PYTHONSAFEPATH is not respected

[siddharthab]

Applies To

• Notebooks (.ipynb files)
• Interactive Window and/or Cell Scripts (.py files with #%% markers)

What happened?

In workspace .env file:

PYTHONSAFEPATH=1

A test file (can be either .ipynb cell or a %% block in a .py file):

import sys
print(sys.flags.safe_path)
print(sys.path)

When the cell is run with the Jupyter extension, the output is:

True
['/home/user/Workspaces/main/python', '/home/user/.mamba/lib/python311.zip', '/home/user/.mamba/lib/python3.11', '/home/user/.mamba/lib/python3.11/lib-dynload', '', '/home/user/.mamba/lib/python3.11/site-packages', '/home/user/.mamba/lib/python3.11/site-packages/setuptools/_vendor']

When run with the Python extension as a Python script, the output is:

True
['/home/user/Workspaces/main/python', '/home/user/.mamba/lib/python311.zip', '/home/user/.mamba/lib/python3.11', '/home/user/.mamba/lib/python3.11/lib-dynload', '/home/user/.mamba/lib/python3.11/site-packages', '/home/user/.mamba/lib/python3.11/site-packages/setuptools/_vendor']

Notice the empty string right before the site-packages directory when run with Jupyter. When sys.flags.safe_path is set (in this case through the PYTHONSAFEPATH=1 env var), this empty string should not be present.

VS Code Version

Version: 1.89.1-cde Commit: 982664f21043ab3f264d1705f0887679853d6af9 Date: 2024-10-30T00:53:56.119Z (2 wks ago) Browser: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Jupyter Extension Version

v2024.4.0

Jupyter logs

Code OSS for Cloud Workstations (1.89.1-cde, 80-sidb.cluster-2pt3hubcdrgtkwmwq6q2s55636.cloudworkstations.dev, desktop)
Jupyter Extension Version: 2024.4.0.
Python Extension Version: 2024.12.3.
Pylance Extension not installed.
Platform: linux (x64).
Workspace folder ~/Workspaces/main, Home = /home/user
18:34:08.995 [info] Process Execution: ~/.mamba/bin/python -m pip list
...[snipped]...
18:46:28.024 [info] Starting interactive window for resource '~/Workspaces/main/a.py' with controller '.jvsc74a57bd00a8a2dede04a01d79e22df88f0be047c97e484973fe05a0227d48a9c31c4bbbe./home/~/.mamba/python./home/~/.mamba/python.-m#ipykernel_launcher (Interactive)'
18:46:28.282 [info] Starting Kernel startUsingPythonInterpreter, .jvsc74a57bd00a8a2dede04a01d79e22df88f0be047c97e484973fe05a0227d48a9c31c4bbbe./home/~/.mamba/python./home/~/.mamba/python.-m#ipykernel_launcher  (Python Path: ~/.mamba/bin/python, Conda, base (Python 3.11.9), 3.11.9) for '/Interactive-1.interactive' (disableUI=false)
18:46:32.838 [info] Process Execution: ~/.mamba/bin/python -c "import ipykernel; print(ipykernel.__version__); print("5dc3a68c-e34e-4080-9c3e-2a532b2ccb4d"); print(ipykernel.__file__)"
18:46:32.872 [info] Process Execution: ~/.mamba/bin/python -m ipykernel_launcher --f=/home/~/.local/share/jupyter/runtime/kernel-v2-68139hamC8RXJPygd.json
    > cwd: ~/Workspaces/main
18:46:33.538 [info] Generated code for 1 = <ipython-input-1-fa9c31eb629c> with 4 lines
18:46:33.603 [info] Cell 1 completed in 0.002s (start: 1732041993601, end: 1732041993603)

Coding Language and Runtime Version

Python v3.11.9

Language Extension Version (if applicable)

Python v2024.12.3

Anaconda Version (if applicable)

micromamba 2.0.2

Running Jupyter locally or remotely?

Local

[siddharthab]

A workaround could be to have this in your User settings.json (other settings scopes do not have this setting).

    "jupyter.runStartupCommands": [
        "import sys",
        "sys.path = [p for p in sys.path if p != '']"
    ]