[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Untrusted search path vulnerabilities



On Friday 19,November,2010 03:47 AM, Filippo Rusconi wrote:
> Hello, Pythonistas,
> 
> in my slow learning of Python and of Python program packaging, here am
> I again asking for advice:
> 
> On Wed, Nov 17, 2010 at 10:58:48PM +0100, Jakub Wilk wrote:
>> A number of packages in the archive sets the PYTHONPATH environment
>> variable in an insecure way. They do something like:
>>
>>       PYTHONPATH=/spam/eggs:$PYTHONPATH
>>
>> This is wrong, because if PYTHONPATH were originally unset or empty,
>> current working directory would be added to sys.path.
> 
> OK, so I may test if the content of the PYTHONPATH variable is empty
> the way below, so that I can set the path in differenciated manners :
> 
> ~~~~~~~~~~ start-script ~~~~~~~~~~~
> 
> #!/bin/sh
> 
> # Only append ${PYTHONPATH} if it actually contains something. Thus,
> # test the length of the string in PYTHONPATH.
> if [ "${#PYTHONPATH}" = "0" ]
> then
>     PYTHONPATH=/usr/lib/mmass/mspy/plot
> else
>     PYTHONPATH=/usr/lib/mmass/mspy/plot:${PYTHONPATH}
> fi
> 
> export PYTHONPATH
> exec python2.6 /usr/share/mmass/mmass.py
> 
> ~~~~~~~ end ~~~~~~~


You probably want something like:

export PYTHONPATH=/usr/lib/mmass/mspy/plot${PYTHONPATH:+:$PYTHONPATH}


-- 
Kind regards,
Loong Jin

Attachment: signature.asc
Description: OpenPGP digital signature


Reply to: