Issue #16248: Disable code execution from the user's home directory by tkinter when the -E flag is passed to Python.
Patch by Zachary Ware.
diff --git a/Lib/lib-tk/Tkinter.py b/Lib/lib-tk/Tkinter.py
index 795cc45..cec31fd 100644
--- a/Lib/lib-tk/Tkinter.py
+++ b/Lib/lib-tk/Tkinter.py
@@ -1709,7 +1709,9 @@
self.tk = _tkinter.create(screenName, baseName, className, interactive, wantobjects, useTk, sync, use)
if useTk:
self._loadtk()
- self.readprofile(baseName, className)
+ if not sys.flags.ignore_environment:
+ # Issue #16248: Honor the -E flag to avoid code injection.
+ self.readprofile(baseName, className)
def loadtk(self):
if not self._tkloaded:
self.tk.loadtk()