Skip to content

gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI - #161706

Merged
vstinner merged 8 commits into
python:mainfrom
vstinner:sys_path0
Nov 9, 2026
Merged

gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI#161706
vstinner merged 8 commits into
python:mainfrom
vstinner:sys_path0

Conversation

@vstinner

@vstinner vstinner commented Nov 9, 2026 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Member

Remove sys.path[0] in gzip, tarfile and zipfile command line interface to prevent shadowing standard library modules from extracted files.

  • Add sys._path0 variable.
  • pymain_sys_path_add_path0() sets sys._path0.
  • Add runpy._remove_sys_path0().
  • gzpi, tarfile and zipfile main functions now call _remove_sys_path0() to prevent shadowing stdlib modules from extracted files.

@vstinner @gpshead
pythongh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI
3b41ecb 
Remove sys.path[0] in gzip, tarfile and zipfile command line
interface to prevent shadowing standard library modules from
extracted files.

* Add sys._path0 variable.
* pymain_sys_path_add_path0() sets sys._path0.
* Add runpy._remove_sys_path0().
* gzpi, tarfile and zipfile main functions now call
  _remove_sys_path0() to prevent shadowing stdlib modules from
  extracted files.

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
@vstinner vstinner added the type-security A security issue label Nov 9, 2026
@bedevere-app bedevere-app Bot mentioned this pull request Nov 9, 2026
Open
@read-the-docs-community

read-the-docs-community Bot commented Nov 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #35770317 | 📁 Comparing a25df3f against main (ad126c9)

  🔍 Preview build  

4 files changed
± c-api/init_config.html
± library/sys.html
± using/cmdline.html
± whatsnew/changelog.html

@vstinner
_remove_sys_path0() now modifies sys.path in-place
6882ff1 
Don't create a new list object anymore.
@vstinner vstinner added needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes labels Nov 9, 2026
ethanfurman
ethanfurman reviewed Nov 9, 2026
View reviewed changes
Comment thread Lib/test/test_runpy.py Resolved
Eclips4
Eclips4 reviewed Nov 9, 2026
View reviewed changes
Comment thread Lib/runpy.py Resolved
Comment thread Lib/runpy.py Resolved
Comment thread Lib/runpy.py Resolved
vstinner and others added 3 commits November 9, 2026 23:03
@vstinner @Eclips4
Update Lib/runpy.py
feaffef 
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
@vstinner @Eclips4
Update Lib/runpy.py
eb7d635 
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
@vstinner
Do nothing is sys._path0 == sys._stdlib_dir
296c65e 
Cleanup tests
@vstinner

vstinner commented Nov 9, 2026

Copy link
Copy Markdown
Member Author

@Eclips4: I updated runpy._remove_sys_path0() to do nothing if sys._path0 == sys._stdlib_dir. Removing sys._stdlib_dir from sys.path is pretty bad, it breaks gzip for example (see my comment above).

@vstinner
Fix test
59a8da4 
Keep a copy of sys_path to make sure that it's unchanged.
@vstinner
vstinner enabled auto-merge (squash) November 9, 2026 22:38
@vstinner
vstinner merged commit e891a91 into python:main Nov 9, 2026
57 checks passed
@vstinner
vstinner deleted the sys_path0 branch November 9, 2026 23:49
@miss-islington-app

miss-islington-app Bot commented Nov 9, 2026

Copy link
Copy Markdown

Thanks @vstinner for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖

@miss-islington-app

miss-islington-app Bot commented Nov 9, 2026

Copy link
Copy Markdown

Sorry, @vstinner, I could not cleanly backport this to 3.14 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker e891a9117985888df3e5d48145cf07ddda098335 3.14

@bedevere-app

bedevere-app Bot commented Nov 9, 2026

Copy link
Copy Markdown

GH-161717 is a backport of this pull request to the 3.15 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.15 bugs and security fixes label Nov 9, 2026
@miss-islington-app

miss-islington-app Bot commented Nov 9, 2026

Copy link
Copy Markdown

Sorry, @vstinner, I could not cleanly backport this to 3.13 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker e891a9117985888df3e5d48145cf07ddda098335 3.13

@miss-islington-app

miss-islington-app Bot commented Nov 9, 2026

Copy link
Copy Markdown

Sorry, @vstinner, I could not cleanly backport this to 3.12 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker e891a9117985888df3e5d48145cf07ddda098335 3.12

@miss-islington-app

miss-islington-app Bot commented Nov 9, 2026

Copy link
Copy Markdown

Sorry, @vstinner, I could not cleanly backport this to 3.11 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker e891a9117985888df3e5d48145cf07ddda098335 3.11

@bedevere-app

bedevere-app Bot commented Nov 10, 2026

Copy link
Copy Markdown

GH-161719 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Nov 10, 2026
@vstinner vstinner removed needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes labels Nov 10, 2026
@vstinner

vstinner commented Nov 10, 2026

Copy link
Copy Markdown
Member Author

Merged. Thanks for useful reviews! I pushed a late fix: runpy._remove_sys_path0() no longer removes sys._path0 if it's equal to sys._stdlib_dir.

vstinner added a commit that referenced this pull request Nov 10, 2026
@miss-islington @vstinner
@gpshead @ethanfurman @Eclips4
[3.15] gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (
673607e 
GH-161706) (#161717)

gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (GH-161706)

Remove sys.path[0] in gzip, tarfile and zipfile command line
interface to prevent shadowing standard library modules from
extracted files.

* Add sys._path0 variable.
* pymain_sys_path_add_path0() sets sys._path0.
* Add runpy._remove_sys_path0().
* gzip, tarfile and zipfile main functions now call
  _remove_sys_path0() to prevent shadowing stdlib modules from
  extracted files.
(cherry picked from commit e891a91)

Co-authored-by: Victor Stinner <vstinner@python.org>
Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
Co-authored-by: Ethan Furman <ethan@stoneleaf.us>
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
vstinner added a commit that referenced this pull request Nov 10, 2026
@vstinner @gpshead
@ethanfurman @Eclips4
[3.14] gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (
8aa5d65 
#161706) (#161719)

gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (#161706)

Remove sys.path[0] in gzip, tarfile and zipfile command line
interface to prevent shadowing standard library modules from
extracted files.

* Add sys._path0 variable.
* pymain_sys_path_add_path0() sets sys._path0.
* Add runpy._remove_sys_path0().
* gzip, tarfile and zipfile main functions now call
  _remove_sys_path0() to prevent shadowing stdlib modules from
  extracted files.




(cherry picked from commit e891a91)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
Co-authored-by: Ethan Furman <ethan@stoneleaf.us>
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
This was referenced Nov 10, 2026
Open
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ethanfurman ethanfurman ethanfurman approved these changes
@sethmlarson sethmlarson sethmlarson approved these changes
@Eclips4 Eclips4 Eclips4 approved these changes
@ericsnowcurrently ericsnowcurrently Awaiting requested review from ericsnowcurrently ericsnowcurrently is a code owner
@FFY00 FFY00 Awaiting requested review from FFY00 FFY00 is a code owner

Assignees

@vstinner vstinner

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@vstinner @ethanfurman @sethmlarson @Eclips4