summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorVictor Stinner <vstinner@redhat.com>2019-04-17 15:05:30 (GMT)
committerGitHub <noreply@github.com>2019-04-17 15:05:30 (GMT)
commit2c4c02f8a876fcf084575dcaf857a0236c81261a (patch)
tree6ef38d2e332c55e6b528b0f30e14828c8d73d8c2
parent228a3c99bdb2d02771bead66a0beabafad3a90d3 (diff)
downloadcpython-2c4c02f8a876fcf084575dcaf857a0236c81261a.zip
cpython-2c4c02f8a876fcf084575dcaf857a0236c81261a.tar.gz
cpython-2c4c02f8a876fcf084575dcaf857a0236c81261a.tar.bz2
bpo-35755: Remove current directory from posixpath.defpath (GH-11586)
Document the change in a NEWS entry of the Security category.
-rw-r--r--Lib/posixpath.py2
-rw-r--r--Misc/NEWS.d/next/Security/2019-01-17-10-03-48.bpo-35755.GmllIs.rst5
2 files changed, 6 insertions, 1 deletions
diff --git a/Lib/posixpath.py b/Lib/posixpath.py
index 21ce72f..ecb4e5a 100644
--- a/Lib/posixpath.py
+++ b/Lib/posixpath.py
@@ -18,7 +18,7 @@ pardir = '..'
extsep = '.'
sep = '/'
pathsep = ':'
-defpath = ':/bin:/usr/bin'
+defpath = '/bin:/usr/bin'
altsep = None
devnull = '/dev/null'
diff --git a/Misc/NEWS.d/next/Security/2019-01-17-10-03-48.bpo-35755.GmllIs.rst b/Misc/NEWS.d/next/Security/2019-01-17-10-03-48.bpo-35755.GmllIs.rst
new file mode 100644
index 0000000..959aafd
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2019-01-17-10-03-48.bpo-35755.GmllIs.rst
@@ -0,0 +1,5 @@
+:func:`shutil.which` now uses ``os.confstr("CS_PATH")`` if available and if the
+:envvar:`PATH` environment variable is not set. Remove also the current
+directory from :data:`posixpath.defpath`. On Unix, :func:`shutil.which` and the
+:mod:`subprocess` module no longer search the executable in the current
+directory if the :envvar:`PATH` environment variable is not set.