Don't import readline in isolated mode

[zooba]

BPO	28192
Nosy	@tiran, @zooba
PRs	[Do Not Merge] Convert Misc/NEWS so that it is managed by towncrier #552

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/zooba'
closed_at = <Date 2016-09-17.21:37:07.001>
created_at = <Date 2016-09-17.18:58:34.517>
labels = ['type-security', 'interpreter-core', '3.7']
title = "Don't import readline in isolated mode"
updated_at = <Date 2017-03-31.16:36:38.319>
user = 'https://github.com/zooba'

bugs.python.org fields:

activity = <Date 2017-03-31.16:36:38.319>
actor = 'dstufft'
assignee = 'steve.dower'
closed = True
closed_date = <Date 2016-09-17.21:37:07.001>
closer = 'steve.dower'
components = ['Interpreter Core']
creation = <Date 2016-09-17.18:58:34.517>
creator = 'steve.dower'
dependencies = []
files = []
hgrepos = []
issue_num = 28192
keywords = []
message_count = 9.0
messages = ['276816', '276820', '276826', '276829', '276831', '276833', '276834', '276851', '276852']
nosy_count = 3.0
nosy_names = ['christian.heimes', 'python-dev', 'steve.dower']
pr_nums = ['552']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue28192'
versions = ['Python 3.6', 'Python 3.7']

[zooba]

When running in isolated mode, readline should not be automatically imported (as it could conceivably be arbitrary code).

[zooba]

Should also allow users to explicitly call site.enablerlcompleter() if they really want it.

[python-dev]

New changeset b0350f351752 by Steve Dower in branch '3.6':
Issue bpo-28192: Don't import readline in isolated mode
https://hg.python.org/cpython/rev/b0350f351752

[tiran]

+1, but your patch is missing Misc/NEWS and a merge to 'default'. The code in Modules/main.c is getting harder to read, too.

[zooba]

The NEWS change slipped into my following commit, and I just did the one merge.

Since you're here, any ideas on how to test this? Adding a readline.py during the test suite will affect any tests running in parallel...

[tiran]

The robot didn't mention your merge because the tracker id was not in the submit messages. I just saw it on python-cvs.

How about a test in subprocess? You could drop a readline.py into Lib/tests/somedirectory and run sys.executable with cwd='Lib/tests/somedirectory').

[zooba]

Also, I think PEP-432 is the way to go about simplifying Py_Main, and I'm keen to see it happen (presumably for 3.7). But the time constraints make it hard, which is why Nick hasn't gotten it done yet either.

[python-dev]

New changeset 5761294bb877 by Steve Dower in branch '3.6':
Issue bpo-28192: Adds tests for hook in isolated mode
https://hg.python.org/cpython/rev/5761294bb877

New changeset 6c7a8a012669 by Steve Dower in branch 'default':
Issue bpo-28192: Adds tests for hook in isolated mode
https://hg.python.org/cpython/rev/6c7a8a012669

[zooba]

Turned out that we really only need to check for sys.__interactivehook__, which made it much easier to write the tests.