzchen · emdneto · web-flow · commit 67a2abdce59e · 2026-07-14T07:54:02.000Z
* opentelemetry-api: Fix Context in-place mutability bypass via inherited dict methods

* Rename context-immutability.fixed to 5399.fixed

---------

Co-authored-by: Leighton Chen &lt;lechen@microsoft.com&gt;
Co-authored-by: Emídio Neto &lt;9735060+emdneto@users.noreply.github.com&gt;
Co-authored-by: Lukas Hering &lt;40302054+herin049@users.noreply.github.com&gt;
Co-authored-by: Riccardo Magliocchetti &lt;riccardo.magliocchetti@gmail.com&gt;
diff --git a/.changelog/5399.fixed b/.changelog/5399.fixed
@@ -0,0 +1 @@
+`opentelemetry-api`: Prevent in-place mutation of `Context` via inherited `dict` methods
diff --git a/opentelemetry-api/src/opentelemetry/context/context.py b/opentelemetry-api/src/opentelemetry/context/context.py
@@ -11,6 +11,27 @@ class Context(dict[str, object]):
     def __setitem__(self, key: str, value: object) -> None:
         raise ValueError
 
+    def __delitem__(self, key: str) -> None:
+        raise ValueError
+
+    def setdefault(self, key: str, default: object = None) -> object:
+        raise ValueError
+
+    def pop(self, key: str, *args: object) -> object:
+        raise ValueError
+
+    def popitem(self) -> tuple[str, object]:
+        raise ValueError
+
+    def clear(self) -> None:
+        raise ValueError
+
+    def update(self, *args: object, **kwargs: object) -> None:
+        raise ValueError
+
+    def __ior__(self, other: object) -> Context:
+        raise ValueError
+
 
 class _RuntimeContext(ABC):
     """The RuntimeContext interface provides a wrapper for the different
diff --git a/opentelemetry-api/tests/context/test_context.py b/opentelemetry-api/tests/context/test_context.py
@@ -54,9 +54,23 @@ def test_set_value(self):
         self.assertEqual(None, context.get_value("a"))
 
     def test_context_is_immutable(self):
+        ctx = context.get_current()
         with self.assertRaises(ValueError):
-            # ensure a context
-            context.get_current()["test"] = "cant-change-immutable"
+            ctx["test"] = "cant-change-immutable"
+        with self.assertRaises(ValueError):
+            del ctx["test"]
+        with self.assertRaises(ValueError):
+            ctx.pop("test")
+        with self.assertRaises(ValueError):
+            ctx.popitem()
+        with self.assertRaises(ValueError):
+            ctx.clear()
+        with self.assertRaises(ValueError):
+            ctx.update({"test": "cant-change-immutable"})
+        with self.assertRaises(ValueError):
+            ctx.setdefault("test", "cant-change-immutable")
+        with self.assertRaises(ValueError):
+            ctx |= {"test": "cant-change-immutable"}
 
     def test_set_current(self):
         context.attach(context.set_value("a", "yyy"))

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	+`opentelemetry-api`: Prevent in-place mutation of `Context` via inherited `dict` methods