sys.audit() for "glob.glob" is called in a recursive function _iglob(). So in process of executing glob.glob() it can be called multiple times, with the original pattern and with patterns for parent directories, while there are metacharacters in them.

I do not think it was intentional.

Provided it's called with different arguments each time (which it is), there isn't a problem here. Audit hooks are supposed to be informative, not definitive (that is, you almost always need to take the surrounding context into consideration, which is why they are better for logging actions rather than blocking actions).

Though it might be unintentional that glob.glob() recursively handles each path segment when it could more efficiently work forward resolving each wildcard segment as it goes. Is that what you mean?

Using recursion is rather an implementation detail, because splitpath() splits a path from the end (Path.glob() does it from other side). Also, it may be a tiny bit more efficient if the pattern contains a long literal prefix.

Ah, and when added sys.audit() for glob.glob(), should not it be added for Path.glob() too? And for os.walk()?

> when added sys.audit() for glob.glob(), should not it be added for Path.glob() too? And for os.walk()?

Sure, those would make sense.

They all go via scandir() which has its own event too (and will do for each directory), but being able to see that it came from a glob or walk call could be useful information.

Maybe moving the sys.audit call in glob.glob further down in the function would avoid some of the recursion? I don't want to duplicate where it's raised too much, as that provides opportunities to bypass it, but this one is only slightly informative - os.scandir is the real one that you'd worry about seeing.

I think it would be better to call sys.audit() in glob.iglob(), before calling the top-level _iglob(). It will give you a general context, and at every recursion level sys.audit() will be called for os.scandir().

It is harder to avoid repeating calls in os.walk(), because it is recursive itself. But you can introduce a recursive helper _walk() and make os.walk() just calling sys.audit() and _walk().

New changeset 54b4f14712b9350f11c983f1c8ac47a3716958a7 by Serhiy Storchaka in branch 'master':
bpo-38149: Call sys.audit() only once per call for glob.glob(). (GH-18360)
https://github.com/python/cpython/commit/54b4f14712b9350f11c983f1c8ac47a3716958a7

New changeset 708f472dd92f4f46c27ace710492da65da4a3319 by Miss Islington (bot) in branch '3.8':
bpo-38149: Call sys.audit() only once per call for glob.glob(). (GH-18360)
https://github.com/python/cpython/commit/708f472dd92f4f46c27ace710492da65da4a3319