Skip to content

🐛 fix(tk): avoid display access during probing - #211

Merged
gaborbernat merged 2 commits into
tox-dev:mainfrom
gaborbernat:security/0jri1j0p-tk-version
Nov 3, 2026
Merged

gaborbernat merged 2 commits into
tox-dev:mainfrom
gaborbernat:security/0jri1j0p-tk-version

Conversation

@gaborbernat

@gaborbernat gaborbernat commented Nov 2, 2026 •

Copy link
Copy Markdown
Member

_resolve_tk_lib() loaded Tk to obtain its version during interpreter discovery. With TCL_LIBRARY set, an unresponsive X display could block the caller outside the probe timeout. Discovery now obtains the linked Tk version without loading the GUI. This addresses draft advisory ANT-2026-0JRI1J0P.

Tk library resolution

The old package require Tk call loaded Tk while the collector was locating library files. Tk opens the display when it creates a main window, and the screen name can come from DISPLAY. CPython exposes the linked Tk version as _tkinter.TK_VERSION. The collector now uses that constant to find the library directory without opening a display.

Behavior changes

Tcl/Tk metadata collection no longer loads Tk or opens a display. It can locate the Tk library on headless systems where loading Tk raised a display error. The TCL_LIBRARY gate remains in place.

Reported by Antigravity: ANT-2026-0JRI1J0P.

@gaborbernat gaborbernat added the bug Something isn't working label Nov 2, 2026
@gaborbernat gaborbernat added the security Security fixes and advisories label Nov 3, 2026
@gaborbernat
gaborbernat merged commit 959a3b8 into tox-dev:main Nov 3, 2026
21 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working security Security fixes and advisories

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant