search

microsoft / vscode-python

Python extension for Visual Studio Code
https://aka.ms/pvsc-marketplace
MIT License
4.32k stars 1.18k forks source link

Environment capture is leaking commands into shell history (and is broken) #24349

Open allenap opened 2 days ago

allenap commented 2 days ago

Type: Bug

Behaviour

My shell history (Bash) has the following command periodically added to it:

/usr/bin/python3 /Users/gavin/.vscode/extensions/ms-python.python-2024.16.1-darwin-arm64/python_files/printEnvVariablesToFile.py /Users/gavin/.vscode/extensions/ms-python.python-2024.16.1-darwin-arm64/python_files/deactivate/bash/envVars.txt

I assume this extension is starting a full interactive shell in order to capture environment variables, i.e. such that history is enabled.

Secondly, the printEnvVariablesToFile.py script is broken:

# Copyright (c) Microsoft Corporation. All rights reserved.
# Licensed under the MIT License.

import os
import sys

# Last argument is the target file into which we'll write the env variables line by line.
output_file = sys.argv[-1]

with open(output_file, "w") as outfile:  # noqa: PTH123
    for key, val in os.environ.items():
        outfile.write(f"{key}={val}\n")

This opens the file with a default UTF-8 encoding. However, environment variables can contain any binary content except NUL bytes, so at some point this will crash. They can also contain newline characters, meaning that the envVars.txt file it produces cannot be reliably parsed.

Steps to reproduce:

  1. Open VS Code.
  2. Open new shell.
  3. Run history.

Extension version: 2024.16.1 VS Code version: Code 1.94.2 (Universal) (384ff7382de624fb94dbaf6da11977bba1ecd427, 2024-10-09T16:08:44.566Z) OS version: Darwin arm64 24.1.0 Modes:

User Settings

``` languageServer: "Pylance" ```

Installed Extensions |Extension Name|Extension Id|Version| |---|---|---| |Black Formatter|ms-python.black-formatter|2024.4.0| |Bookmarks|alefragnani.Bookmarks|13.5.0| |undefined|bbenoist.Nix|1.0.1| |C/C++|ms-vscode.cpptools|1.22.10| |CloudFormation Linter|kddejong.vscode-cfn-lint|0.26.0| |Code Spell Checker|streetsidesoftware.code-spell-checker|3.0.1| |CodeLLDB|vadimcn.vscode-lldb|1.11.0| |Dependi|fill-labs.dependi|0.7.10| |Dev Containers|ms-vscode-remote.remote-containers|0.388.0| |direnv|mkhl.direnv|0.17.0| |Docker|ms-azuretools.vscode-docker|1.29.3| |edamagit|kahole.magit|0.6.62| |EditorConfig for VS Code|EditorConfig.EditorConfig|0.16.4| |Elm Land|elm-land.elm-land|0.2.5| |ENV|IronGeek.vscode-env|0.1.0| |Error Lens|usernamehw.errorlens|3.20.0| |ESLint|dbaeumer.vscode-eslint|3.0.10| |Even Better TOML|tamasfe.even-better-toml|0.19.2| |GDB syntax|pierre-payen.gdb-syntax|0.5.7| |GitHub Codespaces|GitHub.codespaces|1.17.3| |GitHub Copilot|GitHub.copilot|1.243.0| |GitHub Copilot Chat|GitHub.copilot-chat|0.21.2| |GitHub Markdown Preview|bierner.github-markdown-preview|0.3.0| |GitHub Pull Requests|GitHub.vscode-pull-request-github|0.98.0| |GitLens — Git supercharged|eamodio.gitlens|15.6.2| |GraphQL: Inline Operation Execution|GraphQL.vscode-graphql-execution|0.3.0| |GraphQL: Language Feature Support|GraphQL.vscode-graphql|0.12.0| |GraphQL: Syntax Highlighting|GraphQL.vscode-graphql-syntax|1.3.6| |HashiCorp Terraform|hashicorp.terraform|2.33.0| |Haskell|haskell.haskell|2.4.4| |Haskell Syntax Highlighting|justusadam.language-haskell|3.6.0| |isort|ms-python.isort|2023.10.1| |JavaScript Debugger|ms-vscode.js-debug|1.94.0| |JavaScript Debugger Companion Extension|ms-vscode.js-debug-companion|1.1.3| |JSON5 syntax|mrmlnc.vscode-json5|1.0.0| |Jupyter|ms-toolsai.jupyter|2024.9.1| |Jupyter Cell Tags|ms-toolsai.vscode-jupyter-cell-tags|0.1.9| |Jupyter Keymap|ms-toolsai.jupyter-keymap|1.1.2| |Jupyter Notebook Renderers|ms-toolsai.jupyter-renderers|1.0.19| |Jupyter Slide Show|ms-toolsai.vscode-jupyter-slideshow|0.1.6| |Language Support for Java(TM) by Red Hat|redhat.java|1.35.1| |LinkerScript|ZixuanWang.linkerscript|1.0.4| |Markdown Checkboxes|bierner.markdown-checkbox|0.4.0| |Markdown Emoji|bierner.markdown-emoji|0.3.0| |Markdown Footnotes|bierner.markdown-footnotes|0.1.1| |Markdown Preview Github Styling|bierner.markdown-preview-github-styles|2.1.0| |Markdown Preview Mermaid Support|bierner.markdown-mermaid|1.26.0| |Markdown yaml Preamble|bierner.markdown-yaml-preamble|0.1.0| |Mypy Type Checker|ms-python.mypy-type-checker|2024.0.0| |ormolu|sjurmillidahl.ormolu-vscode|0.0.10| |PostgreSQL Language Server|uniquevision.vscode-plpgsql-lsp|2.11.3| |Prettier - Code formatter|esbenp.prettier-vscode|11.0.0| |Procfile|benspaulding.procfile|1.1.7| |Pylance|ms-python.vscode-pylance|2024.10.1| |Python|ms-python.python|2024.16.1| |Python Debugger|ms-python.debugpy|2024.12.0| |Quit Control for VSCode|artdiniz.quitcontrol-vscode|4.0.0| |Rails|bung87.rails|0.17.8| |Remote - SSH|ms-vscode-remote.remote-ssh|0.115.0| |Remote - SSH: Editing Configuration Files|ms-vscode-remote.remote-ssh-edit|0.87.0| |Remote Explorer|ms-vscode.remote-explorer|0.4.3| |Rewrap|stkb.rewrap|1.16.3| |Roc (Unofficial)|IvanDemchenko.roc-lang-unofficial|1.2.0| |Ruff|charliermarsh.ruff|2024.52.0| |Run on Save|emeraldwalk.RunOnSave|0.2.7| |rust-analyzer|rust-lang.rust-analyzer|0.3.2162| |ShellCheck|timonwong.shellcheck|0.37.1| |Slim|sianglim.slim|0.1.2| |Sort lines|Tyriar.sort-lines|1.11.0| |Sort selection|jmredfern.sort-selection|2.0.1| |Sparse Crates|citreae535.sparse-crates|0.1.0| |Table Visualizer for JavaScript Profiles|ms-vscode.vscode-js-profile-table|1.0.10| |Test Adapter Converter|ms-vscode.test-adapter-converter|0.2.0| |Test Explorer UI|hbenl.vscode-test-explorer|2.22.1| |Todo Tree|Gruntfuggly.todo-tree|0.0.226| |vscode-gemfile|bung87.vscode-gemfile|0.4.2| |vscode-icons|vscode-icons-team.vscode-icons|12.9.0| |WebAssembly|dtsvet.vscode-wasm|1.4.1| |XML Format|mikeburgh.xml-format|1.1.3| |YAML|redhat.vscode-yaml|1.15.0| |Zig Language|ziglang.vscode-zig|0.5.9|
System Info |Item|Value| |---|---| |CPUs|Apple M3 Pro (11 x 2400)| |GPU Status|2d_canvas: enabled
canvas_oop_rasterization: enabled_on
direct_rendering_display_compositor: disabled_off_ok
gpu_compositing: enabled
multiple_raster_threads: enabled_on
opengl: enabled_on
rasterization: enabled
raw_draw: disabled_off_ok
skia_graphite: disabled_off
video_decode: enabled
video_encode: enabled
webgl: enabled
webgl2: enabled
webgpu: enabled
webnn: disabled_off| |Load (avg)|2, 2, 2| |Memory (System)|36.00GB (0.21GB free)| |Process Argv|. --crash-reporter-id 87e7dabe-f25e-4383-876b-a6bea12e1495| |Screen Reader|no| |VM|0%|
A/B Experiments ``` vsliv368:30146709 vspor879:30202332 vspor708:30202333 vspor363:30204092 vscod805:30301674 binariesv615:30325510 vsaa593:30376534 py29gd2263:31024239 c4g48928:30535728 azure-dev_surveyone:30548225 vscrpc:30673769 962ge761:30959799 pythongtdpath:30769146 pythonnoceb:30805159 asynctok:30898717 pythonmypyd1:30879173 h48ei257:31000450 pythontbext0:30879054 cppperfnew:31000557 dsvsc020:30976470 pythonait:31006305 dsvsc021:30996838 724cj586:31013169 dvdeprecation:31068756 dwnewjupytercf:31046870 impr_priority:31102340 nativerepl2:31139839 refactort:31108082 pythonrstrctxt:31112756 wkspc-onlycs-t:31132770 wkspc-ranged-t:31151552 cf971741:31144450 iacca1:31156133 notype1:31157159 5fd0e150:31155592 dwcopilot:31164048 icondisabled:31158250 ```
karthiknadig commented 2 days ago

@allenap This is going away soon. I agree this is broken in few ways. We are working on alternative approach to activation and environment variables management, with the intent of avoiding running things in this manner.