5 ms·
Hmm.. it seems that part of the problem is that Python interprets "empty entry in PYTHONPATH" as being the same as ".". That just seems wrong. If you want the c
by dwheeler 6y ago
Hmm.. it seems that part of the problem is that Python interprets "empty entry in PYTHONPATH" as being the same as ".". That just seems wrong. If you want the current directory as one of your PYTHONPATH entries, then you should be required to insert ".".
Perhaps the sharp edge would be reduced if Python skipped empty entries in PYTHONPATH. This might require some people to explicitly add "." in their configurations, but they should have done that anyway, and it wouldn't require code to change. PYTHONPATH is also getting less used anyway, so this might be a relatively unnoticed change by most.
What do you think? Would that be worth proposing?
- mlvljr 6y agoYes, looks like a bug.
- AlphaSite 6y agoI think this would break the fundamental workflow of python where you can run a script and it can import from your CWD.
- masklinn 6y agoScripts being run (`python foo.py`) are not imported. What it would break is running a script and trying to import from a utility module next to it.
- jwilk 6y agoNo, that's unrelated to PYTHONPATH; it wouldn't break either.
- masklinn 6y agoIt's not. That sys.path includes "." when running a script lets you import files next to the script. This is trivial to confirm: > cat "import bar" > foo.py > touch bar.py > python foo.py > python -I foo.py Traceback (most recent call last): File "foo.py", line 1, in <module> import bar ModuleNotFoundError: No module named 'bar' and this is exactly the feature which makes it risky to run `python` from an untrusted location.
- jwilk 6y agoBut there's no PYTHONPATH involved here. If you changed semantics of PYTONPATH as dwheeler suggested, everything would continue to work as you shown.
- fanf2 6y agoIt is probably for compatibility with the way POSIX handles $PATH https://pubs.opengroup.org/onlinepubs/9699919799.2018edition/basedefs/V1_chap08.html https://pubs.opengroup.org/onlinepubs/9699919799.2018edition...
- deleted 6y ago[deleted]
- jwilk 6y agoRight; but for PATH this treatment of empty entries is mostly harmless, because the variable is normally non-empty.
- dwheeler 6y agoYes, that is exactly the problem. People treat PYTHONPATH just like PATH, but the "easy scripting tricks" that are fine with PATH become subtle security vulnerabilities when you do the same thing with PYTHONPATH. E.g., people will often add a directory to PATH by doing: PATH="$PATH:my_new_dir" This is practically always fine for PATH, since it's practically always set. If you use exactly the same syntax with PYTHONPATH, you have an instant security vulnerability. Now the first directory searched is the current directory, and if you ever wander into directories with untrusted fils (like "Downloads/" or "somebody_elses_container/") it could become serious fast. This is a sharp edge that was never intended. I'm going to look into proposing this as a PEP. The change is trivial, but there may be surprising uses. A PEP would mean that it'd get more scrutiny (so the change will be less likely to be reverted later).