don't execute from world-writeable locations

Author: nfx

libs/python/interpreters.go

@@ -47,12 +47,14 @@ func (a allInterpreters) AtLeast(minimalVersion string) (*Interpreter, error) {
 
 var ErrNoPythonInterpreters = errors.New("no python3 interpreters found")
 
+const worldWriteable = 0o002
+
 func DetectInterpreters(ctx context.Context) (allInterpreters, error) {
 	found := allInterpreters{}
 	paths := strings.Split(os.Getenv("PATH"), string(os.PathListSeparator))
 	seen := map[string]bool{}
 	for _, prefix := range paths {
-		entries, err := os.ReadDir(prefix)
+		info, err := os.Stat(prefix)
 		if errors.Is(err, fs.ErrNotExist) {
 			// some directories in $PATH may not exist
 			continue
@@ -61,6 +63,27 @@ func DetectInterpreters(ctx context.Context) (allInterpreters, error) {
 			// some directories we cannot list
 			continue
 		}
+		if err != nil {
+			return nil, fmt.Errorf("stat %s: %w", prefix, err)
+		}
+		if !info.IsDir() {
+			continue
+		}
+		perm := info.Mode().Perm()
+		if perm&worldWriteable != 0 {
+			// we try not to run any python binary that sits in a writable folder by all users.
+			// this is mainly to avoid breaking the security model on a multi-user system.
+			// If the PATH is pointing somewhere untrusted it is the user fault, but we can
+			// help here.
+			//
+			// See https://github.com/databricks/cli/pull/805#issuecomment-1735403952
+			continue
+		}
+		entries, err := os.ReadDir(prefix)
+		if errors.Is(err, fs.ErrPermission) {
+			// some directories we cannot list
+			continue
+		}
 		if err != nil {
 			return nil, fmt.Errorf("listing %s: %w", prefix, err)
 		}

libs/python/interpreters_test.go

@@ -2,6 +2,7 @@ package python
 
 import (
 	"context"
+	"os"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -26,7 +27,7 @@ func TestNoInterpretersFound(t *testing.T) {
 }
 
 func TestFilteringInterpreters(t *testing.T) {
-	t.Setenv("PATH", "testdata/other-binaries-filtered")
+	t.Setenv("PATH", "testdata/other-binaries-filtered"+string(os.PathListSeparator)+"testdata/world-writeable")
 
 	ctx := context.Background()
 	all, err := DetectInterpreters(ctx)

libs/python/testdata/world-writeable/python8.4

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+echo "Python 8.4.10"