* lisp/progmodes/python.el (run-python): Explain why we remove the current

directory from sys.path.  Suggested by Eric Hanchrow <erich@cozi.com>.

1 files changed, 5 insertions, 0 deletions

diff --git a/lisp/progmodes/python.el b/lisp/progmodes/python.el
index d2bb82e0580..a19445f47f5 100644
--- a/lisp/progmodes/python.el
+++ b/lisp/progmodes/python.el
@@ -1586,6 +1586,11 @@ buffer for a list of commands.)"
     (with-current-buffer
         (let* ((cmdlist
                 (append (python-args-to-list cmd)
+                        ;; It's easy for the user to cause the process to be
+                        ;; started without realizing it (e.g. to perform
+                        ;; completion); for this reason loading files from the
+                        ;; current directory is a security risk.  See
+                        ;; http://article.gmane.org/gmane.emacs.devel/103569
                         '("-i" "-c" "import sys; sys.path.remove('')")))
                (path (getenv "PYTHONPATH"))
                (process-environment     ; to import emacs.py