@grahamdumpleton@mastodon.social
2026-03-26 23:38 UTC
There is obviously a lot of discussion about dangers of .pth files in Python recently. FWIW, I have blogged about danger of them over 10 years ago in https://grahamdumpleton.me/posts/2015/04/automatic-patching-of-python/
This wasn't first time though I talked about it as .pth files were a big issue with mod_python, because when it started up it ran as root, thus injected code had full system access. In mod_wsgi I delayed Python initialisation until after the child worker processes forked and ran as non root, sacrificing speed for security.
Replies (1)
-
@grahamdumpleton@mastodon.social 2026-03-26 23:41
Back then I suggested perhaps there should be a white list mechanism for what packages should be allowed to have .pth code executed. These days with much better package installation tools, then maybe a tool like uv could embed an ability to configure it to disallow installation of packages using .pth files with code in them unless white listed, thus blocking them from even being installed in the first place. Just make sure you white list my autowrapt package. 🤣