You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Parser production rules in PLY table files include path information (the p.file). This could be a security issue, because:
generating and including tables in a distribution archive makes the path public. So one either has to move to a neutral location (like /tmp) in order to produce a distribution, or they must not include the parser table files (requires unnecessary case selection in setup.py), or they disclose their local directory structure.
at installation time, on a multi-user system, if the tables are generated before copying to site-packages, then they will contain path information for the user that performed the installation. Others may have read access to site-packages, but not to the user's directories. (Thanks to @slivingston for describing this use case).
Reading through PLY's source code, it follows that the file path information is used only for error reporting, not for parsing functionality. It would be convenient if an option was made available in yacc.yacc to either:
omit the path from the table file, or
trim the path, keeping only the file name, so that error reporting functionality be affected less.
In any case, the paths reported for an installed package, whose tables were generated before copying to site-packages, will show incorrect path prefixes (preceding the package directory name).
The text was updated successfully, but these errors were encountered:
Parser production rules in PLY table files include path information (the
p.file
). This could be a security issue, because:/tmp
) in order to produce a distribution, or they must not include the parser table files (requires unnecessary case selection insetup.py
), or they disclose their local directory structure.site-packages
, then they will contain path information for the user that performed the installation. Others may have read access tosite-packages
, but not to the user's directories. (Thanks to @slivingston for describing this use case).Reading through PLY's source code, it follows that the file path information is used only for error reporting, not for parsing functionality. It would be convenient if an option was made available in
yacc.yacc
to either:In any case, the paths reported for an installed package, whose tables were generated before copying to
site-packages
, will show incorrect path prefixes (preceding the package directory name).The text was updated successfully, but these errors were encountered: