VimPlug/jedi

0 Fork 1

mirror of https://github.com/davidhalter/jedi.git synced 2026-10-20 21:57:05 +08:00

Commit Graph

Author	SHA1	Message	Date
Dhanu-dynamic	f37a9f9feb	Ignore environment_path in loaded project files (#2110 ) A .jedi/project.json can be part of a checked out repository, so honouring its environment_path let an untrusted file point Jedi at a binary to execute. Rather than trying to gate that binary (the ownership heuristic in _is_unix_safe_simple is meaningless on Windows, where st_uid is always 0), drop environment_path from loaded project files entirely, the same way load_unsafe_extensions is already ignored. It stays available when a Project is constructed directly by the user.	2026-09-29 13:58:51 +00:00
Dhanu-dynamic	112d255414	Do not trust code execution settings from .jedi/project.json (#2108 ) get_default_project() loads the first .jedi/project.json above the analysed file, which can be part of a checked out repository. Its environment_path was executed with safe=False and its load_unsafe_extensions was honoured. Loaded projects now check the binary like find_virtualenvs and ignore load_unsafe_extensions.	2026-09-26 12:52:55 +00:00

Author

SHA1

Message

Date

Dhanu-dynamic

f37a9f9feb

Ignore environment_path in loaded project files (#2110 )

A .jedi/project.json can be part of a checked out repository, so honouring its environment_path let an untrusted file point Jedi at a binary to execute. Rather than trying to gate that binary (the ownership heuristic in _is_unix_safe_simple is meaningless on Windows, where st_uid is always 0), drop environment_path from loaded project files entirely, the same way load_unsafe_extensions is already ignored. It stays available when a Project is constructed directly by the user.

2026-09-29 13:58:51 +00:00

Dhanu-dynamic

112d255414

Do not trust code execution settings from .jedi/project.json (#2108 )

get_default_project() loads the first .jedi/project.json above the analysed file, which can be part of a checked out repository. Its environment_path was executed with safe=False and its load_unsafe_extensions was honoured. Loaded projects now check the binary like find_virtualenvs and ignore load_unsafe_extensions.

2026-09-26 12:52:55 +00:00