Repository navigation
Check .netrc file permissions once per parse #139633
Description
Feature or enhancement
Proposal:
The netrc module, when parsing the default ".netrc" file, does a security check that the file is owned by the current user if the file contains non-anonymous logins. That check is currently run once per line which contains a user other than anonymous. That means that the module issues a stat + os.getuid + pwd.getpwuid per entry in the netrc to compare whether the overall file permissions match the current user.
Because the check is just checking file permissions against the current user the same security would be provided by running the check once per netrc parse rather than once per entry.
I encountered this debugging why a script was slow to startup for a user with a large .netrc and discovered requests defaults to parsing netrc when no authentication is explicitly provided and that was triggering this behavior.
Has this already been discussed elsewhere?
No response given
Links to previous discussion of this feature:
No response
Activity
[-]Netrc should only `stat` once to check file permissoins, not once per entry[/-][+]Netrc should check file permissions with `os.fstat` once, not once per entry[/+]pythongh-139633: Run `netrc` file permission check only once per parse
[-]Netrc should check file permissions with `os.fstat` once, not once per entry[/-][+]Check `.netrc` file permissions once rather per parse[/+][-]Check `.netrc` file permissions once rather per parse[/-][+]Check `.netrc` file permissions once per parse[/+]gh-139633: Run netrc file permission check only once per parse (GH-13…
Merge branch 'main' into tachyon-ndjson-kolektor
pythongh-139633: Run netrc file permission check only once per parse (p…
pythongh-139633: Run netrc file permission check only once per parse (p…