Repository: tox-dev/tox

Issue:
PYTHONPATH leaks into "envreport"
Pretty trivial bug.
Even though tox discards PYTHONPATH for `pip install`, it does not discard it for `pip freeze`, causing garbage output if PYTHONPATH has any extra packages (i.e. "pip freeze" will see packages from PYTHONPATH, which it should not do).

https://github.com/tox-dev/tox/blob/3.27.0/src/tox/venv.py#L843

Fix is trivial - fetch env and apply `ensure_pip_os_environ_ok` the same way it is done for `pip install`, pass env to pcall. I will make a PR.


Discussion:
f3flight: @gaborbernat would you be able to have another look?

Patch:
diff --git a/CONTRIBUTORS b/CONTRIBUTORS
index e0259323..09ae1344 100644
--- a/CONTRIBUTORS
+++ b/CONTRIBUTORS
@@ -33,6 +33,7 @@ Cyril Roelandt
 Dane Hillard
 David Staheli
 David Diaz
+Dmitrii Sutiagin a.k.a. f3flight
 Ederag
 Eli Collins
 Eugene Yunak
diff --git a/docs/changelog/2528.bugfix.rst b/docs/changelog/2528.bugfix.rst
new file mode 100644
index 00000000..c5cecd41
--- /dev/null
+++ b/docs/changelog/2528.bugfix.rst
@@ -0,0 +1,1 @@
+Add env cleanup to envreport - fix PYTHONPATH leak into "envreport" -- by :user:`f3flight`.
diff --git a/src/tox/venv.py b/src/tox/venv.py
index 8acb0c77..47f281f6 100644
--- a/src/tox/venv.py
+++ b/src/tox/venv.py
@@ -840,7 +840,11 @@ def tox_runtest_post(venv):
 def tox_runenvreport(venv, action):
     # write out version dependency information
     args = venv.envconfig.list_dependencies_command
-    output = venv._pcall(args, cwd=venv.envconfig.config.toxinidir, action=action, returnout=True)
+    env = venv._get_os_environ()
+    venv.ensure_pip_os_environ_ok(env)
+    output = venv._pcall(
+        args, cwd=venv.envconfig.config.toxinidir, action=action, returnout=True, env=env
+    )
     # the output contains a mime-header, skip it
     output = output.split("\n\n")[-1]
     packages = output.strip().split("\n")


Test patch:
diff --git a/tests/unit/test_venv.py b/tests/unit/test_venv.py
index aa78a48b..3da4e22e 100644
--- a/tests/unit/test_venv.py
+++ b/tests/unit/test_venv.py
@@ -14,6 +14,7 @@ from tox.venv import (
     VirtualEnv,
     getdigest,
     prepend_shebang_interpreter,
+    tox_runenvreport,
     tox_testenv_create,
     tox_testenv_install_deps,
 )
@@ -1233,3 +1234,17 @@ def test_path_change(tmpdir, mocksession, newconfig, monkeypatch):
         path = x.env["PATH"]
         assert os.environ["PATH"] in path
         assert path.endswith(str(venv.envconfig.config.toxinidir) + "/bin")
+
+
+def test_runenvreport_pythonpath_discarded(newmocksession, mocker):
+    mock_os_environ = mocker.patch("tox.venv.VirtualEnv._get_os_environ")
+    mocksession = newmocksession([], "")
+    venv = mocksession.getvenv("python")
+    mock_os_environ.return_value = dict(PYTHONPATH="/some/path/")
+    mock_pcall = mocker.patch.object(venv, "_pcall")
+    tox_runenvreport(venv, None)
+    try:
+        env = mock_pcall.mock_calls[0].kwargs["env"]
+    except TypeError:  # older pytest (python 3.7 and below)
+        env = mock_pcall.mock_calls[0][2]["env"]
+    assert "PYTHONPATH" not in env