Repository navigation
Isolated mode doesn't ignore PYTHONHASHSEED #70310
Description
| BPO | 26122 |
|---|---|
| Nosy | @ncoghlan, @vstinner, @tiran |
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = None
closed_at = <Date 2019-05-15.02:23:01.835>
created_at = <Date 2016-01-15.12:48:14.717>
labels = ['interpreter-core', '3.8', 'type-bug', '3.7']
title = "Isolated mode doesn't ignore PYTHONHASHSEED"
updated_at = <Date 2019-05-20.15:32:22.337>
user = 'https://github.com/ncoghlan'bugs.python.org fields:
activity = <Date 2019-05-20.15:32:22.337>
actor = 'vstinner'
assignee = 'none'
closed = True
closed_date = <Date 2019-05-15.02:23:01.835>
closer = 'vstinner'
components = ['Interpreter Core']
creation = <Date 2016-01-15.12:48:14.717>
creator = 'ncoghlan'
dependencies = []
files = []
hgrepos = []
issue_num = 26122
keywords = []
message_count = 4.0
messages = ['258290', '342533', '342553', '342919']
nosy_count = 3.0
nosy_names = ['ncoghlan', 'vstinner', 'christian.heimes']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue26122'
versions = ['Python 3.7', 'Python 3.8']
Activity
ncoghlan commentedon Jan 15, 2016
While working on the draft PEP-432 implementation, I noticed that -I isn't special cased for early processing the same way that -E is: https://hg.python.org/cpython/file/tip/Modules/main.c#l265
This means that when isolated mode is used to turn off environment variable access, PYTHONHASHSEED may still be read while configuring hash randomisation.
vstinner commentedon May 15, 2019
This issue has been fixed in Python 3.8 with my work on refactoring Py_Main(). -E and -I command line options are now parsed, before reading PYTHONHASHSEED, and -I imply -E as expected. Extract of the code:
where config_read_env_vars() indirectly reads PYTHONHASHSEED.
I'm not sure if the issue is fixed in Python 3.7 or not. The code in Python 3.7 was in a bad state. It's getting better with Python 3.8 :-)
Note: the overall refactoring work is related to PEP-432 and PEP-587.
tiran commentedon May 15, 2019
Is there a way to fix the issue in 3.7 and earlier? We might consider it a security issue.
vstinner commentedon May 20, 2019
Hum, Python 3.7 is fixed as well. At least, in the 3.7 dev branch.
Fixed seed:
vstinner@apu$ PYTHONHASHSEED=42 ./python -c 'print(set("abcdefgh"))'
{'g', 'e', 'a', 'b', 'c', 'f', 'h', 'd'}
vstinner@apu$ PYTHONHASHSEED=42 ./python -c 'print(set("abcdefgh"))'
{'g', 'e', 'a', 'b', 'c', 'f', 'h', 'd'}
vstinner@apu$ PYTHONHASHSEED=42 ./python -c 'print(set("abcdefgh"))'
{'g', 'e', 'a', 'b', 'c', 'f', 'h', 'd'}
vstinner@apu$ PYTHONHASHSEED=42 ./python -c 'print(set("abcdefgh"))'
{'g', 'e', 'a', 'b', 'c', 'f', 'h', 'd'}
Random seed:
vstinner@apu$ PYTHONHASHSEED=42 ./python -I -c 'print(set("abcdefgh"))'
{'b', 'e', 'd', 'f', 'g', 'c', 'a', 'h'}
vstinner@apu$ PYTHONHASHSEED=42 ./python -I -c 'print(set("abcdefgh"))'
{'d', 'g', 'e', 'b', 'h', 'f', 'a', 'c'}
vstinner@apu$ PYTHONHASHSEED=42 ./python -I -c 'print(set("abcdefgh"))'
{'e', 'b', 'g', 'c', 'a', 'h', 'f', 'd'}
vstinner@apu$ PYTHONHASHSEED=42 ./python -I -c 'print(set("abcdefgh"))'
{'c', 'd', 'a', 'g', 'f', 'e', 'h', 'b'}
--
Python 3.6 has the bug:
vstinner@apu$ PYTHONHASHSEED=42 python3.6 -c 'print(set("abcdefgh"))'
{'g', 'e', 'a', 'b', 'c', 'f', 'h', 'd'}
vstinner@apu$ PYTHONHASHSEED=42 python3.6 -c 'print(set("abcdefgh"))'
{'g', 'e', 'a', 'b', 'c', 'f', 'h', 'd'}
vstinner@apu$ PYTHONHASHSEED=42 python3.6 -c 'print(set("abcdefgh"))'
{'g', 'e', 'a', 'b', 'c', 'f', 'h', 'd'}
vstinner@apu$ PYTHONHASHSEED=42 python3.6 -c 'print(set("abcdefgh"))'
{'g', 'e', 'a', 'b', 'c', 'f', 'h', 'd'}
vstinner@apu$ PYTHONHASHSEED=42 python3.6 -I -c 'print(set("abcdefgh"))'
{'g', 'e', 'a', 'b', 'c', 'f', 'h', 'd'}
vstinner@apu$ PYTHONHASHSEED=42 python3.6 -I -c 'print(set("abcdefgh"))'
{'g', 'e', 'a', 'b', 'c', 'f', 'h', 'd'}
vstinner@apu$ PYTHONHASHSEED=42 python3.6 -I -c 'print(set("abcdefgh"))'
{'g', 'e', 'a', 'b', 'c', 'f', 'h', 'd'}
vstinner@apu$ PYTHONHASHSEED=42 python3.6 -I -c 'print(set("abcdefgh"))'
{'g', 'e', 'a', 'b', 'c', 'f', 'h', 'd'}