summaryrefslogtreecommitdiffstats
path: root/Doc
Commit message (Collapse)AuthorAgeFilesLines
* [3.8] gh-95778: CVE-2020-10735: Prevent DoS by very large int() (#96503)Gregory P. Smith2022-09-058-14/+265
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Correctly pre-check for int-to-str conversion Converting a large enough `int` to a decimal string raises `ValueError` as expected. However, the raise comes _after_ the quadratic-time base-conversion algorithm has run to completion. For effective DOS prevention, we need some kind of check before entering the quadratic-time loop. Oops! =) The quick fix: essentially we catch _most_ values that exceed the threshold up front. Those that slip through will still be on the small side (read: sufficiently fast), and will get caught by the existing check so that the limit remains exact. The justification for the current check. The C code check is: ```c max_str_digits / (3 * PyLong_SHIFT) <= (size_a - 11) / 10 ``` In GitHub markdown math-speak, writing $M$ for `max_str_digits`, $L$ for `PyLong_SHIFT` and $s$ for `size_a`, that check is: $$\left\lfloor\frac{M}{3L}\right\rfloor \le \left\lfloor\frac{s - 11}{10}\right\rfloor$$ From this it follows that $$\frac{M}{3L} < \frac{s-1}{10}$$ hence that $$\frac{L(s-1)}{M} > \frac{10}{3} > \log_2(10).$$ So $$2^{L(s-1)} > 10^M.$$ But our input integer $a$ satisfies $|a| \ge 2^{L(s-1)}$, so $|a|$ is larger than $10^M$. This shows that we don't accidentally capture anything _below_ the intended limit in the check. <!-- gh-issue-number: gh-95778 --> * Issue: gh-95778 <!-- /gh-issue-number --> Co-authored-by: Gregory P. Smith [Google LLC] <greg@krypto.org> Co-authored-by: Christian Heimes <christian@python.org> Co-authored-by: Mark Dickinson <dickinsm@gmail.com>
* [3.8] gh-90359: Update documentation to follow PEP 495. (gh-94800). (GH-94834)Dong-hee Na2022-07-281-0/+14
| | | | | (cherry picked from commit 07374cce52abb7fd39729dc1b646ca3029b64c64) Co-authored-by: Dong-hee Na <donghee.na@python.org>
* [3.8] gh-81054: Document that SimpleHTTPRequestHandler follows symbolic ↵Łukasz Langa2022-07-011-1/+12
| | | | | | | links (GH-94416) (GH-94495) (cherry picked from commit 80aaeabb8bd1e6b49598a7e23e0f8d99b3fcecaf) Co-authored-by: Sam Ezeh <sam.z.ezeh@gmail.com>
* gh-83728: Add hmac.new default parameter deprecation (GH-91939) (GH-93547)Miss Islington (bot)2022-06-061-0/+2
| | | | | (cherry picked from commit 56b5daf15970be449d44e91f08db84c698ac5506) Co-authored-by: Stanley <46876382+slateny@users.noreply.github.com>
* [3.8] gh-92448: Update the documentation builder to render the GitHub… ↵Dong-hee Na2022-05-121-4/+5
| | | | | | | | (GH-92605) (cherry picked from commit 45e1721d100bab09510ccf9da49f14ca5cc268f4) Co-authored-by: Dong-hee Na <donghee.na@python.org>
* Add redirects to Misc/NEWS bpo links (GH-91454) (#91895)Miss Islington (bot)2022-05-101-1/+2
| | | | | | | (cherry picked from commit 17dbb6bc10ca8a8b602335414c047294f00afcbe) Co-authored-by: Ezio Melotti <ezio.melotti@gmail.com> Co-authored-by: Ezio Melotti <ezio.melotti@gmail.com>
* [3.8] gh-91888: add a `:gh:` role to the documentation (GH-91889) (#91936)Ezio Melotti2022-05-101-1/+25
| | | | | | | | | | | | | | | | | | | | * gh-91888: Add a :gh: role to the documentation (GH-91889). * [3.8] gh-91888: add a `:gh:` role to the documentation (GH-91889) * Add a new :gh:`...` role for GitHub issues. * Fix a GitHub id to use the :gh: role. * Add Misc/NEWS entry. * Refactoring and rephrasing. Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com>. (cherry picked from commit f7641a2ffec243e5f600028a84debe9028a9ee44) Co-authored-by: Ezio Melotti <ezio.melotti@gmail.com> * Fix use of the default role in NEWS entry
* bpo-47138: Ensure Windows docs build uses the same pinned version as other ↵Steve Dower2022-05-091-1/+2
| | | | | platforms (GH-32161) (#32183) Co-authored-by: Ned Deily <nad@python.org>
* [3.8] bpo-47138: Fix documentation build by pinning Jinja version to 3.0.3 ↵m-aciek2022-04-081-0/+2
| | | | | (GH-32109) Co-authored-by: Ned Deily <nad@python.org>
* bpo-31327: Update time documentation to reflect possible errors (GH-31460) ↵Miss Islington (bot)2022-03-161-0/+6
| | | | | | | | | | | | | | | | | | | | (GH-31827) As per the comments, this mirrors the [datetime documentation](https://docs.python.org/3/library/datetime.htmlGH-datetime.datetime.fromtimestamp). ``` >>> import time >>> time.localtime(999999999999999999999) Traceback (most recent call last): File "<stdin>", line 1, in <module> OverflowError: timestamp out of range for platform time_t >>> time.localtime(-3600) Traceback (most recent call last): File "<stdin>", line 1, in <module> OSError: [Errno 22] Invalid argument ``` (cherry picked from commit c83fc9c02c9846ec3a2d0123999c98e02f00b3f5) Co-authored-by: slateny <46876382+slateny@users.noreply.github.com>
* Update copyright year to 2022. (GH-30335) (GH-31478)Miss Islington (bot)2022-03-082-2/+2
| | | | | | Automerge-Triggered-By: GH:benjaminp (cherry picked from commit ba00f0d93a4aea85ae8089f139856a7c450584d7) Co-authored-by: Benjamin Peterson <benjamin@python.org>
* bpo-41028: Doc: Move switchers to docsbuild-scripts. (GH-20969) (GH-30344)Miss Islington (bot)2022-02-175-173/+14
| | | | | (cherry picked from commit ee2549c2ba8bae00f2b2fea8a39c6dfbd1d06520) Co-authored-by: Julien Palard <julien@palard.fr>
* bpo-45792: Fix contextvar.Token's intersphinx FQN (GH-29533) (GH-29537)Miss Islington (bot)2021-11-161-1/+1
| | | | | | Since `.. module:: contextvars` sets the module using `.. class:: contextvars.Token`, intersphinx records it as `contextvars.contextvars.Token`. (cherry picked from commit e501d70b347c5093018d12482c30a7a98aab86d0) Co-authored-by: Hynek Schlawack <hs@ox.cx>
* bpo-45583: Correct datamodel documentation of int() (GH-29182) (GH-29287)Miss Islington (bot)2021-10-281-2/+2
| | | | | | | It should be noted that this part of the documentation is redundant with function.rst's documentation of int. This one was correctly updated with Python 3.8. (cherry picked from commit d9c1868c25ec6466e8d8ae21fe9315a8a03836ab) Co-authored-by: Arthur Milchior <arthur@milchior.fr>
* [3.9] bpo-45618: Fix documentation build by pinning Docutils version to ↵Ned Deily2021-10-281-0/+4
| | | | | | | 0.17.1 (GH-29230) (GH-29241) (GH-29245) Co-authored-by: Maciej Olko <maciej.olko@yougov.com> Co-authored-by: Erlend Egeberg Aasland <erlend.aasland@innova.no>
* [docs] Update documentation for `multiprocessing.get_start_method` ↵Miss Islington (bot)2021-09-231-1/+7
| | | | | | | (GH-18170) (GH-28535) (cherry picked from commit af90b5498b8c6acd67b50fdad007d26dfd1c5823) Co-authored-by: Sam Sneddon <me@gsnedders.com>
* bpo-45104: Clarify when __init__ is called (GH-28210) (GH-28213)Miss Islington (bot)2021-09-071-1/+1
| | | | | (cherry picked from commit fa15df77f02ba4a66ba0b71989381a426038be01) Co-authored-by: Raymond Hettinger <rhettinger@users.noreply.github.com>
* bpo-44394: Update libexpat copy to 2.4.1 (GH-26945) (GH-28033)Miss Islington (bot)2021-08-291-14/+18
| | | | | | | | | | Update the vendored copy of libexpat to 2.4.1 (from 2.2.8) to get the fix for the CVE-2013-0340 "Billion Laughs" vulnerability. This copy is most used on Windows and macOS. Co-authored-by: Łukasz Langa <lukasz@langa.pl> (cherry picked from commit 3fc5d84046ddbd66abac5b598956ea34605a4e5d) Co-authored-by: Victor Stinner <vstinner@python.org>
* [3.8] bpo-36384: [doc] Correct typos in CVE-2021-29921 fix description ↵Łukasz Langa2021-08-191-1/+1
| | | | (GH-27825)
* [3.8] bpo-36384: Leading zeros in IPv4 addresses are no longer tolerated ↵achraf-mer2021-08-172-2/+29
| | | | | | | | | | | | (GH-25099) (GH-27801) Reverts commit e653d4d8e820a7a004ad399530af0135b45db27a and makes parsing even more strict. Like socket.inet_pton() any leading zero is now treated as invalid input. Signed-off-by: Christian Heimes <christian@python.org> Co-authored-by: Łukasz Langa <lukasz@langa.pl>
* Spell out 's.pop() or s.pop(i)' (GH-27398) (GH-27414)Miss Islington (bot)2021-07-281-1/+1
| | | | | (cherry picked from commit 2ff5bb4908975976031ba738866de619cafadc4d) Co-authored-by: Dennis Sweeney <36520290+sweeneyde@users.noreply.github.com>
* bpo-30511: Add note on thread safety to shutil.make_archive() (GH-26933) ↵Miss Islington (bot)2021-07-211-0/+4
| | | | | | | | (#27276) Co-authored-by: Łukasz Langa <lukasz@langa.pl> (cherry picked from commit 64f54b7ccd49764b0304e076bfd79b5482988f53) Co-authored-by: andrei kulakov <andrei.avk@gmail.com>
* [3.8] bpo-43882 - Mention urllib.parse changes in Whats new section. (#26277)Senthil Kumaran2021-06-281-0/+12
|
* [3.8] bpo-43882 - urllib.parse should sanitize urls containing ASCII newline ↵Miss Islington (bot)2021-05-051-0/+13
| | | | | | | | | and tabs. (GH-25595) (#25726) Co-authored-by: Gregory P. Smith <greg@krypto.org> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> (cherry picked from commit 76cd81d60310d65d01f9d7b48a8985d8ab89c8b4) Co-authored-by: Senthil Kumaran <senthil@uthcode.com> Co-authored-by: Senthil Kumaran <skumaran@gatech.edu>
* bpo-42800: Add audit events for f_code and tb_frame (GH-24182)Miss Islington (bot)2021-05-033-1/+10
| | | | | | | | | | | Accessing the following attributes will now fire PEP 578 style audit hooks as (object.__getattr__, obj, name): * PyTracebackObject: tb_frame * PyFrameObject: f_code * PyGenObject: gi_code, gi_frame * PyCoroObject: cr_code, cr_frame * PyAsyncGenObject: ag_code, ag_frame (cherry picked from commit bb2f3ff7a8f0c3565ccc1946dba7e09a3f7dc209) Co-authored-by: Steve Dower <steve.dower@python.org>
* [3.8] bpo-41100: Support macOS 11 Big Sur and Apple Silicon Macs (#25806)Ned Deily2021-05-021-0/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * bpo-41100: Support macOS 11 and Apple Silicon on Python 3.8 This is a partial backport of bpo-41100 changes `e8b1c038b14b5fc8120aab62c9bf5fb840274cb6` and `96d906b144e6e6aa96c5ffebecbcc5d38034bbda` for Python 3.8. We introduce the ability to build Python from source for `arm64` on macOS, but we do not make a promise of support. This allows us to omit support for Universal2 binaries as well as weak-linking of symbols from the macOS SDK based on the deployment target, which are larger changes much more difficult to merge. This also includes a backport of subsequent bpo-42688 change `7e729978fa08a360cbf936dc215ba7dd25a06a08` to fix build errors with external `libffi`. * bpo-41116: Ensure system supplied libraries are found on macOS 11 (GH-23301) (GH-23455) On macOS system provided libraries are in a shared library cache and not at their usual location. This PR teaches distutils to search in the SDK, even if there was no "-sysroot" argument in the compiler flags. (cherry picked from commit 404a719b5127602c1a948f8e189ab61cd3f147d8) * bpo-42504: fix for MACOSX_DEPLOYMENT_TARGET=11 (GH-23556) macOS releases numbering has changed as of macOS 11 Big Sur. Previously, major releases were of the form 10.x, 10.x+1, 10.x+2, etc; as of Big Sur, they are now x, x+1, etc, so, for example, 10.15, 10.15.1, ..., 10.15.7, 11, 11.0.1, 11.1, ..., 12, 12.1, etc. Allow Python to build with single-digit deployment target values. Patch provided by FX Coudert. (cherry picked from commit 5291639e611dc3f55a34666036f2c3424648ba50) * bpo-42504: Ensure that get_config_var('MACOSX_DEPLOYMENT_TARGET') is a string (GH-24341) (GH-24410) * bpo-42504: Ensure that get_config_var('MACOSX_DEPLOYMENT_TARGET') is a string (cherry picked from commit 49926cf2bcc8b44d9b8f148d81979ada191dd9d5) Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com> Co-authored-by: FX Coudert <fxcoudert@gmail.com> Co-authored-by: Max Bélanger <aeromax@gmail.com>
* Fix exceptions mentioned in os.setxattr() docs (GH-25742) (GH-25795)Miss Islington (bot)2021-05-011-2/+2
| | | | | | | (cherry picked from commit 779232413a367cd3357482e675a5518de102a90e) Co-authored-by: Shreyash Sharma <shreyash.sharma@philips.com> Co-authored-by: Shreyash Sharma <shreyash.sharma@philips.com>
* Fixing doc for callback for lambda (GH-25779) (GH-25789)Miss Islington (bot)2021-05-011-1/+1
| | | | | | | | Fixing callback for lambda when no return value is provided (cherry picked from commit 50c21ad35372983680b44130be560d856c5f27ca) Co-authored-by: Shreyash Sharma <shreyash.sharma@philips.com> Co-authored-by: Shreyash Sharma <shreyash.sharma@philips.com>
* bpo-43971: Add spaces around annotated arg default '=' (GH-25702)Miss Islington (bot)2021-05-011-1/+1
| | | | | | | | Result: "quantity_on_hand: int = 0". (cherry picked from commit e726a902b7c73a7056b7421d801e47ffff255873) Co-authored-by: Mohamed Moselhy <look4d@gmail.com> Co-authored-by: Mohamed Moselhy <look4d@gmail.com>
* [3.8] bpo-42589: Change URL for 'from' link when used in a raised exc… ↵sblondon2021-04-301-2/+2
| | | | | | | | | | | | | | | | | (GH-25755) …eption (GH-23872) Links for 'raise Exception from x' target to 'The raise statement' (7.8) section instead of 'The import statement' (7.11) section. There are more modified links than in the bug report because I searched some other ones which can get the same improvement.. (cherry picked from commit 2fd928c8c1328424130cb9c51fc02ad5f9a66328) This PR is a cherry pick to python 3.8 from https://github.com/python/cpython/pull/23872. The fix was the removal of the change in the other file because the fixed section was introduced in 3.9. So the file does not need to be fixed in 3.8. Co-authored-by: sblondon <sblondon@users.noreply.github.com> Automerge-Triggered-By: GH:Mariatta
* [doc] Be more clear on super() regarding multiple base classes methods ↵Miss Islington (bot)2021-04-291-1/+1
| | | | | | | | | (GH-21789) (GH-25707) (cherry picked from commit 69a733bda34d413d3ad545ef3132240e5d2a7c0c) Co-authored-by: Andre Delfino <adelfino@gmail.com> Co-authored-by: Andre Delfino <adelfino@gmail.com>
* [doc] Do some polishing in IDEs section (GH-22070) (GH-25704)Miss Islington (bot)2021-04-291-12/+12
| | | | | | | (cherry picked from commit 08a4803863856db47a1dde830e56f83e5c6811a2) Co-authored-by: Andre Delfino <adelfino@gmail.com> Co-authored-by: Andre Delfino <adelfino@gmail.com>
* bpo-43959: clarify the documentation of the PyContextVar C-API (GH-25671) ↵Miss Islington (bot)2021-04-281-7/+6
| | | | | (GH-25690) (cherry picked from commit 4c49be766897968e509c41397e0e624c25b1675d)
* [doc] Remove duplicated operator.itemgetter example (GH-24178) (#25647)Miss Islington (bot)2021-04-271-5/+2
| | | | | | | * Remove duplicated itemgetter example * Add spaces (cherry picked from commit 743e2bae10d2010fd1e29b772c9da64efc7c9c47) Co-authored-by: Andre Delfino <adelfino@gmail.com>
* Use the zero argument form of super() in examples for Python3 docs. ↵Miss Islington (bot)2021-04-266-12/+12
| | | | | | | (GH-22314) (GH-25639) (cherry picked from commit 52cd6d5e1b2bece0d8efb58b1af41071c914ebe6) Co-authored-by: Andre Delfino <adelfino@gmail.com>
* [3.8] bpo-28577: Special case added to IP v4 and v6 hosts for /32 and /128 ↵Pete Wicken2021-04-261-1/+6
| | | | | | | | networks (GH-18757) (#25536) The `.hosts()` method now returns the single address present in a /32 or /128 network.. (cherry picked from commit 8e9c47a947954c997d4b725f4551d50a1d896722) Co-authored-by: Pete Wicken <2273100+JamoBox@users.noreply.github.com>
* bpo-41661: Document os.path.relpath() exception on Windows with different ↵Miss Islington (bot)2021-04-261-1/+2
| | | | | | | drives (GH-25346) (#25367) (cherry picked from commit 67c0b3d89c4da9750fdb43fc66d3924681b22d2e) Co-authored-by: Zackery Spytz <zspytz@gmail.com>
* bpo-17305: Link to the third-party idna package. (GH-25208) (#25211)Miss Islington (bot)2021-04-261-0/+3
| | | | | | So long as we don't have idna2008 in the standard library, we should at least point people to the third-party solution. (cherry picked from commit 1d023e374cf96d143b065242131ddc9b889f9a1e) Co-authored-by: Gregory P. Smith <greg@krypto.org>
* bpo-43938: improve dataclasses.FrozenInstanceError documentation (GH-25603) ↵Miss Islington (bot)2021-04-261-1/+1
| | | | | | | | | (GH-25636) (cherry picked from commit 8a307e488d596914a7a5df6b2fdd945f8ce81e69) Co-authored-by: Llandy Riveron Del Risco <llandy3d@gmail.com> Co-authored-by: Llandy Riveron Del Risco <llandy3d@gmail.com>
* Doc: Fix the array.fromfile method doc (GH-22037) (GH-25631)Miss Islington (bot)2021-04-261-2/+1
| | | | | | | | | | | | The check about the f argument type was removed in this commit: https://github.com/python/cpython/commit/2c94aa567e525c82041ad68a3174d8c3acbf37e2 Thanks for Pedro Arthur Duarte (pedroarthur.jedi at gmail.com) by the help with this bug. (cherry picked from commit bd25bcd37a3a41a0e08208e969f0c02287850c61) Co-authored-by: Adorilson Bezerra <adorilson@gmail.com> Co-authored-by: Adorilson Bezerra <adorilson@gmail.com>
* Update asyncio-subprocess.rst (GH-21680) (GH-25622)Miss Islington (bot)2021-04-261-1/+1
| | | | | (cherry picked from commit 3c4850e222388889426e250ff43308e4802dc582) Co-authored-by: Gabriel R F <github@gabrf.com>
* documentation: clarification about the function remove in os library ↵Miss Islington (bot)2021-04-261-0/+1
| | | | | | | (GH-19024) (GH-25618) (cherry picked from commit b6daab2f676de1773d8f35fb362fe4c57449301d) Co-authored-by: Etienne Gautier <etienne.gautier@outlook.com>
* Fix broken links and improve stand-alone tools list in FAQ GH-25610Miss Islington (bot)2021-04-263-10/+9
| | | | | (cherry picked from commit d28b34695301ec99a9334ad8d69b6092f4f703d5) Co-authored-by: Andre Delfino <adelfino@gmail.com>
* Fix id of 'Internet Message Format' RFC in email doc GH-25614Miss Islington (bot)2021-04-262-2/+2
| | | | | | | | | | | | | Previous ID (5233) refers to "Sieve Email Filtering: Subaddress Extension". It seems that the actual reference should be "Internet Message Format" RFC 5322 (https://tools.ietf.org/html/rfc5322). (The typo probably comes from commit 29d1bc0842 in which the ID of this RFC got updated from the obsolete 2822.) Co-authored-by: Ambrose Chua <ambrose@hey.com> (cherry picked from commit cb5c802dcf8851663c4eac5d73f968f626a3a1dc) Co-authored-by: Denis Laxalde <denis@laxalde.org>
* Fix copy.Error casing in documentation GH-22004 (#25612)Miss Islington (bot)2021-04-261-1/+1
| | | | | (cherry picked from commit 0d930f108cb8ba66f54197175c1fba0c38253e4a) Co-authored-by: Andre Delfino <adelfino@gmail.com>
* Remove mention of dst parameter from description of os.lstat() (GH-24704)Miss Islington (bot)2021-04-251-1/+1
| | | | | | | It looks like it was accidentally copy-pasted in 6fa7aada9bd3616e0beeb266e818497b2ec1c859. (cherry picked from commit 7f8e072c6dc88d6973d81f8fd572c04c88e7e3d7) Co-authored-by: Sergey Fedoseev <fedoseev.sergey@gmail.com>
* Fix a typo in datamodel reference document (GH-24930)Miss Islington (bot)2021-04-251-1/+1
| | | | | (cherry picked from commit a1a5e3c4c83c3e3fe24c96ae22dfdedc7e23a1bb) Co-authored-by: Géry Ogam <gery.ogam@gmail.com>
* BaseHTTPRequestHandler, that path includes query (GH-25597)Miss Islington (bot)2021-04-251-1/+3
| | | | | | | | * Clarify, for BaseHTTPRequestHandler, that path includes query Co-authored-by: David Jones <drj@pobox.com> (cherry picked from commit a89d8a94a0dd0bd45349efad6d5ad68641f4ff9a) Co-authored-by: Senthil Kumaran <senthil@uthcode.com>
* bpo-43856: Add a versionadded directive to the importlib.metadata docs ↵Jason R. Coombs2021-04-231-0/+2
| | | | | | | | | | | (GH-25445) Use a versionadded directive to generate the text "New in version 3.8." (to match with the documentation of other modules). Automerge-Triggered-By: GH:jaraco (cherry picked from commit adf24bd835) Co-authored-by: Zackery Spytz <zspytz@gmail.com>
* bpo-43284: Update platform.win32_ver to use _syscmd_ver instead of ↵Miss Islington (bot)2021-04-221-1/+6
| | | | | | | | | | sys.getwindowsversion() (GH-25500) The sys module uses the kernel32.dll version number, which can vary from the "actual" Windows version. Since the best option for getting the version is WMI (which is expensive), we switch back to launching cmd.exe (which is also expensive, but a lot less code on our part). sys.getwindowsversion() is not updated to avoid launching executables from that module. (cherry picked from commit 2a3f4899c63806439e5bcea0c30f7e6a6295a763) Co-authored-by: Shreyan Avigyan <shreyan.avigyan@gmail.com>
generated by cgit v0.12 at 2025-04-10 09:03:03 (GMT)