[issue28896] Embeddable zip allows Windows registry to override module location

[Steve Dower]

Steve Dower added the comment:

It's not intentional, but we clearly haven't done anything to prevent it.

Arguably this finder should be omitted when you run in isolated mode, and I'm on the fence about deprecating it entirely. Adding the importlib experts in case they have opinions (relevant ones, ideally).

A one line workaround that can be added to any code base is:

>>> sys.meta_path[:] = [m for m in sys.meta_path if m.__name__ != 'WindowsRegistryFinder']

But it would also be good to close off this hole. Thoughts on the best option? (-I, move to site.py and -S, something new...)

----------
nosy: +brett.cannon, eric.snow, ncoghlan
versions: +Python 3.6, Python 3.7

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue28896>
_______________________________________