#13579: Python sys.path security risk
-------------------------------------------------------+--------------------
Reporter: vbraun | Owner: mvngu
Type: defect | Status:
positive_review
Priority: blocker | Milestone:
sage-5.4
Component: doctest | Resolution:
Keywords: | Work issues:
Report Upstream: Reported upstream. No feedback yet. | Reviewers: Volker
Braun, Jeroen Demeyer
Authors: Jeroen Demeyer, Volker Braun | Merged in:
Dependencies: | Stopgaps:
-------------------------------------------------------+--------------------
Changes (by vbraun):
* status: needs_review => positive_review
Comment:
First of all, the discussion on the Python bugtracker shows that this
version of the patch is not going to be upstream. I would prefer a minimal
patch that just adds a warning while keeping the old behavior that could
be incorporated upstream. Having said that, I don't mind if we try out
this patch in Sage until the next upstream release.
* Error messages don't clearly state that this is a security risk. The
"not adding directory to sys.path since the write permissions are too
loose" implies that its OK to run scripts off `/tmp` and therefore
implicitly encourages insecure behavior.
* Since many packages (including some in the stdlib) re-add `cwd` if it
is missing, the patch doesn't actually guarantee safe execution in `/tmp`.
A short & sweet **Warning: It is not safe to run scripts in a world-
writeable directory (including /tmp)** would be better ihmo.
--
Ticket URL: <http://trac.sagemath.org/sage_trac/ticket/13579#comment:56>
Sage <http://www.sagemath.org>
Sage: Creating a Viable Open Source Alternative to Magma, Maple, Mathematica,
and MATLAB
--
You received this message because you are subscribed to the Google Groups
"sage-trac" group.
To post to this group, send email to [email protected].
To unsubscribe from this group, send email to
[email protected].
For more options, visit this group at
http://groups.google.com/group/sage-trac?hl=en.
