Linux: shutil.which fails to find executable in current working directory/cwd when PATH unset (subprocess works)

[grqz]

Bug report

Bug description:

On Linux, executables from the cwd are used when PATH is unset:

$ PATH= python -V
Python 3.13.7

subprocess.run also works in this case:

$ PATH= python -q
>>> from subprocess import run
... run(['python', '-V'])
... 
Python 3.13.7
CompletedProcess(args=['python', '-V'], returncode=0)
>>> 

But shutil.which returns None:

>>> from shutil import which
>>> which('python')
>>> 

This is because when PATH is empty(""), the executable ("python") is passed to the kernel's execve directly, without resolving. execve then resolves the file relative to the cwd, I believe it's the case in both Linux and FreeBSD.
POSIX 2024 says this about the PATH environment variable:

If PATH is unset or is set to null, or if a path prefix in PATH contains a character ('%'), the path search is implementation-defined.

EDIT: PATH is empty, not unset

CPython versions tested on:

3.13

Operating systems tested on:

Linux

[dr-carlos]

This issue still occurs in the latest CPython (not just 3.13).

Technically, running PATH= python sets $PATH to be an empty string (""), not unset. If you unset PATH (e.g. with unset PATH in bash), shutil.which() will search the os.defpath (see the docs).

Looking at the shutil.which() code, it says that setting $PATH to an empty string ("") doesn't match anything, as opposed to ":" which matches in the current directory. According to bpo-35755, it's a security issue to just spawn executables in the current directory unless explicitly specified.

cpython/Lib/shutil.py

Lines 1594 to 1608 in 95f6e12

	if path is None:
	path = os.environ.get("PATH", None)
	if path is None:
	try:
	path = os.confstr("CS_PATH")
	except (AttributeError, ValueError):
	# os.confstr() or CS_PATH is not available
	path = os.defpath
	# bpo-35755: Don't use os.defpath if the PATH environment variable
	# is set to an empty string
	# PATH='' doesn't match, whereas PATH=':' looks in the current
	# directory
	if not path:
	return None

[grqz]

it's a security issue to just spawn executables in the current directory unless explicitly specified.

Do we want to change the PATH resolution logic in subprocess?

cpython/Lib/subprocess.py

Lines 1890 to 1896 in 95f6e12

	if os.path.dirname(executable):
	executable_list = (executable,)
	else:
	# This matches the behavior of os._execvpe().
	executable_list = tuple(
	os.path.join(os.fsencode(dir), executable)
	for dir in os.get_exec_path(env))

Here, os.get_exec_path returns [''], and since dir == '', os.path.join(os.fsencode(dir), executable) == executable which then gets resolved to "./executable".

The same happens in glibc execvp: https://sourceware.org/git/?p=glibc.git;a=blob;f=posix/execvpe.c;h=c139dfe8fde6b12dcf2dc4e20e4233157e53384e;hb=dd472e09c11c75e1fe23ecd88d1902fb8f5a283c#l130

EDIT: POSIX says this and this is probably just an extension to the legacy feature since zero-length prefix can be interpreted as an empty element in the PATH list:
A zero-length prefix is a legacy feature that indicates the current working directory. It appears as two adjacent characters ("::"), as an initial preceding the rest of the list, or as a trailing following the rest of the list. A strictly conforming application shall use an actual pathname (such as .) to represent the current working directory in PATH