[PATCH] python.el(run-python): Explain why we remove the current directory from sys.path

[eric . hanchrow]

From: Eric Hanchrow <address@hidden>

---
 lisp/progmodes/python.el |    6 +++++-
 1 files changed, 5 insertions(+), 1 deletions(-)

diff --git a/lisp/progmodes/python.el b/lisp/progmodes/python.el
index 7221d8e..81d073a 100644
--- a/lisp/progmodes/python.el
+++ b/lisp/progmodes/python.el
@@ -1552,7 +1552,11 @@ buffer for a list of commands.)"
     (with-current-buffer
        (let* ((cmdlist
                (append (python-args-to-list cmd)
-                       '("-i" "-c" "import sys; sys.path.remove('')")))
+                       ;; Removing the current directory from
+                       ;; sys.path prevents an attacker from tricking
+                       ;; us into running malicious code.  See
+                       ;; http://article.gmane.org/gmane.emacs.devel/103569
+                        '("-i" "-c" "import sys; sys.path.remove('')")))
               (path (getenv "PYTHONPATH"))
               (process-environment     ; to import emacs.py
                (cons (concat "PYTHONPATH="
-- 
1.6.2