From 6d4869709598b279bc318d55bf1d2ca710826dd3 Mon Sep 17 00:00:00 2001 From: HABER7789 Date: Thu, 30 Jul 2026 14:04:58 -0700 Subject: [PATCH 1/2] validate import checks in python course environment setup Module names from course.json flowed into a `python -c` command line without validation, so a drop-in course could run random Python when someone ran the environment check. They now have to be dotted identifiers, and anything else is reported as a failed check rather than silently dropped. Also fixes the multiple-environments warning, which joined the environment objects directly and so logged [object Object] instead of their names. --- source/vscode/src/learning/python/environment.ts | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/source/vscode/src/learning/python/environment.ts b/source/vscode/src/learning/python/environment.ts index 4737fc767e1..5ec5a715ce4 100644 --- a/source/vscode/src/learning/python/environment.ts +++ b/source/vscode/src/learning/python/environment.ts @@ -10,6 +10,12 @@ import type { import { PythonEnvironments } from "@vscode/python-environments"; import * as vscode from "vscode"; +/** + * Dotted Python module name. Import checks come from author-supplied + * `course.json`, and reach a `python -c` command line. + */ +const MODULE_NAME = /^[A-Za-z_]\w*(\.[A-Za-z_]\w*)*$/; + /** * Manages per-course Python environments for `python-notebook` courses. * @@ -146,6 +152,11 @@ export class EnvironmentManager { const results: { module: string; ok: boolean }[] = []; for (const module of modules) { + if (!MODULE_NAME.test(module)) { + log.warn(`Not a valid Python module name, skipping: ${module}`); + results.push({ module, ok: false }); + continue; + } const code = await runPython(api, env, ["-c", `import ${module}`]); results.push({ module, ok: code === 0 }); } @@ -196,7 +207,9 @@ export class EnvironmentManager { return envs[0]; default: log.warn( - `Found multiple virtual environments, using first: ${envs.join(", ")}`, + `Found multiple virtual environments, using first: ${envs + .map((e) => e.name) + .join(", ")}`, ); return envs[0]; } From 7a48dc0f69b0b1560a1083d1e8236f342a6cccec Mon Sep 17 00:00:00 2001 From: HABER7789 Date: Sun, 2 Aug 2026 23:45:00 -0700 Subject: [PATCH 2/2] update notebook explain button to course notebooks --- source/vscode/package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source/vscode/package.json b/source/vscode/package.json index 27ee7290846..c60a575948c 100644 --- a/source/vscode/package.json +++ b/source/vscode/package.json @@ -485,7 +485,7 @@ "notebook/cell/title": [ { "command": "qsharp-vscode.learningNotebookExplain", - "when": "notebookType == 'jupyter-notebook' && qsharp-vscode.learningWorkspaceDetected", + "when": "qsharp-vscode.learningNotebookActive", "group": "inline/cell@50" } ],