[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
bug#7454: python.el sys.path improperly removes current working director
bug#7454: python.el sys.path improperly removes current working directory
Sun, 21 Nov 2010 15:09:36 -0500
Gnus/5.13 (Gnus v5.13) Emacs/24.0.50 (gnu/linux)
>>> For unknown reasons, python.el's run-python removes the current
>>> working directory from python's sys.path.
>> The reasons are explained here
> Dave Love's upstream version has fixed this in a different way, by
> avoiding module loading from world-writable directories. I'll merge
> this in.
This makes the security hole smaller, but it's still present. E.g. you
may download an evil Python package into your home, then visit the files
in Emacs (e.g. to see if these files look safe for use) and use some of
python.el's features that happens to cause Python to be started: gotcha!