{"action":"opened","issue":{"url":"https://api.github.com/repos/jaraco/keyring/issues/22","labels_url":"https://api.github.com/repos/jaraco/keyring/issues/22/labels{/name}","comments_url":"https://api.github.com/repos/jaraco/keyring/issues/22/comments","events_url":"https://api.github.com/repos/jaraco/keyring/issues/22/events","html_url":"https://github.com/jaraco/keyring/issues/22","id":58651762,"number":22,"title":"using a config file from the current directory is insecure","user":{"login":"jaraco","id":308610,"avatar_url":"https://avatars.githubusercontent.com/u/308610?v=3","gravatar_id":"","url":"https://api.github.com/users/jaraco","html_url":"https://github.com/jaraco","followers_url":"https://api.github.com/users/jaraco/followers","following_url":"https://api.github.com/users/jaraco/following{/other_user}","gists_url":"https://api.github.com/users/jaraco/gists{/gist_id}","starred_url":"https://api.github.com/users/jaraco/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jaraco/subscriptions","organizations_url":"https://api.github.com/users/jaraco/orgs","repos_url":"https://api.github.com/users/jaraco/repos","events_url":"https://api.github.com/users/jaraco/events{/privacy}","received_events_url":"https://api.github.com/users/jaraco/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-02-23T21:31:01Z","updated_at":"2015-02-23T21:31:01Z","closed_at":null,"body":"\nEspecially since the config file allows arbitrary code to be loaded, using one from whatever directory the user happens to be in when the keyring module runs is insecure.  \nThere doesn't seem to be anything to prevent an unscrupulous person from creating a config file that loads a module that reveals the authentication information.\nThe config file from the user's home directory should be loaded first, and the current directory's config file loaded only if explicitly enabled in the home directory config file.\nAlso, the config files should not be used if they are owned by anyone other that the current user, or if they are writable by anyone else.\n\n----------------------------------------\n- Bitbucket: https://bitbucket.org/kang/python-keyring-lib/issue/22\n- Originally reported by: [erh](http://bitbucket.org/erh)\n- Originally created at: 2010-06-22T23:24:05.638\n"}}