[issue15272] pkgutil.find_loader accepts invalid module names

Eric Snow added the comment: pkgutil has since been updated to use importlib, meaning it relies on importlib to sort this out. -- components: +Library (Lib) resolution: -> out of date stage: needs patch -> resolved status: open -> closed versions: +Python 3.6 -Python 3.3 _

[issue15272] pkgutil.find_loader accepts invalid module names

Changes by Eric Snow : -- nosy: +eric.snow ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.o

[issue15272] pkgutil.find_loader accepts invalid module names

Brett Cannon added the comment: PEP 302 just says that find_module "will be called with the fully qualified name of the module." And importation by file name was removed in Python 3 (at some point; don't remember exact feature release). So supporting slashes in a module name is probably not n

[issue15272] pkgutil.find_loader accepts invalid module names

Nick Coghlan added the comment: OK, this one is trickier than I thought - the exact behaviour depends on how you traverse the code, and I believe a PEP 302 importer is technically allowed to accept "/" in module names. (Unless there's a module names "must be valid identifiers" in there somewh

[issue15272] pkgutil.find_loader accepts invalid module names

Changes by Nick Coghlan : -- assignee: -> ncoghlan ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail

[issue15272] pkgutil.find_loader accepts invalid module names

Nick Coghlan added the comment: I'll add a regression test for this as part of my purge of any internal usage of the pkgutil import emulation. -- ___ Python tracker ___ ___

[issue15272] pkgutil.find_loader accepts invalid module names

Changes by Arfrever Frehtes Taifersar Arahesis : -- nosy: +Arfrever ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscri

[issue15272] pkgutil.find_loader accepts invalid module names

Nick Coghlan added the comment: I've taken 3.2 and 2.7 off the list - no doubt someone, somewhere is relying on this particular piece of missing input validation, so it's not worth risking breakage in a point release. I think it's worth fixing for 3.3, though. -- nosy: +georg.brandl

[issue15272] pkgutil.find_loader accepts invalid module names

Changes by Éric Araujo : -- nosy: +eric.araujo versions: +Python 2.7 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscr

[issue15272] pkgutil.find_loader accepts invalid module names

New submission from Nick Coghlan : The pkgutil import emulation is insane and permits modules identifiers to contain paths. Identified in #15230 (reporting some very surprising behaviour from runpy.run_module). -- messages: 164806 nosy: brett.cannon, ncoghlan priority: normal severity