Bug#493937: [Patch] Prevent loading of Python modules in working directory

2008-11-17 Thread Bram Moolenaar
James - > >> Then this appears to be a difference (bug?) in your libc. This is not > >> the case with glibc 2.7 or 2.8 (the two systems I can currently test > >> on). Those error with ENOENT (as specified by SUS[0]). > > > > I'm on FreeBSD. I used this test program: > > > > #include > > #incl

Bug#493937: [Patch] Prevent loading of Python modules in working directory

2008-11-17 Thread James Vega
On Sat, Nov 15, 2008 at 6:52 AM, Bram Moolenaar <[EMAIL PROTECTED]> wrote: > > James - > >> Then this appears to be a difference (bug?) in your libc. This is not >> the case with glibc 2.7 or 2.8 (the two systems I can currently test >> on). Those error with ENOENT (as specified by SUS[0]). > > I

Bug#493937: [Patch] Prevent loading of Python modules in working directory

2008-11-15 Thread Bram Moolenaar
James - > >> Either way, I see two options: > >> > >> 1) Save sys.path before calling PySys_SetArgv and restore it afterward. > >> 2) Prune the first element of sys.path after calling PySys_SetArgv. > >> > >> We know that PySys_SetArgv always adds an element to the front of > >> sys.path and we k

Bug#493937: [Patch] Prevent loading of Python modules in working directory

2008-11-14 Thread James Vega
On Fri, Nov 14, 2008 at 3:42 PM, Bram Moolenaar <[EMAIL PROTECTED]> wrote: > > James - > >> Either way, I see two options: >> >> 1) Save sys.path before calling PySys_SetArgv and restore it afterward. >> 2) Prune the first element of sys.path after calling PySys_SetArgv. >> >> We know that PySys_Se

Bug#493937: [Patch] Prevent loading of Python modules in working directory

2008-11-14 Thread Bram Moolenaar
James - > > > This is incorrect. In Vim's current code, PySys_SetArgv is called with > > > an argv that is simply an empty string (and a terminating NULL > > > sentinel). This causes sys.path's first element to be the empty string, > > > thus causing any Python import statements to use Vim's cu

Bug#493937: [Patch] Prevent loading of Python modules in working directory

2008-11-13 Thread James Vega
On Thu, Nov 13, 2008 at 11:23:07AM +0100, Bram Moolenaar wrote: > > James - > > > This is incorrect. In Vim's current code, PySys_SetArgv is called with > > an argv that is simply an empty string (and a terminating NULL > > sentinel). This causes sys.path's first element to be the empty string,

Bug#493937: [Patch] Prevent loading of Python modules in working directory

2008-11-13 Thread Bram Moolenaar
James - > > > Vim's python interface calls PySys_SetArgv with an argv[0] that doesn't > > > resolve to a filename. This causes Python to prepend sys.path with an > > > empty string which, due to Python's use of relative imports, allows the > > > possibility to run arbitrary code on the user's sy

Bug#493937: [Patch] Prevent loading of Python modules in working directory

2008-11-12 Thread James Vega
On Wed, Nov 12, 2008 at 12:34:16PM +0100, Bram Moolenaar wrote: > > James - > > > Vim's python interface calls PySys_SetArgv with an argv[0] that doesn't > > resolve to a filename. This causes Python to prepend sys.path with an > > empty string which, due to Python's use of relative imports, all

Bug#493937: [Patch] Prevent loading of Python modules in working directory

2008-11-04 Thread Bram Moolenaar
James - > > > Vim's python interface calls PySys_SetArgv with an argv[0] that doesn't > > > resolve to a filename. This causes Python to prepend sys.path with an > > > empty string which, due to Python's use of relative imports, allows the > > > possibility to run arbitrary code on the user's sy

Bug#493937: [Patch] Prevent loading of Python modules in working directory

2008-11-03 Thread James Vega
On Mon, Nov 03, 2008 at 10:23:27PM +0100, Bram Moolenaar wrote: > > James - > > > Bram, > > > > Vim's python interface calls PySys_SetArgv with an argv[0] that doesn't > > resolve to a filename. This causes Python to prepend sys.path with an > > empty string which, due to Python's use of relati