[New-bugs-announce] [issue36053] pkgutil.walk_packages jumps out from given path if there is package with the same name in sys.pah

Piotr Karkut report at bugs.python.org
Wed Feb 20 11:37:07 EST 2019


New submission from Piotr Karkut <karkucik at gmail.com>:

When walk_packages encounter a package with a name that is available in sys.path, it will abandon the current package, and start walking the package from the sys.path.

Consider this file layout:

```
PYTHONPATH/
├──package1/
|   ├──core   
|   |   ├──some_package/
|   |   |   ├──__init__.py
|   |   |   └──mod.py
|   |   └──__init__.py
|   └──__init__.py
└──some_package/
   |   ├──__init__.py
   |   └──another_mod.py
   └──__init__.py
```

The result of walking package1 will be:

```
>> pkgutil.walk_packages('PYTHONPATH/package1')

ModuleInfo(module_finder=FileFinder('PYTHONPATH/package1/core'), name='some_package', ispkg=True)
ModuleInfo(module_finder=FileFinder('PYTHONPATH/some_package), name='another_mod', ispkg=False)
```

I'm not sure if it is a security issue, but it definitely should not jump off the given path.

----------
components: Library (Lib)
messages: 336111
nosy: karkucik
priority: normal
severity: normal
status: open
title: pkgutil.walk_packages jumps out from given path if there is package with the same name in sys.pah
type: behavior
versions: Python 2.7, Python 3.4, Python 3.5, Python 3.6, Python 3.7, Python 3.8

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue36053>
_______________________________________


More information about the New-bugs-announce mailing list