Treat an empty CONDA_PREFIX as "no conda env" in find_nvidia_binary_utility - #2498
Open
LeSingh1 wants to merge 1 commit into
Open
Treat an empty CONDA_PREFIX as "no conda env" in find_nvidia_binary_utility#2498LeSingh1 wants to merge 1 commit into
LeSingh1 wants to merge 1 commit into
Conversation
…tility
`find_nvidia_binary_utility()` accepted any CONDA_PREFIX that was merely set,
including the empty string. `os.path.join("", "bin")` is `"bin"`, so an empty
CONDA_PREFIX added a CWD-relative directory to the trusted search list. The
`assert directory` guard in `_resolve_in_trusted_dirs()` does not catch this
because the joined value is non-empty, so a planted `./bin/nvcc` in the
process working directory could be returned as an absolute path -- the same
CWD-leakage class that NVIDIA#2119 fixed.
Every other pathfinder search step (`search_steps.find_in_conda`,
`_static_libs`, `_headers`) already treats an empty CONDA_PREFIX as "not in a
conda environment"; this brings the binary finder in line.
Contributor
github-actions
Bot
added
the
cuda.pathfinder
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
find_nvidia_binary_utility()gates its conda step onCONDA_PREFIXbeing set rather than non-empty:os.path.join("", "bin")is"bin", so an emptyCONDA_PREFIXputs a CWD-relative directory into the trusted search list. Theassert directoryguard in_resolve_in_trusted_dirs()does not catch it, because the joined value is non-empty. A./bin/nvccin the process working directory is then returned as an absolute path, and the caller executes it — the same CWD-leakage class as #2119.An empty-but-set
CONDA_PREFIXis not exotic: container images and CI setups that export it unconditionally produce exactly that, as do shells that blank it instead of unsetting it.Every other pathfinder search step already uses the truthiness rule —
search_steps.find_in_conda,_static_libs,_headers— andtest_search_steps.py::test_returns_none_with_empty_conda_prefixpins it for dynamic libs. This brings the binary finder in line.The test plants a decoy
./bin/nvcc, setsCONDA_PREFIX="", and assertsNone; it returns the decoy path without the fix.NOTE: developed with the assistance of an AI coding agent. The new test carries
@pytest.mark.agent_authoredper AGENTS.md. I reviewed and verified the change and the reproduction before submitting.