5 ms·

Beware that "python -m" is insecure in untrusted cwd: https://bugs.python.org/issue33053 https://bugs.python.org/issue33053 E.g.: $ echo 'import os; os.exe

• cgriswald 4y ago
  You can use -I to have the interpreter not include the directory in sys.path. (This also eschews site-packages and any environment variables.) $ echo 'import os; os.execvp("cowsay", ["-", "pwned"])' > pip.py $ python -Im pip --version pip 22.0.2 ...
• ericholscher 4y ago
  Isn’t that true of command execution as well? I guess you could use a full path to the pip executable, but similar issue.
  • jjnoakes 4y ago
    Do you mean there might be a 'pip' command in the local directory that might get called by accident, or do you mean the real python pip command might load a python module from the local directory by accident?
    • romanows 4y ago
      The second thing. Python includes the current working directory first in the module search path. It leads to the above issue and occasionally some a tricky debugging problem.
      • jwilk 4y ago
        If you run a script, such as "pip", sys.path[0] is the script's directory, not cwd: https://docs.python.org/3/using/cmdline.html https://docs.python.org/3/using/cmdline.html > If the script name refers directly to a Python file, the directory containing that file is added to the start of sys.path
        • romanows 4y ago
          You are right! I missed the switch from talking about the `python -m`-style invocation versus the `python <script>`-style invocation. (Should I double down and attribute it to difficulties with how significant whitespace indentation can make it hard to determine the scope (of the comment threading on mobile)? :P)
    • danudey 4y ago
      Windows' cmd.exe is the only shell I'm aware of that (by default) checks the local directory for executables before the actual PATH variable, so I wouldn't consider that a real problem. The 'local directory' one is the actual concern. For example, our CI system for one of our tools runs commands like `pip install -U setuptools`. If we switched it to `python -m pip install -U setuptools`, it would continue to work fine - unless a developer accidentally committed a file called `pip.py` to the root. At that point, Python would try to import `pip.py` as `pip` instead of the actual module pip (because current directory is checked for includes first).
      • jjnoakes 4y ago
        Did you reply to the right comment? I was looking for clarification on a comment made when discussing running pip directly, as a full path to the pip executable, and not via "python -m pip ...".
  • singron 4y ago
    Only if PATH includes ".", which is why they say not to do that (or use windows. I'm not sure if you can fix that there).
    • colejohnson66 4y ago
      CMD includes the CWD in the PATH,[a] but PowerShell doesn’t; you’re forced to do the `./` (or `.\`) dance. However, if you tab complete a file name that’s not "dot slash" prefixed, it’ll add it for you. Not sure if sh and friends do that. [a]: Implicitly. Echoing the $PATH variable won’t include `.`, but you can execute as if it was
    • thaumasiotes 4y ago
      Even if PATH includes the current directory, you'll be safe as long as it doesn't take priority over the regular bin directories.
• jcelerier 4y ago
  > untrusted cwd ... when does that happen and why would you run any program in that case ?
  • aahortwwy 4y ago
    Maybe you just downloaded a bunch of files into your cwd and now you're going to run a script to process them.
• hauntsaninja 4y ago
  In Python 3.11, you can use the "-P" flag or the "PYTHONSAFEPATH" environment variable to avoid adding cwd to sys.path https://docs.python.org/3.11/whatsnew/3.11.html#summary-release-highlights https://docs.python.org/3.11/whatsnew/3.11.html#summary-rele...