Re: Untrusted search path vulnerabilities

2010-11-22 Thread Jakub Wilk
* Mike Hommey , 2010-11-18, 12:17: A number of packages in the archive sets the PYTHONPATH environment variable in an insecure way. They do something like:      PYTHONPATH=/spam/eggs:$PYTHONPATH This is wrong, because if PYTHONPATH were originally unset or empty, current working directory wou

Re: Untrusted search path vulnerabilities

2010-11-18 Thread Mike Hommey
On Thu, Nov 18, 2010 at 07:04:07PM +0800, Paul Wise wrote: > > On Wed, Nov 17, 2010 at 22:58, Jakub Wilk wrote: > >> A number of packages in the archive sets the PYTHONPATH environment > >> variable > >> in an insecure way. They do something like: > >> > >>      PYTHONPATH=/spam/eggs:$PYTHONPATH

Re: Untrusted search path vulnerabilities

2010-11-18 Thread Paul Wise
> On Wed, Nov 17, 2010 at 22:58, Jakub Wilk wrote: >> A number of packages in the archive sets the PYTHONPATH environment variable >> in an insecure way. They do something like: >> >>      PYTHONPATH=/spam/eggs:$PYTHONPATH >> >> This is wrong, because if PYTHONPATH were originally unset or empty,