search

microsoft / pyright

Static Type Checker for Python
Other
13.04k stars 1.39k forks source link

Make python interpreter execution more secure #8341

Closed rchiodo closed 1 month ago

rchiodo commented 1 month ago

Pyrx internal issue: https://github.com/microsoft/pyrx/issues/5287

The FullAccessHost currently runs the python interpreter from whatever directory Pylance was started from. This could potentially cause issues if that directory happens have overridden some of the stdlib modules.

This change makes the FullAccessHost run python with either the '-I' flag or forces it to run in a temp folder.

rchiodo commented 1 month ago

Note, I ran this code with Pylance too to verify the '-I' doesn't mess up pytest config usage (it's the only thing that calls 'runScript') and it seems to work fine.

github-actions[bot] commented 1 month ago

According to mypy_primer, this change doesn't affect type check results on a corpus of open source code. ✅

github-actions[bot] commented 1 month ago

According to mypy_primer, this change doesn't affect type check results on a corpus of open source code. ✅