gh-57684: Document safe path in What's New in Python 3.11 (#92362)

Mention also -P and PYTHONSAFEPATH in the Security Considerations
page.

diff --git a/Doc/library/security_warnings.rst b/Doc/library/security_warnings.rst
index 26b015c0f8fc7a193b34c3439c0da0c71f6e5008..f985dc4acd11c18f3da9af8391b671cf2762d767 100644 (file)
--- a/Doc/library/security_warnings.rst
+++ b/Doc/library/security_warnings.rst
@@ -32,3 +32,9 @@ The following modules have specific security considerations:
 * :mod:`xml`: :ref:`XML vulnerabilities <xml-vulnerabilities>`
 * :mod:`zipfile`: :ref:`maliciously prepared .zip files can cause disk volume
   exhaustion <zipfile-resources-limitations>`
+
+The :option:`-I` command line option can be used to run Python in isolated
+mode. When it cannot be used, the :option:`-P` option or the
+:envvar:`PYTHONSAFEPATH` environment variable can be used to not prepend a
+potentially unsafe path to :data:`sys.path` such as the current directory, the
+script's directory or an empty string.

diff --git a/Doc/whatsnew/3.11.rst b/Doc/whatsnew/3.11.rst
index efcfa176008793bc2909cd0a7569d71503adef4a..c84b36f8d6c403373dee0683dbcafeadb1efa880 100644 (file)
--- a/Doc/whatsnew/3.11.rst
+++ b/Doc/whatsnew/3.11.rst
@@ -79,6 +79,12 @@ New typing features:
 * :pep:`673`: ``Self`` type.
 * :pep:`675`: Arbitrary literal string type.
 
+Security improvements:
+
+* New :option:`-P` command line option and :envvar:`PYTHONSAFEPATH` environment
+  variable to not prepend a potentially unsafe path to :data:`sys.path` such as
+  the current directory, the script's directory or an empty string.
+
 
 New Features
 ============