[New-bugs-announce] [issue36053] pkgutil.walk_packages jumps out from given path if there is package with the same name in sys.pah
Piotr Karkut
report at bugs.python.org
Wed Feb 20 11:37:07 EST 2019
New submission from Piotr Karkut <karkucik at gmail.com>:
When walk_packages encounter a package with a name that is available in sys.path, it will abandon the current package, and start walking the package from the sys.path.
Consider this file layout:
```
PYTHONPATH/
├──package1/
| ├──core
| | ├──some_package/
| | | ├──__init__.py
| | | └──mod.py
| | └──__init__.py
| └──__init__.py
└──some_package/
| ├──__init__.py
| └──another_mod.py
└──__init__.py
```
The result of walking package1 will be:
```
>> pkgutil.walk_packages('PYTHONPATH/package1')
ModuleInfo(module_finder=FileFinder('PYTHONPATH/package1/core'), name='some_package', ispkg=True)
ModuleInfo(module_finder=FileFinder('PYTHONPATH/some_package), name='another_mod', ispkg=False)
```
I'm not sure if it is a security issue, but it definitely should not jump off the given path.
----------
components: Library (Lib)
messages: 336111
nosy: karkucik
priority: normal
severity: normal
status: open
title: pkgutil.walk_packages jumps out from given path if there is package with the same name in sys.pah
type: behavior
versions: Python 2.7, Python 3.4, Python 3.5, Python 3.6, Python 3.7, Python 3.8
_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue36053>
_______________________________________
More information about the New-bugs-announce
mailing list