diff --git a/Lib/lib-tk/Tkinter.py b/Lib/lib-tk/Tkinter.py index 3cce276e0aaa044ee345b41689778f640deadb33..ea563313f1dbe3154c7358126bc428981a9e32d5 100644 --- a/Lib/lib-tk/Tkinter.py +++ b/Lib/lib-tk/Tkinter.py @@ -1643,7 +1643,9 @@ class Tk(Misc, Wm): self.tk = _tkinter.create(screenName, baseName, className, interactive, wantobjects, useTk, sync, use) if useTk: self._loadtk() - self.readprofile(baseName, className) + if not sys.flags.ignore_environment: + # Issue #16248: Honor the -E flag to avoid code injection. + self.readprofile(baseName, className) def loadtk(self): if not self._tkloaded: self.tk.loadtk() diff --git a/Misc/NEWS b/Misc/NEWS index 3e84155b25083f0c818dc4b0b946d8735be92398..2a865df43f25c21ccc4e25743503b9f08b91ffac 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -13,6 +13,9 @@ Core and Builtins Library ------- +- Issue #16248: Disable code execution from the user's home directory by + tkinter when the -E flag is passed to Python. Patch by Zachary Ware. + What's New in Python 2.6.8? ===========================