''.split(':') returns [''] !

In the particular case of PATH, '' is the same as '.',
which is a bad idea from a security point of view.

component/ocropy/buildout.cfg

@@ -32,7 +32,7 @@ setup-eggs =
   ${matplotlib:egg}
   ${pillow-python:egg}
 patches =
-  ${:_profile_base_location_}/ocropy.patch#d338f1849042f16a16591ad805dd1d26
+  ${:_profile_base_location_}/ocropy.patch#dd7a02e1e63ed9df68e3a539b3e919eb
 patch-options = -p1
 patch-binary = ${patch:location}/bin/patch
 environment = ocropy-env

component/ocropy/ocropy.patch

-From 80b496756881fe435ec55155037bef45d66089d0 Mon Sep 17 00:00:00 2001
+From 1bb1546b12b0c08b1b32b293207de2d58d43ff1c Mon Sep 17 00:00:00 2001
 From: Francois Le Corre <francois.lecorre@nexedi.com>
 Date: Thu, 6 Apr 2017 11:32:27 +0200
 Subject: [PATCH] WIP
@@ -86,7 +86,7 @@ index b7a207f..240450b 100644
          os.mkdir(prefix)
      m = hashlib.md5()
 diff --git a/setup.py b/setup.py
-index 2ec5832..6697b12 100644
+index 2ec5832..0ad4d85 100644
 --- a/setup.py
 +++ b/setup.py
 @@ -10,7 +10,9 @@
@@ -94,8 +94,8 @@ index 2ec5832..6697b12 100644
  #from distutils.command.install_data import install_data
  
 -if not os.path.exists("models/en-default.pyrnn.gz"):
-+models = os.environ.get('OCROPY_MODEL_PATH', '').split(':') or \
-+    [c for c in glob.glob("models/*pyrnn.gz")]
++models = os.environ.get('OCROPY_MODEL_PATH')
++models = models.split(':') if models else glob.glob("models/*pyrnn.gz")
 +if not models:
      print()
      print("You should download the default model 'en-default.pyrnn.gz'")

slapos/recipe/erp5_test/test.py

@@ -34,7 +34,10 @@ def runTestSuite(args):
   if 'test_ca_path' in d:
     env['TEST_CA_PATH'] = d['test_ca_path']
   if 'prepend_path' in d:
-    env['PATH'] = ':'.join([d['prepend_path']] + os.environ.get('PATH', '').split(':'))
+    try:
+      env['PATH'] = d['prepend_path'] + ':' + env['PATH']
+    except KeyError:
+      env['PATH'] = d['prepend_path']
   if 'instance_home' in d:
     env['INSTANCE_HOME'] = d['instance_home']
     env['REAL_INSTANCE_HOME'] = d['instance_home']