* bug#7454: python.el sys.path improperly removes current working directory
@ 2010-11-21 0:13 Brendan Miller
2010-11-21 1:47 ` Glenn Morris
2010-11-21 16:53 ` Chong Yidong
0 siblings, 2 replies; 7+ messages in thread
From: Brendan Miller @ 2010-11-21 0:13 UTC (permalink / raw)
To: 7454
For unknown reasons, python.el's run-python removes the current
working directory from
python's sys.path. This breaks the ability to import other modules in
the current
directory from inferior python sessions.
A more extended discussion is here:
http://stackoverflow.com/questions/2658475/python-mode-import-problem
with a suggested fix.
^ permalink raw reply [flat|nested] 7+ messages in thread
* bug#7454: python.el sys.path improperly removes current working directory
2010-11-21 0:13 bug#7454: python.el sys.path improperly removes current working directory Brendan Miller
@ 2010-11-21 1:47 ` Glenn Morris
2010-11-21 16:08 ` Chong Yidong
2010-11-21 16:10 ` Chong Yidong
2010-11-21 16:53 ` Chong Yidong
1 sibling, 2 replies; 7+ messages in thread
From: Glenn Morris @ 2010-11-21 1:47 UTC (permalink / raw)
To: Brendan Miller; +Cc: 7454
Brendan Miller wrote:
> For unknown reasons, python.el's run-python removes the current
> working directory from python's sys.path.
The reasons are explained here
http://lists.gnu.org/archive/html/emacs-devel/2008-09/msg00215.html
^ permalink raw reply [flat|nested] 7+ messages in thread
* bug#7454: python.el sys.path improperly removes current working directory
2010-11-21 1:47 ` Glenn Morris
@ 2010-11-21 16:08 ` Chong Yidong
2010-11-21 20:09 ` Stefan Monnier
2010-11-21 16:10 ` Chong Yidong
1 sibling, 1 reply; 7+ messages in thread
From: Chong Yidong @ 2010-11-21 16:08 UTC (permalink / raw)
To: Glenn Morris; +Cc: 7454, Brendan Miller
Glenn Morris <rgm@gnu.org> writes:
> Brendan Miller wrote:
>
>> For unknown reasons, python.el's run-python removes the current
>> working directory from python's sys.path.
>
> The reasons are explained here
>
> http://lists.gnu.org/archive/html/emacs-devel/2008-09/msg00215.html
Dave Love's upstream version has fixed this in a different way, by
avoiding module loading from world-writable directories. I'll merge
this in.
^ permalink raw reply [flat|nested] 7+ messages in thread
* bug#7454: python.el sys.path improperly removes current working directory
2010-11-21 16:08 ` Chong Yidong
@ 2010-11-21 20:09 ` Stefan Monnier
2010-11-21 20:36 ` Brendan Miller
0 siblings, 1 reply; 7+ messages in thread
From: Stefan Monnier @ 2010-11-21 20:09 UTC (permalink / raw)
To: Chong Yidong; +Cc: 7454, Brendan Miller
>>> For unknown reasons, python.el's run-python removes the current
>>> working directory from python's sys.path.
>> The reasons are explained here
>> http://lists.gnu.org/archive/html/emacs-devel/2008-09/msg00215.html
> Dave Love's upstream version has fixed this in a different way, by
> avoiding module loading from world-writable directories. I'll merge
> this in.
This makes the security hole smaller, but it's still present. E.g. you
may download an evil Python package into your home, then visit the files
in Emacs (e.g. to see if these files look safe for use) and use some of
python.el's features that happens to cause Python to be started: gotcha!
Stefan
^ permalink raw reply [flat|nested] 7+ messages in thread* bug#7454: python.el sys.path improperly removes current working directory
2010-11-21 20:09 ` Stefan Monnier
@ 2010-11-21 20:36 ` Brendan Miller
0 siblings, 0 replies; 7+ messages in thread
From: Brendan Miller @ 2010-11-21 20:36 UTC (permalink / raw)
To: Stefan Monnier; +Cc: 7454, Chong Yidong
On Sun, Nov 21, 2010 at 12:09 PM, Stefan Monnier
<monnier@iro.umontreal.ca> wrote:
>>>> For unknown reasons, python.el's run-python removes the current
>>>> working directory from python's sys.path.
>>> The reasons are explained here
>>> http://lists.gnu.org/archive/html/emacs-devel/2008-09/msg00215.html
>
>> Dave Love's upstream version has fixed this in a different way, by
>> avoiding module loading from world-writable directories. I'll merge
>> this in.
>
> This makes the security hole smaller, but it's still present. E.g. you
> may download an evil Python package into your home, then visit the files
> in Emacs (e.g. to see if these files look safe for use) and use some of
> python.el's features that happens to cause Python to be started: gotcha!
>
>
> Stefan
>
It seems like there's a very simple solution to this that will keep
the security hole fixed, but still allow us to import modules from the
pwd normally.
Since the security hole is that we might import emacs.py from the
current working directory, the *only* place where we don't want the
pwd on the path is:
line 1578: (python-send-string "import emacs")
Correct?
So the solution is just to add this single line after it:
(python-send-string "sys.path[0:0] = ['']")
Which adds the pwd (the empty string) back to the front of the path.
I currently have almost the same thing setup by running that in my
inferior-python-mode-hook, and it seems to work.
^ permalink raw reply [flat|nested] 7+ messages in thread
* bug#7454: python.el sys.path improperly removes current working directory
2010-11-21 1:47 ` Glenn Morris
2010-11-21 16:08 ` Chong Yidong
@ 2010-11-21 16:10 ` Chong Yidong
1 sibling, 0 replies; 7+ messages in thread
From: Chong Yidong @ 2010-11-21 16:10 UTC (permalink / raw)
To: Glenn Morris; +Cc: 7454, Brendan Miller
Actually, it looks like Dave is no longer treating python.el as being
covered by his copyright assignment, so we can't use his code. I'll
work out a different solution.
^ permalink raw reply [flat|nested] 7+ messages in thread
* bug#7454: python.el sys.path improperly removes current working directory
2010-11-21 0:13 bug#7454: python.el sys.path improperly removes current working directory Brendan Miller
2010-11-21 1:47 ` Glenn Morris
@ 2010-11-21 16:53 ` Chong Yidong
1 sibling, 0 replies; 7+ messages in thread
From: Chong Yidong @ 2010-11-21 16:53 UTC (permalink / raw)
To: Brendan Miller; +Cc: 7454
Brendan Miller <catphive@catphive.net> writes:
> python.el's run-python removes the current working directory from
> python's sys.path. This breaks the ability to import other modules in
> the current directory from inferior python sessions.
I've added a customization option, python-remove-cwd-from-path, to the
emacs-23 branch for those who want to disable this behavior.
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2010-11-21 20:36 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-11-21 0:13 bug#7454: python.el sys.path improperly removes current working directory Brendan Miller
2010-11-21 1:47 ` Glenn Morris
2010-11-21 16:08 ` Chong Yidong
2010-11-21 20:09 ` Stefan Monnier
2010-11-21 20:36 ` Brendan Miller
2010-11-21 16:10 ` Chong Yidong
2010-11-21 16:53 ` Chong Yidong
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/emacs.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).