4 ms·
This is a very bad idea, for the same reason that relative directories are not on the regular PATH on Unix: On a multi-user system, or even a single-user system
by ptx 11y ago
This is a very bad idea, for the same reason that relative directories are not on the regular PATH on Unix: On a multi-user system, or even a single-user system that sometimes has untrusted files on it, you can't safely use your tools if they can be overridden by whatever someone happens to have placed in the current directory.
For example, if you're looking through various home directories for some file, you might be doing something like:
$ cd /home/foo
$ ls
$ cd /home/bar
$ ls
If your PATH contained ".useful_stuff/tools" and the user bar happened to have a file called "/home/bar/.useful_stuff/tools/ls", that file has now been executed instead of /bin/ls, with your privileges. Your account has now been compromised.
Try this:
[ptx@hn downloads]$ python3 -c 'print("hello")'
hello
[ptx@hn downloads]$ export PYTHONPATH="./.pip"
[ptx@hn downloads]$ python3 -c 'print("hello")'
You have been owned! Have a nice day.
hello
[ptx@hn downloads]$ cat .pip/site.py
print("You have been owned! Have a nice day.")
For this same reason, if you use Mercurial on a repository owned by someone else, you get something like:
[root@host foo]# hg stat
not trusting file /home/ptx/foo/.hg/hgrc from untrusted user ptx, group users
Microsoft had a related security problem a few years back where they would load DLL files from the current directory:
https://isc.sans.edu/diary/DLL+hijacking+vulnerabilities/9445 https://isc.sans.edu/diary/DLL+hijacking+vulnerabilities/944...