bug#7454: python.el sys.path improperly removes current working directory

bug#7454: python.el sys.path improperly removes current working directory

[Brendan Miller]

For unknown reasons, python.el's run-python removes the current
working directory from
python's sys.path. This breaks the ability to import other modules in
the current
directory from inferior python sessions.

A more extended discussion is here:
http://stackoverflow.com/questions/2658475/python-mode-import-problem
with a suggested fix.

bug#7454: python.el sys.path improperly removes current working directory

[Glenn Morris]

Brendan Miller wrote:

> For unknown reasons, python.el's run-python removes the current
> working directory from python's sys.path.

The reasons are explained here

http://lists.gnu.org/archive/html/emacs-devel/2008-09/msg00215.html

bug#7454: python.el sys.path improperly removes current working directory

[Chong Yidong]

Glenn Morris <rgm@gnu.org> writes:

> Brendan Miller wrote:
>
>> For unknown reasons, python.el's run-python removes the current
>> working directory from python's sys.path.
>
> The reasons are explained here
>
> http://lists.gnu.org/archive/html/emacs-devel/2008-09/msg00215.html

Dave Love's upstream version has fixed this in a different way, by
avoiding module loading from world-writable directories.  I'll merge
this in.

bug#7454: python.el sys.path improperly removes current working directory

[Chong Yidong]

Actually, it looks like Dave is no longer treating python.el as being
covered by his copyright assignment, so we can't use his code.  I'll
work out a different solution.

bug#7454: python.el sys.path improperly removes current working directory

[Chong Yidong]

Brendan Miller <catphive@catphive.net> writes:

> python.el's run-python removes the current working directory from
> python's sys.path. This breaks the ability to import other modules in
> the current directory from inferior python sessions.

I've added a customization option, python-remove-cwd-from-path, to the
emacs-23 branch for those who want to disable this behavior.

bug#7454: python.el sys.path improperly removes current working directory

[Stefan Monnier]

>>> For unknown reasons, python.el's run-python removes the current
>>> working directory from python's sys.path.
>> The reasons are explained here
>> http://lists.gnu.org/archive/html/emacs-devel/2008-09/msg00215.html

> Dave Love's upstream version has fixed this in a different way, by
> avoiding module loading from world-writable directories.  I'll merge
> this in.

This makes the security hole smaller, but it's still present.  E.g. you
may download an evil Python package into your home, then visit the files
in Emacs (e.g. to see if these files look safe for use) and use some of
python.el's features that happens to cause Python to be started: gotcha!


        Stefan

bug#7454: python.el sys.path improperly removes current working directory

[Brendan Miller]

On Sun, Nov 21, 2010 at 12:09 PM, Stefan Monnier
<monnier@iro.umontreal.ca> wrote:
>>>> For unknown reasons, python.el's run-python removes the current
>>>> working directory from python's sys.path.
>>> The reasons are explained here
>>> http://lists.gnu.org/archive/html/emacs-devel/2008-09/msg00215.html
>
>> Dave Love's upstream version has fixed this in a different way, by
>> avoiding module loading from world-writable directories.  I'll merge
>> this in.
>
> This makes the security hole smaller, but it's still present.  E.g. you
> may download an evil Python package into your home, then visit the files
> in Emacs (e.g. to see if these files look safe for use) and use some of
> python.el's features that happens to cause Python to be started: gotcha!
>
>
>        Stefan
>

It seems like there's a very simple solution to this that will keep
the security hole fixed, but still allow us to import modules from the
pwd normally.

Since the security hole is that we might import emacs.py from the
current working directory, the *only* place where we don't want the
pwd on the path is:
line 1578: (python-send-string "import emacs")

Correct?

So the solution is just to add this single line after it:
(python-send-string "sys.path[0:0] = ['']")

Which adds the pwd (the empty string) back to the front of the path.

I currently have almost the same thing setup by running that in my
inferior-python-mode-hook, and it seems to work.