homepage

This issue tracker has been migrated to GitHub , and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: Calling Tkinter.Tk() with a baseName keyword argument throws UnboundLocalError
Type: behavior Stage: resolved
Components: Tkinter Versions: Python 2.7
process
Status: closed Resolution: duplicate
Dependencies: Superseder: Security bug in tkinter allows for untrusted, arbitrary code execution.
View: 16248
Assigned To: Nosy List: r.david.murray, serhiy.storchaka, terry.reedy, y-fujii
Priority: normal Keywords:

Created on 2013年04月20日 11:57 by y-fujii, last changed 2022年04月11日 14:57 by admin. This issue is now closed.

Messages (4)
msg187418 - (view) Author: Yasuhiro Fujii (y-fujii) * Date: 2013年04月20日 11:57
Calling Tkinter.Tk() with baseName keyword argument throws UnboundLocalError on Python 2.7.4.
A process to reproduce the bug:
>>> import Tkinter
>>> Tkinter.Tk(baseName="test")
Traceback (most recent call last):
 File "<stdin>", line 1, in <module>
 File "/usr/lib/python2.7/lib-tk/Tkinter.py", line 1748, in __init__
 if not sys.flags.ignore_environment:
UnboundLocalError: local variable 'sys' referenced before assignment
A patch to fix the bug:
--- Lib/lib-tk/Tkinter.py.orig
+++ Lib/lib-tk/Tkinter.py
@@ -1736,7 +1736,7 @@
 # ensure that self.tk is always _something_.
 self.tk = None
 if baseName is None:
- import sys, os
+ import os
 baseName = os.path.basename(sys.argv[0])
 baseName, ext = os.path.splitext(baseName)
 if ext not in ('.py', '.pyc', '.pyo'):
msg187422 - (view) Author: R. David Murray (r.david.murray) * (Python committer) Date: 2013年04月20日 13:14
Thanks for the report and patch. It would be nice to turn that test into a unit test.
I've run the test on 3.4; this appears to be a 2.7 only bug.
msg187872 - (view) Author: Terry J. Reedy (terry.reedy) * (Python committer) Date: 2013年04月26日 20:22
Line 35 is "import sys" so sys imports within functions are superfluous, as well as contrary to current guidelines. There is another on 1033. Both were removed before 3.3, so this amounts to a 2.7 backport.
It took me a moment to see that the unneeded conditional import is not innocuous, as it localizes 'sys' while sometimes leaving it unbound. Good catch.
Yashuhiro, can you sign a PSF contributor license agreement? The electronic version is easy.
 http://www.python.org/psf/contrib/contrib-form/
We don't really need it for this patch, but we hope to see more from you.
A minimal test would be a unittest version of
 assert isinstance(Tk(baseName="test"), Tk)
This mainly tests that no exceptions are raised when the arg is present. The doc may suggest that baseName should have a visible effect on the instance that could be tested. If there is already a 3.x test, it should be backported. If not, anything added to 2.7 should be added to 3.x also.
msg195907 - (view) Author: Serhiy Storchaka (serhiy.storchaka) * (Python committer) Date: 2013年08月22日 15:34
Fixed in changesets fa82071bb7e1 and 0f17aed78168.
History
Date User Action Args
2022年04月11日 14:57:44adminsetgithub: 62003
2013年08月22日 15:34:25serhiy.storchakasetstatus: open -> closed

superseder: Security bug in tkinter allows for untrusted, arbitrary code execution.

nosy: + serhiy.storchaka
messages: + msg195907
resolution: duplicate
stage: test needed -> resolved
2013年04月26日 20:22:38terry.reedysetnosy: + terry.reedy
messages: + msg187872
2013年04月20日 13:14:56r.david.murraysetnosy: + r.david.murray

messages: + msg187422
stage: test needed
2013年04月20日 11:57:47y-fujiicreate

AltStyle によって変換されたページ (->オリジナル) /