Update the encoding package's search function to use absolute imports when

calling __import__.  This helps make the expected search locations for encoding
modules be more explicit.

One could use an explicit value for __path__ when making the call to __import__
to force the exact location searched for encodings.  This would give the most
strict search path possible if one is worried about malicious code being
imported.  The unfortunate side-effect of that is that if __path__ was modified
on 'encodings' on purpose in a safe way it would not be picked up in future
__import__ calls.

diff --git a/Lib/encodings/__init__.py b/Lib/encodings/__init__.py
index 6cf608954ccd8e0e3e0559524d57e6b9edfa42de..190b3c4950a66351bfccde13da29462caf82241f 100644 (file)
--- a/Lib/encodings/__init__.py
+++ b/Lib/encodings/__init__.py
@@ -93,8 +93,10 @@ def search_function(encoding):
         if not modname or '.' in modname:
             continue
         try:
-            mod = __import__('encodings.' + modname,
-                             globals(), locals(), _import_tail)
+            # Import equivalent to `` from .modname import *``.
+            # '*' is used so that __import__ returns the desired module and not
+            # 'encodings' itself.
+            mod = __import__(modname, globals(), locals(), ['*'], 1)
         except ImportError:
             pass
         else:

diff --git a/Misc/NEWS b/Misc/NEWS
index 1426799118fba741b031497813372eb28e9e0be8..dffd5b70ec867e77933efa83254eeedf9c43481f 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -128,6 +128,9 @@ Core and builtins
 Library
 -------
 
+- Have the encoding package's search function dynamically import using absolute
+  import semantics.
+
 - Patch #1647484: Renamed GzipFile's filename attribute to name.
 
 - Patch #1517891: Mode 'a' for ZipFile now creates the file if it