ipython / ipython/traitlets

Application.load_config_file loads all files with same basename as given file

未关闭
#850 3 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
Python
星标
653
派生
217
平均合并
2 天 21 小时
30 天内合并 PR
2

描述

Even if `load_config_file` is given an absolute path to a config file, it will load all files that have the same basename that are in that directory.

This is highly surprising and potentially a security issue.

Example:

```python
from pathlib import Path
from traitlets import Integer
from traitlets.config import Application
from tempfile import TemporaryDirectory

class Foo(Application):
bar = Integer(0).tag(config=True)

def start(self):
print(self.bar)

if __name__ == "__main__":
with TemporaryDirectory() as tmpdir:
tmpdir = Path(tmpdir)
json_path = tmpdir / "foo.json"
py_path = tmpdir / "foo.py"

# valid python, invalid
py_path.write_text("c.Foo.bar = 10")
json_path.write_text("Invalid json")

app = Foo()
app.load_config_file(py_path)
app.start()

# other way around
py_path.write_text("raise Exception('You loaded the python file!')")
json_path.write_text('{"Foo": {"bar": 11}}')

app = Foo()
app.load_config_file(json_path)
app.start()
```

贡献指南

打开贡献指南

调研方向

Start at Application.load_config_file and reproduce the two cases from the issue with temporary .py and .json files. Trace how the requested path is resolved and how matching files are selected. Add a regression test showing that loading one absolute path does not execute or parse another same-basename file.

由索引模型根据 Issue 内容生成。

评估

技术栈
python
领域
tooling
Issue 类型
缺陷
难度
3/5
预计耗时
1-2 天
活跃度
停滞
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。