This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: Calling Tkinter.Tk() with a baseName keyword argument throws UnboundLocalError
Type: behavior Stage: resolved
Components: Tkinter Versions: Python 2.7
process
Status: closed Resolution: duplicate
Dependencies: Superseder: Security bug in tkinter allows for untrusted, arbitrary code execution.
View: 16248
Assigned To: Nosy List: r.david.murray, serhiy.storchaka, terry.reedy, y-fujii
Priority: normal Keywords:

Created on 2013-04-20 11:57 by y-fujii, last changed 2022-04-11 14:57 by admin. This issue is now closed.

Messages (4)
msg187418 - (view) Author: Yasuhiro Fujii (y-fujii) * Date: 2013-04-20 11:57
Calling Tkinter.Tk() with baseName keyword argument throws UnboundLocalError on Python 2.7.4.

A process to reproduce the bug:
>>> import Tkinter
>>> Tkinter.Tk(baseName="test")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python2.7/lib-tk/Tkinter.py", line 1748, in __init__
    if not sys.flags.ignore_environment:
UnboundLocalError: local variable 'sys' referenced before assignment

A patch to fix the bug:
--- Lib/lib-tk/Tkinter.py.orig
+++ Lib/lib-tk/Tkinter.py
@@ -1736,7 +1736,7 @@
         # ensure that self.tk is always _something_.
         self.tk = None
         if baseName is None:
-            import sys, os
+            import os
             baseName = os.path.basename(sys.argv[0])
             baseName, ext = os.path.splitext(baseName)
             if ext not in ('.py', '.pyc', '.pyo'):
msg187422 - (view) Author: R. David Murray (r.david.murray) * (Python committer) Date: 2013-04-20 13:14
Thanks for the report and patch.  It would be nice to turn that test into a unit test.

I've run the test on 3.4; this appears to be a 2.7 only bug.
msg187872 - (view) Author: Terry J. Reedy (terry.reedy) * (Python committer) Date: 2013-04-26 20:22
Line 35 is "import sys" so sys imports within functions are superfluous, as well as contrary to current guidelines. There is another on 1033. Both were removed before 3.3, so this amounts to a 2.7 backport.

It took me a moment to see that the unneeded conditional import is not innocuous, as it localizes 'sys' while sometimes leaving it unbound. Good catch.

Yashuhiro, can you sign a PSF contributor license agreement? The electronic version is easy.
  http://www.python.org/psf/contrib/contrib-form/
We don't really need it for this patch, but we hope to see more from you.

A minimal test would be a unittest version of
  assert isinstance(Tk(baseName="test"), Tk)
This mainly tests that no exceptions are raised when the arg is present. The doc may suggest that baseName should have a visible effect on the instance that could be tested. If there is already a 3.x test, it should be backported. If not, anything added to 2.7 should be added to 3.x also.
msg195907 - (view) Author: Serhiy Storchaka (serhiy.storchaka) * (Python committer) Date: 2013-08-22 15:34
Fixed in changesets fa82071bb7e1 and 0f17aed78168.
History
Date User Action Args
2022-04-11 14:57:44adminsetgithub: 62003
2013-08-22 15:34:25serhiy.storchakasetstatus: open -> closed

superseder: Security bug in tkinter allows for untrusted, arbitrary code execution.

nosy: + serhiy.storchaka
messages: + msg195907
resolution: duplicate
stage: test needed -> resolved
2013-04-26 20:22:38terry.reedysetnosy: + terry.reedy
messages: + msg187872
2013-04-20 13:14:56r.david.murraysetnosy: + r.david.murray

messages: + msg187422
stage: test needed
2013-04-20 11:57:47y-fujiicreate