improve command for getting sys path to resolve security issue

Author: s-kai273

src/client/common/utils/pythonUtils.ts

@@ -1,8 +1,20 @@
 import { execFileSync } from 'child_process';
 
 export function getSysPath(pythonCmd = 'python3'): string[] {
+    // cleanSysPathCommand removes the working directory from sys.path.
+    // The -c flag adds it automatically, which can allow some stdlib
+    // modules (like json) to be overridden by other files (like json.py).
+    const cleanSysPathCommand = [
+        'import os, os.path, sys',
+        'normalize = lambda p: os.path.normcase(os.path.normpath(p))',
+        'cwd = normalize(os.getcwd())',
+        'orig_sys_path = [p for p in sys.path if p != ""]',
+        'sys.path[:] = [p for p in sys.path if p != "" and normalize(p) != cwd]',
+        'import sys, json',
+        'print(json.dumps(sys.path))',
+    ].join('; ');
     try {
-        const out = execFileSync(pythonCmd, ['-c', 'import sys, json; print(json.dumps(sys.path))'], {
+        const out = execFileSync(pythonCmd, ['-c', cleanSysPathCommand], {
             encoding: 'utf-8',
         });
         return JSON.parse(out);