summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* bpo-38328: Speed up the creation time of constant list and set display. ↵Brandt Bucher2019-11-263-1/+25
| | | | (GH-17114)
* closes bpo-38803: Fix leak in posixmodule. (GH-17373)Eddie Elizondo2019-11-261-0/+1
|
* bpo-21063: Improve module synopsis for distutils (GH-17363)Sanchit Khurana2019-11-255-9/+9
|
* bpo-20928: support base-URL and recursive includes in etree.ElementInclude ↵Stefan Behnel2019-11-253-7/+132
| | | | | | | | | | | | (#5723) * bpo-20928: bring elementtree's XInclude support en-par with the implementation in lxml by adding support for recursive includes and a base-URL. * bpo-20928: Support xincluding the same file multiple times, just not recursively. * bpo-20928: Add 'max_depth' parameter to xinclude that limits the maximum recursion depth to 6 by default. * Add news entry for updated ElementInclude support
* bpo-38870: Remove dependency on contextlib to avoid performance regression ↵Pablo Galindo2019-11-251-7/+13
| | | | | | | | | on import (GH-17376) https://bugs.python.org/issue38870 Automerge-Triggered-By: @pablogsal
* Fix typo in Doc/whatsnew/3.9.rst (GH-17372)Pablo Galindo2019-11-251-1/+1
|
* bpo-38870: Expose a function to unparse an ast object in the ast module ↵Pablo Galindo2019-11-246-751/+772
| | | | | | | (GH-17302) Add ast.unparse() as a function in the ast module that can be used to unparse an ast.AST object and produce a string with code that would produce an equivalent ast.AST object when parsed.
* bpo-38862: IDLE Strip Trailing Whitespace fixes end newlines (GH-17366)Terry Jan Reedy2019-11-247-41/+69
| | | Extra newlines are removed at the end of non-shell files. If the file only has newlines after stripping other trailing whitespace, all are removed, as is done by patchcheck.py.
* bpo-38876: Raise pickle.UnpicklingError when loading an item from memo for ↵Claudiu Popa2019-11-244-8/+35
| | | | | | | | | | | | | | | invalid input (GH-17335) The previous code was raising a `KeyError` for both the Python and C implementation. This was caused by the specified index of an invalid input which did not exist in the memo structure, where the pickle stores what objects it has seen. The malformed input would have caused either a `BINGET` or `LONG_BINGET` load from the memo, leading to a `KeyError` as the determined index was bogus. https://bugs.python.org/issue38876 https://bugs.python.org/issue38876
* Remove unnecessary variable definition (GH-17368)Batuhan Taşkaya2019-11-241-1/+0
|
* Better runtime TypedDict (GH-17214)Zac Hatfield-Dodds2019-11-243-3/+25
| | | | | This patch enables downstream projects inspecting a TypedDict subclass at runtime to tell which keys are optional. This is essential for generating test data with Hypothesis or validating inputs with typeguard or pydantic.
* bpo-38881: choices() raises ValueError when all weights are zero (GH-17362)Raymond Hettinger2019-11-234-3/+15
|
* bpo-38899: virtual environment activation for fish should use `source` ↵Brett Cannon2019-11-233-3/+6
| | | | | | | | | | | | (GH-17359) The previously documented use of `.` is considered deprecated (https://fishshell.com/docs/current/commands.html#source). https://bugs.python.org/issue38899 Automerge-Triggered-By: @brettcannon
* bpo-38896: Remove PyUnicode_ClearFreeList() function (GH-17354)Victor Stinner2019-11-237-27/+6
| | | | Remove PyUnicode_ClearFreeList() function: the Unicode free list has been removed in Python 3.3.
* bpo-38686: fix HTTP Digest handling in request.py (#17045)PypeBros2019-11-222-2/+5
| | | | | | | | | | | | | | | | | | | | | * fix HTTP Digest handling in request.py There is a bug triggered when server replies to a request with `WWW-Authenticate: Digest` where `qop="auth,auth-int"` rather than mere `qop="auth"`. Having both `auth` and `auth-int` is legitimate according to the `qop-options` rule in §3.2.1 of [[https://www.ietf.org/rfc/rfc2617.txt|RFC 2617]]: > qop-options = "qop" "=" <"> 1#qop-value <"> > qop-value = "auth" | "auth-int" | token > **qop-options**: [...] If present, it is a quoted string **of one or more** tokens indicating the "quality of protection" values supported by the server. The value `"auth"` indicates authentication; the value `"auth-int"` indicates authentication with integrity protection This is description confirmed by the definition of the [//n//]`#`[//m//]//rule// extended-BNF pattern defined in §2.1 of [[https://www.ietf.org/rfc/rfc2616.txt|RFC 2616]] as 'a comma-separated list of //rule// with at least //n// and at most //m// items'. When this reply is parsed by `get_authorization`, request.py only tests for identity with `'auth'`, failing to recognize it as one of the supported modes the server announced, and claims that `"qop 'auth,auth-int' is not supported"`. * 📜🤖 Added by blurb_it. * bpo-38686 review fix: remember why. * fix trailing space in Lib/urllib/request.py Co-Authored-By: Brandt Bucher <brandtbucher@gmail.com>
* Update CODEOWNERS (#17356)Ethan Furman2019-11-221-0/+3
| | | Add Ethan Furman for enum, cgi, and cgitb.
* bpo-38858: new_interpreter() uses pycore_init_import_warnings() (GH-17353)Victor Stinner2019-11-221-14/+11
|
* bpo-38858: new_interpreter() reuses pycore_init_builtins() (GH-17351)Victor Stinner2019-11-224-43/+24
| | | | | | | | | new_interpreter() now calls _PyBuiltin_Init() to create the builtins module and calls _PyImport_FixupBuiltin(), rather than using _PyImport_FindBuiltin(tstate, "builtins"). pycore_init_builtins() is now responsible to initialize intepr->builtins_copy: inline _PyImport_Init() and remove this function.
* bpo-38858: _PyImport_FixupExtensionObject() handles subinterpreters (GH-17350)Victor Stinner2019-11-224-46/+70
| | | | | If _PyImport_FixupExtensionObject() is called from a subinterpreter, leave extensions unchanged and don't copy the module dictionary into def->m_base.m_copy.
* closes bpo-29275: Remove Y2K reference from time module docs (GH-17321)Callum Ward2019-11-221-10/+5
| | | | | | The Y2K reference is not needed as it only points out that Python's use of C standard functions doesn't generally suffer from Y2K issues; the point regarding conventions for conversion of 2-digit years in :func:`strptime` is still valid.
* bpo-38858: Add init_interp_main() subfunction (GH-17347)Victor Stinner2019-11-221-103/+109
| | | | Fix new_interpreter() error handling: undo it all if status is an exception.
* bpo-38858: Add init_set_builtins_open() subfunction (GH-17346)Victor Stinner2019-11-221-18/+50
|
* bpo-38804: Fix REDoS in http.cookiejar (GH-17157)bcaller2019-11-224-6/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The regex http.cookiejar.LOOSE_HTTP_DATE_RE was vulnerable to regular expression denial of service (REDoS). LOOSE_HTTP_DATE_RE.match is called when using http.cookiejar.CookieJar to parse Set-Cookie headers returned by a server. Processing a response from a malicious HTTP server can lead to extreme CPU usage and execution will be blocked for a long time. The regex contained multiple overlapping \s* capture groups. Ignoring the ?-optional capture groups the regex could be simplified to \d+-\w+-\d+(\s*\s*\s*)$ Therefore, a long sequence of spaces can trigger bad performance. Matching a malicious string such as LOOSE_HTTP_DATE_RE.match("1-c-1" + (" " * 2000) + "!") caused catastrophic backtracking. The fix removes ambiguity about which \s* should match a particular space. You can create a malicious server which responds with Set-Cookie headers to attack all python programs which access it e.g. from http.server import BaseHTTPRequestHandler, HTTPServer def make_set_cookie_value(n_spaces): spaces = " " * n_spaces expiry = f"1-c-1{spaces}!" return f"b;Expires={expiry}" class Handler(BaseHTTPRequestHandler): def do_GET(self): self.log_request(204) self.send_response_only(204) # Don't bother sending Server and Date n_spaces = ( int(self.path[1:]) # Can GET e.g. /100 to test shorter sequences if len(self.path) > 1 else 65506 # Max header line length 65536 ) value = make_set_cookie_value(n_spaces) for i in range(99): # Not necessary, but we can have up to 100 header lines self.send_header("Set-Cookie", value) self.end_headers() if __name__ == "__main__": HTTPServer(("", 44020), Handler).serve_forever() This server returns 99 Set-Cookie headers. Each has 65506 spaces. Extracting the cookies will pretty much never complete. Vulnerable client using the example at the bottom of https://docs.python.org/3/library/http.cookiejar.html : import http.cookiejar, urllib.request cj = http.cookiejar.CookieJar() opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj)) r = opener.open("http://localhost:44020/") The popular requests library was also vulnerable without any additional options (as it uses http.cookiejar by default): import requests requests.get("http://localhost:44020/") * Regression test for http.cookiejar REDoS If we regress, this test will take a very long time. * Improve performance of http.cookiejar.ISO_DATE_RE A string like "444444" + (" " * 2000) + "A" could cause poor performance due to the 2 overlapping \s* groups, although this is not as serious as the REDoS in LOOSE_HTTP_DATE_RE was.
* Fix quoted signature of setattrofunc (GH-17251)Alex2019-11-221-1/+1
| | | setattrofunc returns `int`, not `PyObject *`.
* bpo-38866: Remove asyncore from test_pyclbr.py (GH-17316)jacksonriley2019-11-221-1/+1
| | | Co-Authored-By: Kyle Stanley <aeros167@gmail.com>
* bpo-38858: Call _PyUnicode_Fini() in Py_EndInterpreter() (GH-17330)Victor Stinner2019-11-223-22/+25
| | | Py_EndInterpreter() now clears the filesystem codec.
* bpo-36854: Fix refleak in subinterpreter (GH-17331)Victor Stinner2019-11-222-2/+13
| | | | finalize_interp_clear() now explicitly clears the codec registry and then trigger a GC collection to clear all references.
* bpo-38863: Improve is_cgi() in http.server (GH-17312)Siwon Kang2019-11-223-2/+30
| | | | | | | | | | | | | | | | | | | is_cgi() function of http.server library does not currently handle a cgi script if one of the cgi_directories is located at the sub-directory of given path. Since is_cgi() in CGIHTTPRequestHandler class separates given path into (dir, rest) based on the first seen '/', multi-level directories like /sub/dir/cgi-bin/hello.py is divided into head=/sub, rest=dir/cgi-bin/hello.py then check whether '/sub' exists in cgi_directories = [..., '/sub/dir/cgi-bin']. This patch makes the is_cgi() keep expanding dir part to the next '/' then checking if that expanded path exists in the cgi_directories. Signed-off-by: Siwon Kang <kkangshawn@gmail.com> https://bugs.python.org/issue38863
* Defer import of shutil which only needed for help and usage (GH-17334)Raymond Hettinger2019-11-221-3/+3
|
* bpo-38526: Fix zipfile.Path method name to be the correct one (#17317)Claudiu Popa2019-11-211-1/+1
|
* bpo-37838: get_type_hints for wrapped functions with forward reference ↵benedwards142019-11-214-1/+28
| | | | | | (GH-17126) https://bugs.python.org/issue37838
* Correct release version to 3.9 for RERAISE and WITH_EXCEPT_START bytecodes. ↵Mark Shannon2019-11-211-2/+2
| | | | | | | (#17318) bpo-33387 Corrects commit fee5526
* bpo-38692: Skip test_posix.test_pidfd_open() on EPERM (GH-17290)Victor Stinner2019-11-212-0/+5
| | | | | | Skip the test_posix.test_pidfd_open() test if os.pidfd_open() fails with a PermissionError. This situation can happen in a Linux sandbox using a syscall whitelist which doesn't allow the pidfd_open() syscall yet (like systemd-nspawn).
* bpo-38875: test_capi: trashcan tests require cpu resource (GH-17314)Victor Stinner2019-11-212-0/+3
| | | test_capi: trashcan tests now require the test "cpu" resource.
* CODEOWNERS: add myself for asyncore/chat, ftplib and shutil modules (#17313)Giampaolo Rodola2019-11-211-0/+6
|
* Produce cleaner bytecode for 'with' and 'async with' by generating separate ↵Mark Shannon2019-11-2115-4744/+4779
| | | | | | code for normal and exceptional paths. (#6641) Remove BEGIN_FINALLY, END_FINALLY, CALL_FINALLY and POP_FINALLY bytecodes. Implement finally blocks by code duplication. Reimplement frame.lineno setter using line numbers rather than bytecode offsets.
* bpo-38858: Allocate small integers on the heap (GH-17301)Victor Stinner2019-11-211-36/+19
| | | | Allocate small Python integers (small_ints of longobject.c) on the heap, rather than using static objects.
* Update functions.rst (GH-16468)Géry Ogam2019-11-211-2/+2
| | | | | | | This PR will make the following changes to the [_Built-in Functions_](https://docs.python.org/3/library/functions.html) chapter of the library documentation: - improve hyperlinks in Sphinx roles (trailing 's' belong to hyperlinks). Automerge-Triggered-By: @csabella
* bpo-36277: Add document for pdb debug and retval commands (GH-12872)Dave Nguyen2019-11-211-0/+8
| | | | | | | https://bugs.python.org/issue36277 Automerge-Triggered-By: @csabella
* Removed capital letter in parameter in stdtypes.rst (GH-17218)Jules Lasne (jlasne)2019-11-211-1/+1
| | | Automerge-Triggered-By: @csabella
* Fixed an incorrect sentence in the docs (GH-17205)Aveheuzed2019-11-211-2/+1
| | | | | | | | Fixed an incorrect sentence in Doc/c-api/mapping.rst I fell on while translating the file. skip issue Automerge-Triggered-By: @csabella
* bpo-38857: AsyncMock fix for awaitable values and StopIteration fix [3.8] ↵Jason Fried2019-11-215-42/+103
| | | | (GH-17269)
* bpo-38823: Clean up _xxtestfuzz initialization. (GH-17216)Brandt Bucher2019-11-211-6/+1
| | | https://bugs.python.org/issue38823
* bpo-38841: Skip asyncio test_create_datagram_endpoint_existing_sock_unix ↵xdegaye2019-11-202-1/+3
| | | | | | | | | | | | | (GH-17294) on platforms lacking a functional bind() for named unix domain sockets https://bugs.python.org/issue38841 Automerge-Triggered-By: @asvetlov
* bpo-38858: Fix Py_Finalize() when called from a subinterpreter (GH-17297)Victor Stinner2019-11-201-11/+18
| | | | Use _Py_IsMainInterpreter() in Py_Initialize() and Py_Finalize() to detect if the current interpreter is the main interpreter or not.
* bpo-33125: Add support for building and releasing Windows ARM64 packages ↵Steve Dower2019-11-2029-74/+286
| | | | | (GH-16828) Note that the support is not actually enabled yet, and so we won't be publishing these packages. However, for those who want to build it themselves (even by reusing the Azure Pipelines definition), it's now relatively easy to enable.
* Add Python 3.8 to py based search in find_python.bat (GH-17188)Segev Finer2019-11-201-1/+1
|
* bpo-38858: Add _Py_IsMainInterpreter(tstate) (GH-17293)Victor Stinner2019-11-203-3/+11
|
* Update information about publishing a new version to the Microsoft Store ↵Steve Dower2019-11-201-14/+24
| | | | (GH-17262)
* bpo-38821: Fix crash in argparse when using gettext (GH-17192)Federico Bond2019-11-202-2/+4
|
generated by cgit v0.12 at 2025-02-10 13:15:50 (GMT)