From e4cf9293c2bb248bc1b8463ada51793767f9f5dd Mon Sep 17 00:00:00 2001 From: Dave Halter Date: Tue, 31 Dec 2019 19:20:59 +0100 Subject: [PATCH] Clarify a sentence around virtualenv security, see #1250 --- jedi/api/environment.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/jedi/api/environment.py b/jedi/api/environment.py index 8f850e45..99643418 100644 --- a/jedi/api/environment.py +++ b/jedi/api/environment.py @@ -461,8 +461,8 @@ def _is_unix_safe_simple(real_path): # 2. The repository has an innocent looking folder called foobar. jedi # searches for the folder and executes foobar/bin/python --version if # there's also a foobar/bin/activate. - # 3. The bin/python is obviously not a python script but a bash script or - # whatever the attacker wants. + # 3. The attacker has gained code execution, since he controls + # foobar/bin/python. return uid == 0