Validation bypass of aliased fields in TypedDict and dataclasses allowing extra data

Summary

When extra data is allowed, providing both the alias and the name of an aliased TypedDict or dataclass field makes the unvalidated value (provided under the name) overwrite the validated one (provided under the alias), resulting in validated data not matching the declared type.

Details

Extra items are stored in the same dictionary as the fields (the returned dictionary for TypedDict, the instance __dict__ for dataclasses). As only the alias is marked as used, the field name is treated as an extra item, and its unvalidated value overrides the validated one (pydantic-core/src/validators/typed_dict.rs):

// First pass, for each field:
used_keys.insert(lookup_path.first_key()); // only the alias `b` is marked as used
// ...
output_dict.set_item(&field.name, value)?; // the validated value is stored under `a`

// Second pass, for each input key:
if .used_keys.(cow.()) {
    ; 
}

ExtraBehavior::Allow => {
    
    .output_dict.(py_key, value.(.py)?)?;
}