homepage

This issue tracker has been migrated to GitHub , and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: Don't import readline in isolated mode
Type: security Stage: resolved
Components: Interpreter Core Versions: Python 3.7, Python 3.6
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: steve.dower Nosy List: christian.heimes, python-dev, steve.dower
Priority: normal Keywords:

Created on 2016年09月17日 18:58 by steve.dower, last changed 2022年04月11日 14:58 by admin. This issue is now closed.

Pull Requests
URL Status Linked Edit
PR 552 closed dstufft, 2017年03月31日 16:36
Messages (9)
msg276816 - (view) Author: Steve Dower (steve.dower) * (Python committer) Date: 2016年09月17日 18:58
When running in isolated mode, readline should not be automatically imported (as it could conceivably be arbitrary code).
msg276820 - (view) Author: Steve Dower (steve.dower) * (Python committer) Date: 2016年09月17日 19:05
Should also allow users to explicitly call site.enablerlcompleter() if they really want it.
msg276826 - (view) Author: Roundup Robot (python-dev) (Python triager) Date: 2016年09月17日 19:57
New changeset b0350f351752 by Steve Dower in branch '3.6':
Issue #28192: Don't import readline in isolated mode
https://hg.python.org/cpython/rev/b0350f351752 
msg276829 - (view) Author: Christian Heimes (christian.heimes) * (Python committer) Date: 2016年09月17日 20:01
+1, but your patch is missing Misc/NEWS and a merge to 'default'. The code in Modules/main.c is getting harder to read, too.
msg276831 - (view) Author: Steve Dower (steve.dower) * (Python committer) Date: 2016年09月17日 20:02
The NEWS change slipped into my following commit, and I just did the one merge.
Since you're here, any ideas on how to test this? Adding a readline.py during the test suite will affect any tests running in parallel...
msg276833 - (view) Author: Christian Heimes (christian.heimes) * (Python committer) Date: 2016年09月17日 20:06
The robot didn't mention your merge because the tracker id was not in the submit messages. I just saw it on python-cvs.
How about a test in subprocess? You could drop a readline.py into Lib/tests/somedirectory and run sys.executable with cwd='Lib/tests/somedirectory').
msg276834 - (view) Author: Steve Dower (steve.dower) * (Python committer) Date: 2016年09月17日 20:06
Also, I think PEP 432 is the way to go about simplifying Py_Main, and I'm keen to see it happen (presumably for 3.7). But the time constraints make it hard, which is why Nick hasn't gotten it done yet either.
msg276851 - (view) Author: Roundup Robot (python-dev) (Python triager) Date: 2016年09月17日 21:35
New changeset 5761294bb877 by Steve Dower in branch '3.6':
Issue #28192: Adds tests for hook in isolated mode
https://hg.python.org/cpython/rev/5761294bb877
New changeset 6c7a8a012669 by Steve Dower in branch 'default':
Issue #28192: Adds tests for hook in isolated mode
https://hg.python.org/cpython/rev/6c7a8a012669 
msg276852 - (view) Author: Steve Dower (steve.dower) * (Python committer) Date: 2016年09月17日 21:37
Turned out that we really only need to check for sys.__interactivehook__, which made it much easier to write the tests.
History
Date User Action Args
2022年04月11日 14:58:37adminsetgithub: 72379
2017年03月31日 16:36:38dstufftsetpull_requests: + pull_request1101
2016年09月24日 19:22:02christian.heimeslinkissue12238 superseder
2016年09月17日 21:37:07steve.dowersetstatus: open -> closed
resolution: fixed
messages: + msg276852

stage: needs patch -> resolved
2016年09月17日 21:35:57python-devsetmessages: + msg276851
2016年09月17日 20:06:09steve.dowersetmessages: + msg276834
2016年09月17日 20:06:06christian.heimessetmessages: + msg276833
2016年09月17日 20:02:59steve.dowersetmessages: + msg276831
2016年09月17日 20:01:43christian.heimessettype: behavior -> security
components: + Interpreter Core
2016年09月17日 20:01:22christian.heimessetnosy: + christian.heimes
messages: + msg276829
2016年09月17日 19:57:29python-devsetnosy: + python-dev
messages: + msg276826
2016年09月17日 19:05:38steve.dowersetmessages: + msg276820
2016年09月17日 18:58:34steve.dowercreate

AltStyle によって変換されたページ (->オリジナル) /