Application.load_config_file loads all files with same basename as given file
- 主要语言
- Python
- 星标
- 653
- 派生
- 217
- 平均合并
- 2 天 21 小时
- 30 天内合并 PR
- 2
描述
Even if `load_config_file` is given an absolute path to a config file, it will load all files that have the same basename that are in that directory.
This is highly surprising and potentially a security issue.
Example:
```python
from pathlib import Path
from traitlets import Integer
from traitlets.config import Application
from tempfile import TemporaryDirectory
class Foo(Application):
bar = Integer(0).tag(config=True)
def start(self):
print(self.bar)
if __name__ == "__main__":
with TemporaryDirectory() as tmpdir:
tmpdir = Path(tmpdir)
json_path = tmpdir / "foo.json"
py_path = tmpdir / "foo.py"
# valid python, invalid
py_path.write_text("c.Foo.bar = 10")
json_path.write_text("Invalid json")
app = Foo()
app.load_config_file(py_path)
app.start()
# other way around
py_path.write_text("raise Exception('You loaded the python file!')")
json_path.write_text('{"Foo": {"bar": 11}}')
app = Foo()
app.load_config_file(json_path)
app.start()
```
贡献指南
调研方向
Start at Application.load_config_file and reproduce the two cases from the issue with temporary .py and .json files. Trace how the requested path is resolved and how matching files are selected. Add a regression test showing that loading one absolute path does not execute or parse another same-basename file.
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- python
- 领域
- tooling
- Issue 类型
- 缺陷
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 活跃度
- 停滞
- 描述清晰度
- 基本清楚
- 新手友好度
- 35/100