[issue33944] Deprecate and remove pth files
Ethan Smith
report at bugs.python.org
Fri Jun 22 18:19:24 EDT 2018
Ethan Smith <ethan at ethanhs.me> added the comment:
I am in favor of symlinks no longer being able to execute arbitrary code, however, I do think having them add to the path cannot be killed in two releases. Here is why:
1. Windows support for symlinks is still not automatic. In the creators update of Windows 10 (released March 2017), CreateSymbolicLink added a dwflag SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE. This requires the user to be in developer mode to work. CPython currently doesn't use this flag. (I will open an issue to add that in a moment). I worry that giving people little time to update will be troublesome.
2. All editable installs everywhere (AFAIK) and setuptools eggs (still somewhat common) use easy-install.pth to list where they are. I think breaking editable installs is a bad idea, as there is no clear solution for this. Also setuptools has a fair amount of work to do before it can replace egg installs.
So I think removing adding to the path will require much more thought and break a lot more code than removing arbitrary code execution.
----------
nosy: +Ethan Smith
_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue33944>
_______________________________________
More information about the Python-bugs-list
mailing list