2 ms·
Huh. Looks like there's a solution in 3.11: https://docs.python.org/3/using/cmdline.html#cmdoption-P https://docs.python.org/3/using/cmdline.html#cmdoption-P
by eesmith 4y ago
Huh. Looks like there's a solution in 3.11: https://docs.python.org/3/using/cmdline.html#cmdoption-P https://docs.python.org/3/using/cmdline.html#cmdoption-P
-P
Don’t prepend a potentially unsafe path to sys.path:
* python -m module command line: Don’t prepend the current working directory.
* python script.py command line: Don’t prepend the script’s directory.
If it’s a symbolic link, resolve symbolic links.
* python -c code and python (REPL) command lines: Don’t prepend an empty
string, which means the current working directory.
See also the PYTHONSAFEPATH environment variable, and -E and -I (isolated) options.
New in version 3.11.
Or perhaps '-I'? https://docs.python.org/3/using/cmdline.html#cmdoption-I https://docs.python.org/3/using/cmdline.html#cmdoption-I
Run Python in isolated mode. This also implies -E, -P and -s options.
In isolated mode sys.path contains neither the script’s directory nor
the user’s site-packages directory. All PYTHON* environment variables
are ignored, too. Further restrictions may be imposed to prevent the
user from injecting malicious code.
New in version 3.4.
- mg 4y agoIf you write the python command by hand and are aware of the issue, you can certainly mitigate it. But if some shellscript you run internally uses some Python via "python -m" or "python -c" running that shellscript is also dangerous. Even if it is completely trustworthy.
- eesmith 4y agoWhat it means is there's a migration path, and we can start using "python -Pm" or whatever in documentation, sh-bang paths, and so on. Hmmm.... is there a way to tell the entry points which command-line flags to specify for the auto-generated Python start scripts?