summaryrefslogtreecommitdiffstats
path: root/Lib/test/test_xmlrpc.py
Commit message (Collapse)AuthorAgeFilesLines
* [3.8] gh-95778: CVE-2020-10735: Prevent DoS by very large int() (#96503)Gregory P. Smith2022-09-051-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Correctly pre-check for int-to-str conversion Converting a large enough `int` to a decimal string raises `ValueError` as expected. However, the raise comes _after_ the quadratic-time base-conversion algorithm has run to completion. For effective DOS prevention, we need some kind of check before entering the quadratic-time loop. Oops! =) The quick fix: essentially we catch _most_ values that exceed the threshold up front. Those that slip through will still be on the small side (read: sufficiently fast), and will get caught by the existing check so that the limit remains exact. The justification for the current check. The C code check is: ```c max_str_digits / (3 * PyLong_SHIFT) <= (size_a - 11) / 10 ``` In GitHub markdown math-speak, writing $M$ for `max_str_digits`, $L$ for `PyLong_SHIFT` and $s$ for `size_a`, that check is: $$\left\lfloor\frac{M}{3L}\right\rfloor \le \left\lfloor\frac{s - 11}{10}\right\rfloor$$ From this it follows that $$\frac{M}{3L} < \frac{s-1}{10}$$ hence that $$\frac{L(s-1)}{M} > \frac{10}{3} > \log_2(10).$$ So $$2^{L(s-1)} > 10^M.$$ But our input integer $a$ satisfies $|a| \ge 2^{L(s-1)}$, so $|a|$ is larger than $10^M$. This shows that we don't accidentally capture anything _below_ the intended limit in the check. <!-- gh-issue-number: gh-95778 --> * Issue: gh-95778 <!-- /gh-issue-number --> Co-authored-by: Gregory P. Smith [Google LLC] <greg@krypto.org> Co-authored-by: Christian Heimes <christian@python.org> Co-authored-by: Mark Dickinson <dickinsm@gmail.com>
* bpo-30458: Disallow control chars in http URLs. (GH-12755)Gregory P. Smith2019-05-011-2/+7
| | | Disallow control chars in http URLs in urllib.urlopen. This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected.
* bpo-22831: Use "with" to avoid possible fd leaks in tests (part 2). (GH-10929)Serhiy Storchaka2019-03-051-7/+5
|
* bpo-35153: Add headers parameter to xmlrpc.client.ServerProxy (GH-10308)Cédric Krier2019-02-191-1/+62
| | | Allow to add HTTP headers to XML-RPC requests sent to the server.
* bpo-18799: Resurrect test_404 in test_xmlrpc. (GH-11196)Vajrasky Kok2018-12-171-3/+2
|
* bpo-33759: Fix test.test_xmlrpc.ServerProxyTestCase. (GH-7362)Serhiy Storchaka2018-06-041-1/+3
| | | It depended on a global variable set by other tests.
* Trivial cleanups following bpo-31370 (#3649)Antoine Pitrou2017-09-181-7/+1
| | | | | | * Trivial cleanups following bpo-31370 * Also cleanup the "importlib._bootstrap_external" module
* bpo-31234: Join threads in tests (#3572)Victor Stinner2017-09-141-2/+6
| | | | Call thread.join() on threads to prevent the "dangling threads" warning.
* bpo-31370: Remove support for threads-less builds (#3385)Antoine Pitrou2017-09-071-7/+1
| | | | | | * Remove Setup.config * Always define WITH_THREAD for compatibility.
* Stop test_xmlrpc from writing to sys.stderr (#3359)Christian Heimes2017-09-061-0/+4
| | | | | | | | One test case of test_xmlrpc uses HTTPServer with a subclass of BaseHTTPRequestHandler. The BaseRequestHandler class logs to sys.stderr by default. Override log_message() to not clobber test output. Signed-off-by: Christian Heimes <christian@python.org>
* Change assertRaises to assertRaisesRegex in test_xmlrpc (#481)Dillon Brock2017-03-051-3/+3
|
* bpo-29615: SimpleXMLRPCDispatcher no longer chains KeyError (#260)Petr Motejlek2017-03-011-1/+89
| | | | (or any other exception) to exception(s) raised in the dispatched methods. Patch by Petr Motejlek.
* bpo-7769: enable xmlrpc.server.SimpleXMLRPCDispatcher.register_function used ↵Xiang Zhang2017-02-281-6/+7
| | | | as decorator (GH-231)
* Issue #26885: xmlrpc now supports unmarshalling additional data types usedSerhiy Storchaka2016-09-111-0/+49
| | | | by Apache XML-RPC implementation for numerics and None.
* #27364: fix "incorrect" uses of escape character in the stdlib.R David Murray2016-09-081-1/+1
| | | | | | | And most of the tools. Patch by Emanual Barry, reviewed by me, Serhiy Storchaka, and Martin Panter.
* Backed out changeset af29d89083b3 (closes #25548) (closes #27498)Benjamin Peterson2016-07-141-2/+2
|
* Issue #25548: Showing memory address of class objects in replKushal Das2016-06-041-2/+2
|
* Issue #26873: xmlrpc now raises ResponseError on unsupported type tagsSerhiy Storchaka2016-05-041-0/+14
|\ | | | | | | instead of silently return incorrect result.
| * Issue #26873: xmlrpc now raises ResponseError on unsupported type tagsSerhiy Storchaka2016-05-041-0/+14
| | | | | | | | instead of silently return incorrect result.
* | Issue #23277: Remove unused imports in tests.Serhiy Storchaka2016-04-241-1/+0
| |
* | Issue #23277: Remove more unused sys and os imports.Serhiy Storchaka2016-04-241-1/+0
|/
* Issue #26402: Fix XML-RPC client retrying after server disconnectionMartin Panter2016-02-251-0/+37
| | | | | This is a regression introduced in 3.5 by revision eba80326ba53. Fix by Jelte Fennema, test case by me.
* Issue #26147: xmlrpc now works with strings not encodable with usedSerhiy Storchaka2016-01-201-6/+24
| | | | non-UTF-8 encoding.
* Issue #9006: Added tests for XML RPC with non-UTF-8 encoding.Serhiy Storchaka2016-01-181-3/+53
|
* Use assertRaisesRegex instead of deprecated assertRaisesRegexp.Serhiy Storchaka2015-04-101-1/+1
|\
| * Use assertRaisesRegex instead of deprecated assertRaisesRegexp.Serhiy Storchaka2015-04-101-2/+2
| |
* | Stop using a deprecated unittest.TestCase method.Brett Cannon2014-12-121-1/+1
| |
* | merge 3.4 (#16043)Benjamin Peterson2014-12-061-2/+23
|\ \ | |/
| * merge 3.3 (#16043)Benjamin Peterson2014-12-061-2/+23
| |\
| | * merge 3.2 (#16043)Benjamin Peterson2014-12-061-1/+22
| | |\
| | | * add a default limit for the amount of data xmlrpclib.gzip_decode will return ↵Benjamin Peterson2014-12-061-1/+22
| | | | | | | | | | | | | | | | (closes #16043)
* | | | Removed duplicated words in in comments and docs.Serhiy Storchaka2014-12-011-1/+1
|\ \ \ \ | |/ / /
| * | | Removed duplicated words in in comments and docs.Serhiy Storchaka2014-12-011-1/+1
| | | |
* | | | Issue #22031: Reprs now always use hexadecimal format with the "0x" prefixSerhiy Storchaka2014-07-221-1/+1
| | | | | | | | | | | | | | | | when contain an id in form " at 0x...".
* | | | Issue #20627: xmlrpc.client.ServerProxy is now a context manager.Brett Cannon2014-03-211-0/+18
|/ / / | | | | | | | | | Patch by Claudiu Popa.
* | | #19192: Give up on time.xmlrpc.com as an xmlrpc network test.R David Murray2013-10-111-2/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | time.xmlrpc.com has come and gone over the years, and has been gone again for a while. The test did test one thing that the current xmlrpc tests don't: the use of multiple levels of attribute names in the call. So in addition to removing the network test, we add a test in xmlrpc of dotted name access. There should also be a test for when dotted name access is disallowed, but that requires more extensive test harness refactoring, and in any case was not tested by the network test we are deleting, since it is a server-side setting. This is a slightly simplified version of a patch by Vajrasky Kok.
* | | #18453: merge with 3.3.Ezio Melotti2013-08-101-2/+10
|\ \ \ | |/ /
| * | #18453: fix unused variables in test_xmlrpc. Patch by Vajrasky Kok.Ezio Melotti2013-08-101-2/+10
| | |
* | | Issue #15767: Excise the remaining instances of ModuleNotFoundErrorBrett Cannon2013-07-041-2/+2
| | |
* | | Partially revert changeset #281857369a78 to make sure threads areBrett Cannon2013-06-131-1/+11
| | | | | | | | | | | | reaped in all situations.
* | | Spruce up test_xmlrpc by using ModuleNotFoundError and moving toBrett Cannon2013-06-131-22/+7
| | | | | | | | | | | | unittest.main().
* | | Issue #16717: get rid of socket.error, replace with OSErrorAndrew Svetlov2012-12-181-14/+14
|/ /
* | Add tests to marshall double with xmlrpc.client.Florent Xicluna2012-07-071-0/+16
| |
* | Issue #14001: CVE-2012-0845: xmlrpc: Fix an endless loop in SimpleXMLRPCServerCharles-François Natali2012-02-181-6/+8
|\ \ | |/ | | | | upon malformed POST request.
| * Issue #14001: CVE-2012-0845: xmlrpc: Fix an endless loop in SimpleXMLRPCServerCharles-François Natali2012-02-181-6/+8
| |\ | | | | | | | | | upon malformed POST request.
| | * Merged revisions 86596 via svnmerge fromEzio Melotti2010-11-211-13/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | svn+ssh://pythondev@svn.python.org/python/branches/py3k ........ r86596 | ezio.melotti | 2010-11-20 21:04:17 +0200 (Sat, 20 Nov 2010) | 1 line #9424: Replace deprecated assert* methods in the Python test suite. ........
| | * Merged revisions 86533 via svnmerge fromAntoine Pitrou2010-11-191-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | svn+ssh://pythondev@svn.python.org/python/branches/py3k ........ r86533 | antoine.pitrou | 2010-11-19 21:07:52 +0100 (ven., 19 nov. 2010) | 3 lines Fix test_ssl_presence when ssl is not present ........
| | * Merged revisions 86523 via svnmerge fromSenthil Kumaran2010-11-181-21/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | svn+ssh://pythondev@svn.python.org/python/branches/py3k ........ r86523 | senthil.kumaran | 2010-11-19 01:08:48 +0800 (Fri, 19 Nov 2010) | 3 lines Code Changes as per review comments by Antoine Pitrou. ........
| | * Merged revisions 86514 via svnmerge fromSenthil Kumaran2010-11-181-0/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | svn+ssh://pythondev@svn.python.org/python/branches/py3k ........ r86514 | senthil.kumaran | 2010-11-18 23:00:53 +0800 (Thu, 18 Nov 2010) | 3 lines Fix Issue 9991: xmlrpc client ssl check faulty ........
| | * Merged revisions 73715 via svnmerge fromGeorg Brandl2009-08-131-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | svn+ssh://svn.python.org/python/branches/py3k ........ r73715 | benjamin.peterson | 2009-07-01 01:06:06 +0200 (Mi, 01 Jul 2009) | 1 line convert old fail* assertions to assert* ........
generated by cgit v0.12 at 2025-12-27 19:42:13 (GMT)