Re: Why does IDLE use a subprocess?

--===============6016640060889310710==
Content-Type: multipart/alternative; boundary="0000000000005ea2ae05fd15bbfa"

--0000000000005ea2ae05fd15bbfa
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi James,

IDLE's use of a sub-process is not primarily about security.

If one were to run user code within the same Python process (as IDLE
originally did!), then the Python interpreter would be shared between the
user code and IDLE.

(It is today possible to run a (nearly entirely) separate Python
interpreter within the same process, but that is a relatively new
development from recent years.)

Sharing the interpreter is a problem for various reasons, led by:
* User code can break IDLE in many interesting and unexpected ways.
* User code can block the main thread, which would make IDLE unresponsive.

There are many other reasons too. For example, the "restart interpreter"
feature is much harder, perhaps impossible, to implement.

Let me know if you'd like any further details.
- Tal Einat

On Tue, May 23, 2023 at 1:23=E2=80=AFAM James Schaffler via IDLE-dev <
[email protected]> wrote:

> Hi,
>
> I was curious about the internals of IDLE, and noticed that IDLE uses
> executes user code in a "subprocess" that's separate from the Python
> interpreter that is running IDLE itself (which does tasks such as making
> the window and coloring the text).
>
> As far as I understand, IDLE runs a modified version of
> code.InteractiveInterpreter by sending user code through a socket. Even t=
he
> IDLE documentation says that without a subprocess, "user code is not
> isolated from IDLE itself." However, some minimal testing of
> InteractiveInterpreter leads me to believe that the Interpreter object ha=
s
> its own view of local/global variables and therefore shouldn't be able to
> affect the calling interpreter (please correct me if I'm wrong).
>
> So my question is a combination of "Why does IDLE use a subprocess?" and
> "Why is InteractiveInterpreter not secure enough?" What possible security
> vulnerabilities exist if one uses IDLE without the subprocess? If anyone
> knows (or could point me to information on) why IDLE is designed this way=
,
> I'd really appreciate it. Thank you!
>
> Jim
> _______________________________________________
> IDLE-dev mailing list
> [email protected]
> https://mail.python.org/mailman/listinfo/idle-dev
>

--0000000000005ea2ae05fd15bbfa
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi James,<br></div><div><br></div><div>IDLE&#39;s use=
 of a sub-process is not primarily about security.</div><div><br></div><div=
>If one were to run user code within the same Python process (as IDLE origi=
nally did!), then the Python interpreter would be shared between the user c=
ode and IDLE. <br></div><div><br></div><div>(It is today possible to run a =
(nearly entirely) separate Python interpreter within the same process, but =
that is a relatively new development from recent years.)</div><div><br></di=
v><div>Sharing the interpreter is a problem for various reasons, led by:</d=
iv><div>* User code can break IDLE in many interesting and unexpected ways.=
<br></div><div>* User code can block the main thread, which would make IDLE=
 unresponsive.<br></div><div><br></div><div>There are many other reasons to=
o. For example, the &quot;restart interpreter&quot; feature is much harder,=
 perhaps impossible, to implement.</div><div><br></div><div>Let me know if =
you&#39;d like any further details.</div><div>- Tal Einat<br></div></div><b=
r><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Tue, =
May 23, 2023 at 1:23=E2=80=AFAM James Schaffler via IDLE-dev &lt;<a href=3D=
"mailto:[email protected]">[email protected]</a>&gt; wrote:<br></div><b=
lockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-le=
ft:1px solid rgb(204,204,204);padding-left:1ex">Hi,<br>
<br>
I was curious about the internals of IDLE, and noticed that IDLE uses execu=
tes user code in a &quot;subprocess&quot; that&#39;s separate from the Pyth=
on interpreter that is running IDLE itself (which does tasks such as making=
 the window and coloring the text).<br>
<br>
As far as I understand, IDLE runs a modified version of code.InteractiveInt=
erpreter by sending user code through a socket. Even the IDLE documentation=
 says that without a subprocess, &quot;user code is not isolated from IDLE =
itself.&quot; However, some minimal testing of InteractiveInterpreter leads=
 me to believe that the Interpreter object has its own view of local/global=
 variables and therefore shouldn&#39;t be able to affect the calling interp=
reter (please correct me if I&#39;m wrong).<br>
<br>
So my question is a combination of &quot;Why does IDLE use a subprocess?&qu=
ot; and &quot;Why is InteractiveInterpreter not secure enough?&quot; What p=
ossible security vulnerabilities exist if one uses IDLE without the subproc=
ess? If anyone knows (or could point me to information on) why IDLE is desi=
gned this way, I&#39;d really appreciate it. Thank you!<br>
<br>
Jim<br>
_______________________________________________<br>
IDLE-dev mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]=
g</a><br>
<a href=3D"https://mail.python.org/mailman/listinfo/idle-dev" rel=3D"norefe=
rrer" target=3D"_blank">https://mail.python.org/mailman/listinfo/idle-dev</=
a><br>
</blockquote></div>

--0000000000005ea2ae05fd15bbfa--

--===============6016640060889310710==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
IDLE-dev mailing list
[email protected]
https://mail.python.org/mailman/listinfo/idle-dev

--===============6016640060889310710==--