Description

assignee = None
closed_at = <Date 2014-08-08.11:48:58.187>
created_at = <Date 2014-08-08.09:32:09.977>
labels = ['type-security', 'interpreter-core', 'invalid']
title = 'Local files shadow system modules, even from system modules'
updated_at = <Date 2014-08-08.11:48:58.181>
user = 'https://bugs.python.org/drt24'

activity = <Date 2014-08-08.11:48:58.181>
actor = 'ncoghlan'
assignee = 'none'
closed = True
closed_date = <Date 2014-08-08.11:48:58.187>
closer = 'ncoghlan'
components = ['Interpreter Core']
creation = <Date 2014-08-08.09:32:09.977>
creator = 'drt24'
dependencies = []
files = []
hgrepos = []
issue_num = 22172
keywords = []
message_count = 2.0
messages = ['225065', '225066']
nosy_count = 2.0
nosy_names = ['ncoghlan', 'drt24']
pr_nums = []
priority = 'normal'
resolution = 'not a bug'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue22172'
versions = ['Python 3.4']

Activity

1. drt24 commented on Aug 8, 2014

   

   drt24mannequin

   on Aug 8, 2014

   MannequinAuthor

   More actions

   In Python 3.4 (but not 3.2 or 2.7) when a system module does an import then files with the same name in the directory of the original python script which match that name are used.

   E.g.
   With a directory containing:
   test.py:
   #!/usr/bin/env python3
   from collections import OrderedDict
   print('do stuff')

   operator.py:
   #!/usr/bin/env python3
   print('EXPLOIT!')

   Running test.py will cause:
   EXPLOIT!
   Traceback (most recent call last):
     File "./test.py", line 4, in <module>
       from collections import OrderedDict
     File "/usr/lib/python3.4/collections/__init__.py", line 11, in <module>
       from operator import itemgetter as _itemgetter, eq as _eq
   ImportError: cannot import name 'itemgetter'

   While test.py is perfectly innocent it is in the same directory as the nasty operator.py and test.py makes no reference at all to operator.py but when 'collections' is imported it imports from operator which is resolved to operator.py in the local directory

   This is a security vulnerability because it is possible to verify that a python script is safe to run by reading its code and then on running it find that other code is implicitly loaded by the system libraries which is never referenced in the original file or part of any of the standard libraries.

   It is also rather confusing but a related issue is already filed for that in bpo-21202.
   This is similar to the standard name shadowing trap http://python-notes.curiousefficiency.org/en/latest/python_concepts/import_traps.html#the-name-shadowing-trap but now applies to other files in the source directory in a way which it didn't in previous versions of python. I suspect this was introduced in python 3.3 through changes to the import system and __init__.py becoming optional but I don't have a 3.3 install to check that with.

   sys.path here is: ['/auto/homes/drt24/pythontest', '/usr/lib/python3.4', '/usr/lib/python3.4/plat-x86_64-linux-gnu', '/usr/lib/python3.4/lib-dynload', '/usr/local/lib/python3.4/dist-packages', '/usr/lib/python3/dist-packages']
   Running Python 3.4.0-0ubuntu2 on Ubuntu 14.04.1 LTS with Linux 3.13.0-32-generic
2. drt24

   added

   interpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)

   type-securityA security issueA security issue

   on Aug 8, 2014
3. ncoghlan commented on Aug 8, 2014

   

   ncoghlan

   on Aug 8, 2014

   Contributor

   More actions

   This is not new behaviour. It's just normal system shadowing:

   $ python test.py 
   Traceback (most recent call last):
     File "test.py", line 1, in <module>
       import collections
     File "/usr/lib64/python2.7/collections.py", line 9, in <module>
       from operator import itemgetter as _itemgetter, eq as _eq
   ImportError: cannot import name itemgetter

   Avoiding that behaviour is what the new isolated mode is for:

   $ ~/devel/py34/python -I test.py 
   $
4. ncoghlan

   closed this as completedon Aug 8, 2014
5. ncoghlan

   added

   invalid

   on Aug 8, 2014
6. ezio-melotti

   transferred this issue fromon Apr 10, 2022

Issue actions