gh-125140: Remove the current directory from sys.path when using pyrepl (GH-125212)

Signed-off-by: Pablo Galindo <pablogsal@gmail.com>
Co-authored-by: Łukasz Langa <lukasz@langa.pl>
Co-authored-by: Peter Bierma <zintensitydev@gmail.com>

diff --git a/Lib/site.py b/Lib/site.py
index b3194d79fb5ab88aaf3200680d9c102a137d0145..07a6361fad44e5450a495140535a01be99b51faf 100644 (file)
--- a/Lib/site.py
+++ b/Lib/site.py
@@ -503,9 +503,14 @@ def register_readline():
         if PYTHON_BASIC_REPL:
             CAN_USE_PYREPL = False
         else:
-            import _pyrepl.readline
-            import _pyrepl.unix_console
-            from _pyrepl.main import CAN_USE_PYREPL
+            original_path = sys.path
+            sys.path = [p for p in original_path if p != '']
+            try:
+                import _pyrepl.readline
+                import _pyrepl.unix_console
+                from _pyrepl.main import CAN_USE_PYREPL
+            finally:
+                sys.path = original_path
     except ImportError:
         return
 

diff --git a/Misc/NEWS.d/next/Security/2024-10-09-20-08-13.gh-issue-125140.YgNWRB.rst b/Misc/NEWS.d/next/Security/2024-10-09-20-08-13.gh-issue-125140.YgNWRB.rst
new file mode 100644 (file)
index 0000000..f4a4930
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2024-10-09-20-08-13.gh-issue-125140.YgNWRB.rst
@@ -0,0 +1 @@
+Remove the current directory from ``sys.path`` when using PyREPL.