From 7ec3a3236080dd65a6d949427d206c7cab72d47f Mon Sep 17 00:00:00 2001 From: Antoine Pitrou Date: Sun, 9 Dec 2012 14:46:18 +0100 Subject: Issue #16248: Disable code execution from the user's home directory by tkinter when the -E flag is passed to Python. Patch by Zachary Ware. --- Lib/tkinter/__init__.py | 4 +++- Misc/NEWS | 3 +++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/Lib/tkinter/__init__.py b/Lib/tkinter/__init__.py index 643026e..67a2f9a 100644 --- a/Lib/tkinter/__init__.py +++ b/Lib/tkinter/__init__.py @@ -1698,7 +1698,9 @@ class Tk(Misc, Wm): self.tk = _tkinter.create(screenName, baseName, className, interactive, wantobjects, useTk, sync, use) if useTk: self._loadtk() - self.readprofile(baseName, className) + if not sys.flags.ignore_environment: + # Issue #16248: Honor the -E flag to avoid code injection. + self.readprofile(baseName, className) def loadtk(self): if not self._tkloaded: self.tk.loadtk() diff --git a/Misc/NEWS b/Misc/NEWS index d90b40d..b43799f 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -179,6 +179,9 @@ Core and Builtins Library ------- +- Issue #16248: Disable code execution from the user's home directory by + tkinter when the -E flag is passed to Python. Patch by Zachary Ware. + - Issue #16628: Fix a memory leak in ctypes.resize(). - Issue #13614: Fix setup.py register failure with invalid rst in description. -- cgit v0.12