[Bug Report] Box Drive crashes in presence of environment variables

I clicked the Create a Ticket link in the footer, but it went nowhere (???), so this will have to do. The OAUTH login flow for Box Drive began to "defecate the hibernation locality" on me a few months ago. The browser would open, I'd login successfully, then upon receipt of them a dialog box would appear with words to the effect that Box Drive had crashed. I'm not a hardcore user of Box so I just shrugged and used the web interface as needed. I used the Send Logs… function at the time, and kept a copy to peruse at my leisure. Upon inspection, they illuminated an issue wherein Box Drive was interacting with my local Python environment, which I found perplexing on its face as well as cryptic to debug.

I can't stress enough how strongly I feel that applications like Box Drive should operate within their own sandboxed virtualenv even in the presence of a pre-existing local interpreter, as it would've made all of this moot to begin with. However as that's not currently the case, I'll proceed to take you through the debugging process that ultimately resolved the fault.

As alluded to above, the issue ended up being one of environment variable leakage, specifically in this case the PYTHON_KEYRING_BACKEND variable. The terminal error message in the logs was 'Module not found: keyring.backends.OnePasswordBackend' which was both surprising to me and not. I do make use of that particular module on the system in question, but was perplexed as to why it wouldn't be found by Box Drive. I surmised that Box Drive was looking for the module after having parsed my configuration file for the keyring module, and figured that if it wasn't tightly scoped enough to stay out of there, it would also be able to traverse my PYTHONMODULEPATH to find the module itself.

That implicit assumption turned out to be wrong once I understood the method by which Box Drive's environment was being influenced, namely my global environment variables. I had my preferred backend for the keyring module declared both in the default configuration file for the module and also as an environment variable for processes that are hampered by filesystem boundaries. Thus, it was the environment variable that Box Drive was reading, leading to the Module not found error as it naturally wasn't present in its module path.

My proposed resolution for the issue is that it be executed in a clean environment that doesn't inherit the parent process' envvars, otherwise this is bound to happen again to more people than just me. I would ask that the development team effect some form of mitigation for this behavior as soon as possible and highlight such in the changelog so I can return to using the environment variable again. A ping here would also be appreciate upon release of a fix.

—A fellow snake wrangler