Eryk Sun wrote:

On 2/24/20, jdveiga@gmail.com jdveiga@gmail.com wrote:

...

It is the intended and the expected behaviour. The working directory is always added to the sys.path. You mean always in this particular context, i.e. the working directory

is added normally when executing a command via -c or a module as a script via -m. When executing a script normally, the script directory gets added, which is reasonably secure.

Yeah, you are right.

Adding the working directory to sys.path is ok for the interactive shell and -c commands, but I don't understand why it gets added with -m, which is a security hole, and to me an annoyance. It can be disabled with isolated mode, but that's a blunt instrument that disables too much.

If current directory is not added to the sys.path, how can modules be imported outside PYTHONPATH? https://docs.python.org/3/glossary.html#term-import-path Python cannot guess where your modules are if paths to search for them are not provided. If you run a script from terminal it is assumed that your modules are in the working directory. Is another asumption possible? Maybe you can pass this path via CLI but I think that this is not currently possible. As long as I know, you must include your path in PYTHONPATH or run it from a proper directory. Correct me if I am wrong. On the other hand, can you explain why adding the current directory to importable paths creates a security hole? I am curious. No idea about this.

Nick Timkovich wrote:

...

Are you familiar with the -I option for "isolated mode"? https://docs.python.org/3/using/cmdline.html#id2 -I Run Python in isolated mode. This also implies -E and -s. In isolated mode sys.path contains neither the script’s directory nor the user’s site-packages directory. All PYTHON* environment variables are ignored, too. Further restrictions may be imposed to prevent the user from injecting malicious code. New in version 3.4.

Oooh... Can you provide some examples on the use of -I? I try to use along with -m (`python -I -m a.b`) and get this error: "python: Error while finding module specification for 'a.b' (ModuleNotFoundError: No module named 'a')". On the other hand `python -m a.b -I` just passed -I as a script's CLI argument. Of course, I get the expected results if run `python -I` on terminal.

On Mon, Feb 24, 2020 at 6:04 PM Eryk Sun wrote:

On 2/24/20, jdveiga@gmail.com wrote:

...

I try to use along with -m (`python -I -m a.b`) and get this error:

"python:

...

Error while finding module specification for 'a.b' (ModuleNotFoundError: No module named 'a')".

This is a use case for -m that requires adding the working directory to sys.path. I work in virtual environments, and I don't navigate into a package and execute modules. The target package is always either in the standard library or installed in site-packages, and the module is executed from the top level. So for me adding the working directory is a feature I never need, and I completely forgot about why anyone would want it.

Having the working directory added when using the -m flag is something I use in quite a few of my project. See https://aroberge.github.io/friendly-traceback-docs/docs/html/usage.html for example (example usages 3 to 6 rely on this).

_______________________________________________ Python-ideas mailing list -- python-ideas@python.org To unsubscribe send an email to python-ideas-leave@python.org https://mail.python.org/mailman3/lists/python-ideas.python.org/ Message archived at https://mail.python.org/archives/list/python-ideas@python.org/message/RAZRNA... Code of Conduct: http://python.org/psf/codeofconduct/

I guess I'm confused if you want (e.g.) `python json.py` to do something but not `python -m json` to call the same file (a different way), given you're in the directory. nick@lappy386:~/Code$ echo "{}" | python -m json.tool {} nick@lappy386:~/Code$ touch json.py nick@lappy386:~/Code$ echo "{}" | python -m json.tool .../bin/python: Error while finding module specification for 'json.tool' (ModuleNotFoundError: __path__ attribute not found on 'json' while trying to find 'json.tool') nick@lappy386:~/Code$ echo "{}" | python -I -m json.tool {} Isolated mode effectively ignores the environment (variables and directory), so it will only use what's in that Python's site-packages (non-user, but could be a virtualenv) If you want the local path to not be on `sys.path` for a *script-like* call, you could do `python -I myscript.py`, but `-m mypkg` is I think indistinguishable from trying to `import mypkg`, so it needs to be discoverable on `sys.path`...this feels like an A/B problem: what are you trying to do? On Mon, Feb 24, 2020 at 3:35 PM wrote:

Nick Timkovich wrote:

...

...

Are you familiar with the -I option for "isolated mode"? https://docs.python.org/3/using/cmdline.html#id2 -I Run Python in isolated mode. This also implies -E and -s. In isolated mode sys.path contains neither the script’s directory nor the user’s site-packages directory. All PYTHON* environment variables are ignored, too. Further restrictions may be imposed to prevent the user from injecting malicious code. New in version 3.4.

Oooh... Can you provide some examples on the use of -I?

I try to use along with -m (`python -I -m a.b`) and get this error: "python: Error while finding module specification for 'a.b' (ModuleNotFoundError: No module named 'a')".

On the other hand `python -m a.b -I` just passed -I as a script's CLI argument.

Of course, I get the expected results if run `python -I` on terminal. _______________________________________________ Python-ideas mailing list -- python-ideas@python.org To unsubscribe send an email to python-ideas-leave@python.org https://mail.python.org/mailman3/lists/python-ideas.python.org/ Message archived at https://mail.python.org/archives/list/python-ideas@python.org/message/QTZRM5... Code of Conduct: http://python.org/psf/codeofconduct/