{az} use runpy instead of os.execl#21261
Conversation
python -m adds the current working directory to the start of sys.path,
which means running from say /tmp with a fake azure.py causes az to load
it and run it:
$ cd /tmp
$ echo 'raise RuntimeError(pwned)' > azure.py
$ az --help
Traceback (most recent call last):
File "/usr/lib/python3.9/runpy.py", line 188, in _run_module_as_main
mod_name, mod_spec, code = _get_module_details(mod_name, _Error)
File "/usr/lib/python3.9/runpy.py", line 111, in _get_module_details
__import__(pkg_name)
File "/tmp/azure.py", line 1, in <module>
raise RuntimeError("pwned")
RuntimeError: pwned
Use runpy instead.
Original report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1005251
Reported-by: Jakub Wilk <jwilk@jwilk.net>
|
Core may cause breaking changes |
|
For what it's worth, we carry this patch in the Fedora project (reported in Fedora 35 at https://bugzilla.redhat.com/show_bug.cgi?id=2053193). It would be great to see this merged since it's a security issue and multiple Linux distributions have had to pick up a patch and carry it for years. |
|
🔔 Routing this PR to @Azure/act-platform-engineering-squad. |
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
There was a problem hiding this comment.
Pull request overview
This PR updates the az launcher script to avoid invoking python -m azure.cli (which prepends the current working directory to sys.path) by switching to runpy, preventing accidental/hostile shadowing such as /tmp/azure.py being imported.
Changes:
- Add
runpyimport to theazshim script. - Replace
os.execl(..., '-m', 'azure.cli', ...)withrunpy.run_module('azure.cli').
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| os.environ['AZ_INSTALLER'] = 'PIP' | ||
|
|
||
| os.execl(sys.executable, sys.executable, '-m', 'azure.cli', *sys.argv[1:]) | ||
| runpy.run_module('azure.cli') |
Description
python -m adds the current working directory to the start of sys.path,
which means running from say /tmp with a fake azure.py causes az to load
it and run it:
$ cd /tmp
$ echo 'raise RuntimeError(pwned)' > azure.py
$ az --help
Traceback (most recent call last):
File "/usr/lib/python3.9/runpy.py", line 188, in _run_module_as_main
mod_name, mod_spec, code = _get_module_details(mod_name, _Error)
File "/usr/lib/python3.9/runpy.py", line 111, in _get_module_details
import(pkg_name)
File "/tmp/azure.py", line 1, in
raise RuntimeError("pwned")
RuntimeError: pwned
Use runpy instead.
Original report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1005251
Reported-by: Jakub Wilk jwilk@jwilk.net
🤖 PR Validation — ️✔️ All clear