saschpe/py2pack — pull request #9 by blumentopf (2013-10-02 19:07:43+00:00)
Title: Run setup.py (instead of just parsing it) to gather more data

Hi Sascha,

I'd be interested to get feedback from you on this experimental feature and specifically on the following issues:

* tarfile.extractall() does not protect against overwriting files outside of tempdir (pathnames which are absolute or with "../" at the beginning; zipfile.extractall() attempts to prevent that). One solution would be to use setuptools.sandbox.DirectorySandbox. That's what setuptools.sandbox.run_setup() does. The downside is that obviously setuptools needs to be installed, so it adds another prerequisite to py2pack.

* setuptools.sandbox.run_setup() saves (and later restores) more state than I do, e.g. sys.modules and sys.argv. Not sure if that is actually necessary.

* Running setup.py is risky (execution of foreign/untrusted code). That is one of the reasons I've made this feature optional. However, _parse_setup_py() calls eval() on portions of setup.py so it can be argued that execution of foreign code already happens anyway.

* Execution of setup.py might fail. We could catch any exceptions and fall back to regular "parse" mode in that case.

Let me know what you think. Thanks.