- Issue #17012: shutil.which() no longer fallbacks to the PATH environment

  variable if empty path argument is specified.  Patch by Serhiy Storchaka.

Lib/shutil.py

@@ -1090,7 +1090,11 @@ def which(cmd, mode=os.F_OK | os.X_OK, path=None):
             return cmd
         return None
 
-    path = (path or os.environ.get("PATH", os.defpath)).split(os.pathsep)
+    if path is None:
+        path = os.environ.get("PATH", os.defpath)
+    if not path:
+        return None
+    path = path.split(os.pathsep)
 
     if sys.platform == "win32":
         # The current directory takes precedence on Windows.

Lib/test/test_shutil.py

@@ -25,6 +25,7 @@ import warnings
 
 from test import support
 from test.support import TESTFN, check_warnings, captured_stdout, requires_zlib
+from unittest.mock import patch
 
 try:
     import bz2
@@ -1363,6 +1364,26 @@ class TestWhich(unittest.TestCase):
         rv = shutil.which(self.file[:-4], path=self.dir)
         self.assertEqual(rv, self.temp_file.name[:-4] + ".EXE")
 
+    def test_environ_path(self):
+        with support.EnvironmentVarGuard() as env:
+            env['PATH'] = self.dir
+            rv = shutil.which(self.file)
+            self.assertEqual(rv, self.temp_file.name)
+
+    def test_empty_path(self):
+        base_dir = os.path.dirname(self.dir)
+        with support.temp_cwd(path=self.dir), \
+             support.EnvironmentVarGuard() as env:
+            env['PATH'] = self.dir
+            rv = shutil.which(self.file, path='')
+            self.assertIsNone(rv)
+
+    def test_empty_path_no_PATH(self):
+        with support.EnvironmentVarGuard() as env:
+            env.pop('PATH', None)
+            rv = shutil.which(self.file)
+            self.assertIsNone(rv)
+
 
 class TestMove(unittest.TestCase):
 

Misc/NEWS

@@ -42,6 +42,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #17012: shutil.which() no longer fallbacks to the PATH environment
+  variable if empty path argument is specified.  Patch by Serhiy Storchaka.
+
 - Issue #17710: Fix pickle raising a SystemError on bogus input.
 
 - Issue #17341: Include the invalid name in the error messages from re about