Review comment

Author: mauvilsa

jsonargparse/_util.py

@@ -316,6 +316,8 @@ def import_object(name: str, check_path: bool = True):
     annotation, instead of from a parsed value.
     """
     if isinstance(name, str) and name in code_given_classes:
+        if check_path:
+            check_import_path(name)
         return code_given_classes[name]
     if not isinstance(name, str) or "." not in name:
         raise ValueError(f"Expected a dot import path string: {name}")

jsonargparse_tests/test_import_paths.py

@@ -356,6 +356,19 @@ def test_subclass_class_path_denied_by_default(parser):
         parser.parse_args(["--handler=logging.FileHandler"])
 
 
+def test_subclass_class_path_of_local_class_denied(parser):
+    class LocalCalendar(Calendar):
+        pass
+
+    parser.add_argument("--local", type=LocalCalendar)
+    parser.add_argument("--cal", type=Calendar)
+    cfg = parser.parse_args(["--local={}"])
+    assert cfg.local.class_path.endswith("<locals>.LocalCalendar")
+    set_parsing_settings(import_path_denylist=[__name__])
+    with pytest.raises(ArgumentError, match="not allowed"):
+        parser.parse_args([f"--cal={cfg.local.class_path}"])
+
+
 def test_star_callable_bound_to_denied_callable_denied(parser):
     set_parsing_settings(import_path_denylist=["*"], import_path_allowlist=["jsonargparse_tests"])
     parser.add_argument("--fn", type=Callable)