Skip to content

🐛 fix(discovery): search bare specs on PATH - #207

Merged
gaborbernat merged 3 commits into
tox-dev:mainfrom
gaborbernat:security/24eepsbf-explicit-spec
Nov 3, 2026
Merged

gaborbernat merged 3 commits into
tox-dev:mainfrom
gaborbernat:security/24eepsbf-explicit-spec

Conversation

@gaborbernat

@gaborbernat gaborbernat commented Nov 2, 2026 •

Copy link
Copy Markdown
Member

get_interpreter() probed an unrecognized bare spec against the caller's working directory before searching PATH. A file in a shared working directory could replace the requested interpreter. Bare specs now use the executable-name search on PATH; explicit paths still resolve from their named directory. This addresses draft advisory ANT-2026-24EEPSBF.

Bare spec resolution

PythonSpec.from_string_spec() stores an unrecognized string in spec.path. The old explicit branch then probed that value as a path. The branch now requires a directory component, leaving bare words for the existing PATH search.

Behavior changes

A caller that intends a file in the working directory must write ./name or another explicit relative path. A bare name can still match an executable on PATH. Absolute paths and try_first_with retain their existing handling.

Reported by Antigravity: ANT-2026-24EEPSBF.

Discovery probed an unparsed spec against the caller's working directory
before PATH. A shared directory could supply the executable. Specs with a
directory still take the explicit path branch.
@gaborbernat gaborbernat added the bug Something isn't working label Nov 2, 2026
@gaborbernat gaborbernat added the security Security fixes and advisories label Nov 3, 2026
@gaborbernat
gaborbernat merged commit 750e103 into tox-dev:main Nov 3, 2026
21 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working security Security fixes and advisories

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant