Repository navigation
os.defpath too permissive #70602
Description
| BPO | 26414 |
|---|---|
| Nosy | @jwilk, @dhduvall, @vadmium, @nitishch |
| Superseder | |
| Files |
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = None
closed_at = <Date 2019-01-17.23:16:04.241>
created_at = <Date 2016-02-22.22:50:17.557>
labels = ['library']
title = 'os.defpath too permissive'
updated_at = <Date 2019-01-17.23:16:04.240>
user = 'https://bugs.python.org/jbeck'bugs.python.org fields:
activity = <Date 2019-01-17.23:16:04.240>
actor = 'eryksun'
assignee = 'none'
closed = True
closed_date = <Date 2019-01-17.23:16:04.241>
closer = 'eryksun'
components = ['Library (Lib)']
creation = <Date 2016-02-22.22:50:17.557>
creator = 'jbeck'
dependencies = []
files = ['42010']
hgrepos = []
issue_num = 26414
keywords = ['patch']
message_count = 3.0
messages = ['260703', '260717', '307816']
nosy_count = 6.0
nosy_names = ['jwilk', 'dhduvall', 'swalker', 'martin.panter', 'jbeck', 'nitishch']
pr_nums = []
priority = 'normal'
resolution = 'duplicate'
stage = 'resolved'
status = 'closed'
superseder = '35755'
type = None
url = 'https://bugs.python.org/issue26414'
versions = ['Python 2.7', 'Python 3.4', 'Python 3.5', 'Python 3.6']
Activity
jbeck commentedon Feb 22, 2016
A bug has been filed against Solaris' internal version of Python, which is
largely the same (including in this case) as the base version we get from
python.org. The bug is that os.defpath starts with ':' and thus any Python
script run with a null PATH environment variable will use the current
working directory as its first entry. This is generally considered to
be bad practice, and especially dangerous for anyone running with root
privileges on a Unix box. So we intend to change Solaris' version of
Python to elide this, i.e., to apply the attached patch to our 2.7 version
and comparable patches to our 3.4 and 3.5 versions
As a precaution, I queried the security list before filing this bug, asking:
to confirm.)
of any gotchas we should look out for? There were no regressions when I
ran the Python test suite.
and got the following reply:
---
From: Guido van Rossum <[email protected]>
Date: Sat, 20 Feb 2016 09:29:11 -0800
Subject: Re: [PSRT] os.defpath too permissive
Wow. That looks like something really old. I think you can just file
an issue with a patch for this at bugs.python.org. I agree that it
should be fixed. I don't think there are many users that would be
vulnerable, nor do I think that much code would break; the only use in
the stdlib has os.environ.get("PATH", os.defpath) so in all practical
cases it would get the user's $PATH variable (which is presumably
safe) anyway.
---
So I am now filing this bug as suggested.
vadmium commentedon Feb 23, 2016
Digging through the history, it has been this way since at least revision d5b67d2ec7ee (1994).
Removing the colon is definitely a good idea. Maybe this might be a more proper way to get the default PATH:
>>> os.confstr("CS_PATH") '/bin:/usr/bin'jwilk commentedon Dec 7, 2017
Linux man page for execvp(3)
<http://man7.org/linux/man-pages/man3/execvp.3.html\> says:
So while having cwd is os.defpath has some historical justification,
now that glibc dropped it from its default PATH, it would be prudent for
Python to follow the suit.