Skip to content

Docs: Clarify that -I is not a security boundary #150790

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
StanFromIreland wants to merge 3 commits into
base: main
Choose a base branch
from
+9 −8
Open

Docs: Clarify that -I is not a security boundary #150790

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b091c32
Docs: Clarify that `-I` is not a security boundary
StanFromIreland Jun 2, 2026
fc4d7d7
Double word typo
StanFromIreland Jun 2, 2026
d10a497
Don't mention it as a security consideration, and more scary warnings
StanFromIreland Jun 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 0 additions & 5 deletions Doc/library/security_warnings.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,8 +32,3 @@ The following modules have specific security considerations:
* :mod:`zipfile`: :ref:`maliciously prepared .zip files can cause disk volume
exhaustion <zipfile-resources-limitations>`

The :option:`-I` command line option can be used to run Python in isolated
mode. When it cannot be used, the :option:`-P` option or the
:envvar:`PYTHONSAFEPATH` environment variable can be used to not prepend a
potentially unsafe path to :data:`sys.path` such as the current directory, the
script's directory or an empty string.
Copy link
Copy Markdown
Member

@vstinner vstinner Jun 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I removed the note you added to 'Security Considerations,' since these flags aren't guaranteed to be security boundaries, I don't think we should imply that by putting them there.

This paragraph explains how to harden Python command line interface, to protect against some issues. It doesn't imply that it protects from all possible attacks.

I would prefer to keep the paragraph here. If you consider that the intent of this paragraph is unclear, I suggest rephrasing it, and maybe explain somehow what are all ways to inject code, and what are means to harden Python.

12 changes: 9 additions & 3 deletions Doc/using/cmdline.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -294,8 +294,11 @@ Miscellaneous options

.. option:: -E

Ignore all ``PYTHON*`` environment variables, e.g.
Ignore all ``PYTHON*`` environment variables, for example,
:envvar:`PYTHONPATH` and :envvar:`PYTHONHOME`, that might be set.
This is useful for running commands that should not take into account the
user's current environment settings, but does not necessarily mean that the
current environment will have no effect.
Copy link
Copy Markdown
Member

@vstinner vstinner Jun 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure that this sentence is useful. In the first sentence, the effect of the option is well defined: "Ignore all PYTHON* environment variables" (nothing more, nothing less). In the second sentence, "User's current environment" is a little bit vague to me. Does it mean that variables which don't start with PYTHON are also ignored? No, they are not ignored.

Copy link
Copy Markdown
Member

@zooba zooba Jun 4, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's exactly what the rest of the sentence says, so maybe if we rephrase to put "other environment variables may still be used, such as for locale or terminal options, but those that are used by Python to initialise runtime settings will be ignored and default values used instead."

The point of this line is to not just say "this is not a security boundary" without also actually saying what it is. We're better off implying the security aspects and being explicit about the intent, since that's more helpful for everyone.


See also the :option:`-P` and :option:`-I` (isolated) options.

Expand Down Expand Up @@ -324,8 +327,9 @@ Miscellaneous options

In isolated mode :data:`sys.path` contains neither the script's directory nor
the user's site-packages directory. All ``PYTHON*`` environment
variables are ignored, too. Further restrictions may be imposed to prevent
the user from injecting malicious code.
Copy link
Copy Markdown
Member

@vstinner vstinner Jun 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the REPL, import readline is omitted in isolated mode. That's what the last sentence implies indirectly.

variables are ignored, too. This feature is not a security boundary.
Further restrictions need to be imposed to prevent the user from injecting
Copy link
Copy Markdown
Member

@vstinner vstinner Jun 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I didn't know the "security boundary" expression. What does it mean? I don't think that security is a all-or-nothing thing, it's more complicated.

Copy link
Copy Markdown
Member

@zooba zooba Jun 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security boundary means that if you can bypass it, you've found a vulnerability. If something is not a security boundary, then bypassing it is just a normal bug (or feature).

malicious code.

.. versionadded:: 3.4

Expand Down Expand Up @@ -362,6 +366,8 @@ Miscellaneous options
* ``python -c code`` and ``python`` (REPL) command lines: Don't prepend an
empty string, which means the current working directory.

This feature is not a security boundary. Further restrictions need to be
imposed to prevent the user from injecting malicious code.
Copy link
Copy Markdown
Member

@vstinner vstinner Jun 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think that the current -P option documentation implies that it protects you from any malicious code injection. I don't see the value of adding this paragraph. It doesn't explain how to block all entry points for malicious code.

See also the :envvar:`PYTHONSAFEPATH` environment variable, and :option:`-E`
and :option:`-I` (isolated) options.

Expand Down
Loading