{"action":"created","issue":{"url":"https://api.github.com/repos/daokoder/dao/issues/457","labels_url":"https://api.github.com/repos/daokoder/dao/issues/457/labels{/name}","comments_url":"https://api.github.com/repos/daokoder/dao/issues/457/comments","events_url":"https://api.github.com/repos/daokoder/dao/issues/457/events","html_url":"https://github.com/daokoder/dao/issues/457","id":98701314,"number":457,"title":"Incorrect path searching on module loading","user":{"login":"Night-walker","id":5074460,"avatar_url":"https://avatars.githubusercontent.com/u/5074460?v=3","gravatar_id":"","url":"https://api.github.com/users/Night-walker","html_url":"https://github.com/Night-walker","followers_url":"https://api.github.com/users/Night-walker/followers","following_url":"https://api.github.com/users/Night-walker/following{/other_user}","gists_url":"https://api.github.com/users/Night-walker/gists{/gist_id}","starred_url":"https://api.github.com/users/Night-walker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Night-walker/subscriptions","organizations_url":"https://api.github.com/users/Night-walker/orgs","repos_url":"https://api.github.com/users/Night-walker/repos","events_url":"https://api.github.com/users/Night-walker/events{/privacy}","received_events_url":"https://api.github.com/users/Night-walker/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2015-08-03T09:02:00Z","updated_at":"2015-08-03T13:46:47Z","closed_at":null,"body":"For some reason, current directory takes precedence over standard modules library when loading stuff. That means one can create fake standard modules, placing the files with identical names in the current directory."},"comment":{"url":"https://api.github.com/repos/daokoder/dao/issues/comments/127239960","html_url":"https://github.com/daokoder/dao/issues/457#issuecomment-127239960","issue_url":"https://api.github.com/repos/daokoder/dao/issues/457","id":127239960,"user":{"login":"dumblob","id":2451044,"avatar_url":"https://avatars.githubusercontent.com/u/2451044?v=3","gravatar_id":"","url":"https://api.github.com/users/dumblob","html_url":"https://github.com/dumblob","followers_url":"https://api.github.com/users/dumblob/followers","following_url":"https://api.github.com/users/dumblob/following{/other_user}","gists_url":"https://api.github.com/users/dumblob/gists{/gist_id}","starred_url":"https://api.github.com/users/dumblob/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dumblob/subscriptions","organizations_url":"https://api.github.com/users/dumblob/orgs","repos_url":"https://api.github.com/users/dumblob/repos","events_url":"https://api.github.com/users/dumblob/events{/privacy}","received_events_url":"https://api.github.com/users/dumblob/received_events","type":"User","site_admin":false},"created_at":"2015-08-03T13:46:47Z","updated_at":"2015-08-03T13:46:47Z","body":"> Never seen anything like this. And I don't think security like this has any real meaning for a scripting language.\r\n\r\nWell, then we have to check all paths for the same module name and report conflicts. Otherwise we will silently shadow all other modules with the same name. On Windows this'll get very easy - somebody will download a single executable deployed application to some directory where there is also some Dao script with a common name (`time` or `zip` or whatever) and this script is moving files around or removing them or doing some other potentially harmfull stuff.\r\n\r\nWell, and then this poor guy just double clicks the executable (containing the single executable deployed Dao application) and he's scrued, because nobody would think, that such application would look around for some modules and even if it did, than definitely not running them."}}