Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

optionally omit or trim path info stored in table files #58

Closed
johnyf opened this issue Apr 17, 2015 · 1 comment
Closed

optionally omit or trim path info stored in table files #58

johnyf opened this issue Apr 17, 2015 · 1 comment

Comments

@johnyf
Copy link

johnyf commented Apr 17, 2015

Parser production rules in PLY table files include path information (the p.file). This could be a security issue, because:

  1. generating and including tables in a distribution archive makes the path public. So one either has to move to a neutral location (like /tmp) in order to produce a distribution, or they must not include the parser table files (requires unnecessary case selection in setup.py), or they disclose their local directory structure.
  2. at installation time, on a multi-user system, if the tables are generated before copying to site-packages, then they will contain path information for the user that performed the installation. Others may have read access to site-packages, but not to the user's directories. (Thanks to @slivingston for describing this use case).

Reading through PLY's source code, it follows that the file path information is used only for error reporting, not for parsing functionality. It would be convenient if an option was made available in yacc.yacc to either:

  • omit the path from the table file, or
  • trim the path, keeping only the file name, so that error reporting functionality be affected less.

In any case, the paths reported for an installed package, whose tables were generated before copying to site-packages, will show incorrect path prefixes (preceding the package directory name).

@dabeaz
Copy link
Owner

dabeaz commented Apr 19, 2015

Modified to only record the base filename in the parsetab.py file.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants