[New-bugs-announce] [issue33059] netrc module validates file mode only for /home/user/.netrc
Andreas Költringer
report at bugs.python.org
Mon Mar 12 17:05:31 EDT 2018
New submission from Andreas Költringer <andreas.koeltringer at n-fuse.co>:
On my first try to use the netrc module I got back the error:
"~/.netrc access too permissive: access permissions must restrict access to only the owner"
I changed the file permissions and wrapped this up in try-except and went on to write some unit tests (using tempfile), assuming that the file mode checks would be performed on any netrc file I passed into the constructor (yes, I did not read the documentation sufficiently well).
Anyway, I believe that these security checks should be done for any netrc file (they contain sensitive information no matter where they are located on the file system). There was already a discussion on the topic
https://bugs.python.org/issue14984
where there was concern regarding backwards-compatibility and the idea to re-visit this issue "in the future". That was in 2013, so maybe this "future" is now?
----------
components: Library (Lib)
messages: 313701
nosy: akoeltringer
priority: normal
severity: normal
status: open
title: netrc module validates file mode only for /home/user/.netrc
type: security
versions: Python 3.4, Python 3.5, Python 3.6, Python 3.7, Python 3.8
_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue33059>
_______________________________________
More information about the New-bugs-announce
mailing list