[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 23 Jul 2021 14:39:33 -0600
From: Mats Wichmann <mats@...hmann.us>
To: oss-security@...ts.openwall.com
Subject: Re: ipython3 may execute code from the current working
directory
On 7/22/21 5:35 AM, Jakub Wilk wrote:
> * Georgi Guninski <gguninski@...il.com>, 2021-07-22, 11:52:
>> Summary: under certain circumstances, ipython3 may execute code from
>> the current working directory.
>
> Looks like this might be intentional? Or at least there's an option to
> turn off this behavior:
>
> https://github.com/ipython/ipython/blob/7.25.0/IPython/core/shellapp.py#L219
normally (cpython), an empty string in sys.path doesn't mean "current
directory", it means "script directory", the directory the script you're
running is found in [1]. that only falls back to current directory in
case there is no script directory - which happens if you invoke the
interpreter interactively . So maybe ipython isn't interpreting this the
same way?
there have been more than one security concern about the way this makes
it possible for untrusted modules to get loaded.
[1] https://docs.python.org/3/library/sys.html#sys.path
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
