From: Victor Stinner Date: Fri, 6 May 2022 02:53:00 +0000 (+0200) Subject: gh-57684: Document safe path in What's New in Python 3.11 (#92362) X-Git-Tag: v3.11.0b1~27 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5f29268283aba12d4f2c83cab4966286e0ac5128;p=thirdparty%2FPython%2Fcpython.git gh-57684: Document safe path in What's New in Python 3.11 (#92362) Mention also -P and PYTHONSAFEPATH in the Security Considerations page. --- diff --git a/Doc/library/security_warnings.rst b/Doc/library/security_warnings.rst index 26b015c0f8fc..f985dc4acd11 100644 --- a/Doc/library/security_warnings.rst +++ b/Doc/library/security_warnings.rst @@ -32,3 +32,9 @@ The following modules have specific security considerations: * :mod:`xml`: :ref:`XML vulnerabilities ` * :mod:`zipfile`: :ref:`maliciously prepared .zip files can cause disk volume exhaustion ` + +The :option:`-I` command line option can be used to run Python in isolated +mode. When it cannot be used, the :option:`-P` option or the +:envvar:`PYTHONSAFEPATH` environment variable can be used to not prepend a +potentially unsafe path to :data:`sys.path` such as the current directory, the +script's directory or an empty string. diff --git a/Doc/whatsnew/3.11.rst b/Doc/whatsnew/3.11.rst index efcfa1760087..c84b36f8d6c4 100644 --- a/Doc/whatsnew/3.11.rst +++ b/Doc/whatsnew/3.11.rst @@ -79,6 +79,12 @@ New typing features: * :pep:`673`: ``Self`` type. * :pep:`675`: Arbitrary literal string type. +Security improvements: + +* New :option:`-P` command line option and :envvar:`PYTHONSAFEPATH` environment + variable to not prepend a potentially unsafe path to :data:`sys.path` such as + the current directory, the script's directory or an empty string. + New Features ============