Untrusted arbitrary code execution?
- 主要语言
- Python
- 星标
- 198
- 派生
- 14
- PR 合并指标
- 30 天内没有已合并 PR
描述
Is this expected?
```bash
antoine@elune /tmp/tmp.ucyPsHjPcy/untrusted_code % cat /usr/bin/grep.py
#!/usr/bin/env python3
import os
print('Running grep.')
```
```bash
antoine@elune /tmp/tmp.ucyPsHjPcy/untrusted_code % cat os.py
print('MALICIOUS')
```
```bash
antoine@elune /tmp/tmp.ucyPsHjPcy/untrusted_code % pythonloc /usr/bin/grep.py
MALICIOUS
Fatal Python error: initsite: Failed to import the site module
Traceback (most recent call last):
[...]
AttributeError: module 'os' has no attribute 'path'
```
It doesn't seem reasonable at all to me that running a random script installed on my system with pythonloc would override its libraries with potentially arbitrary code in the directory I'm running the script from.
贡献指南
这个仓库没有索引到贡献指南
评估
这个 Issue 还没有评估数据。