oss-sec mailing list archives

Re: ipython3 may execute code from the current working directory


From: Jakub Wilk <jwilk () jwilk net>
Date: Thu, 22 Jul 2021 13:35:45 +0200

* Georgi Guninski <gguninski () gmail com>, 2021-07-22, 11:52:
Summary: under certain circumstances, ipython3 may execute code from the current working directory.

Looks like this might be intentional? Or at least there's an option to turn off this behavior:

https://github.com/ipython/ipython/blob/7.25.0/IPython/core/shellapp.py#L219
https://ipython.readthedocs.io/en/stable/config/options/kernel.html#configtrait-InteractiveShellApp.ignore_cwd

However, in some Debian packages (at least 5.8.0-1 from Debian buster), even --ignore-cwd doesn't help, because /usr/bin/python3 looks like this:

  VERSION="3"
  if [ ! -f /usr/bin/python$VERSION ]
  then
          echo "Please install the python$VERSION package." >&2
          exit 1
  else
          exec python$VERSION -c "import sys; sys.argv[0] = '/usr/bin/ipython$VERSION'; from IPython.terminal.ipapp import 
launch_new_instance; launch_new_instance()" "$@"
  fi

But "python3 -c" adds cwd to sys.path.

--
Jakub Wilk


Current thread: