New submission from Piotr Karkut <karku...@gmail.com>:
When walk_packages encounter a package with a name that is available in
sys.path, it will abandon the current package, and start walking the package
from the sys.path.
Consider this file layout:
```
PYTHONPATH/
├──package1/
| ├──core
| | ├──some_package/
| | | ├──__init__.py
| | | └──mod.py
| | └──__init__.py
| └──__init__.py
└──some_package/
| ├──__init__.py
| └──another_mod.py
└──__init__.py
```
The result of walking package1 will be:
```
>> pkgutil.walk_packages('PYTHONPATH/package1')
ModuleInfo(module_finder=FileFinder('PYTHONPATH/package1/core'),
name='some_package', ispkg=True)
ModuleInfo(module_finder=FileFinder('PYTHONPATH/some_package),
name='another_mod', ispkg=False)
```
I'm not sure if it is a security issue, but it definitely should not jump off
the given path.
----------
components: Library (Lib)
messages: 336111
nosy: karkucik
priority: normal
severity: normal
status: open
title: pkgutil.walk_packages jumps out from given path if there is package with
the same name in sys.pah
type: behavior
versions: Python 2.7, Python 3.4, Python 3.5, Python 3.6, Python 3.7, Python 3.8
_______________________________________
Python tracker <rep...@bugs.python.org>
<https://bugs.python.org/issue36053>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe:
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
