summaryrefslogtreecommitdiffstats
path: root/Lib/test
Commit message (Collapse)AuthorAgeFilesLines
* 00351-cve-2019-20907-fix-infinite-loop-in-tarfile.patchfedora-2.7.18-5Rishi2020-09-292-0/+7
| | | | | | | 00351 # Avoid infinite loop when reading specially crafted TAR files using the tarfile module (CVE-2019-20907). See: https://bugs.python.org/issue39017
* 00191-disable-NOOP.patchFedora Python maintainers2020-09-291-0/+1
| | | | | 00191 # Disabling NOOP test as it fails without internet connection
* 00170-gc-assertions.patchFedora Python maintainers2020-09-291-1/+47
| | | | | | | | | | | | 00170 # In debug builds, try to print repr() when a C-level assert fails in the garbage collector (typically indicating a reference-counting error somewhere else e.g in an extension module) Backported to 2.7 from a patch I sent upstream for py3k http://bugs.python.org/issue9263 (rhbz#614680) hiding the proposed new macros/functions within gcmodule.c to avoid exposing them within the extension API. (rhbz#850013)
* 00167-disable-stack-navigation-tests-when-optimized-in-test_gdb.patchFedora Python maintainers2020-09-291-11/+3
| | | | | | | | | | 00167 # Don't run any of the stack navigation tests in test_gdb when Python is optimized, since there appear to be many different ways in which gdb can fail to read the PyFrameObject* for arbitrary places in the callstack, presumably due to compiler optimization (rhbz#912025) Not yet sent upstream
* 00165-crypt-module-salt-backport.patchFedora Python maintainers2020-09-291-0/+19
| | | | | | | | | | 00165 # Backport to Python 2 from Python 3.3 of improvements to the "crypt" module adding precanned ways of salting a password (rhbz#835021) Based on r88500 patch to py3k from Python 3.3 plus 6482dd1c11ed, 0586c699d467, 62994662676a, 74a1110a3b50, plus edits to docstrings to note that this additional functionality is not standard within 2.7
* 00156-gdb-autoload-safepath.patchFedora Python maintainers2020-09-291-1/+26
| | | | | | | | 00156 # Recent builds of gdb will only auto-load scripts from certain safe locations. Turn off this protection when running test_gdb in the selftest suite to ensure that it can load our -gdb.py script (rhbz#817072): Not yet sent upstream
* 00147-add-debug-malloc-stats.patchFedora Python maintainers2020-09-291-0/+26
| | | | | | | 00147 # Add a sys._debugmallocstats() function Based on patch 202 from RHEL 5's python.spec, with updates from rhbz#737198 Sent upstream as http://bugs.python.org/issue14785
* 00146-hashlib-fips.patchFedora Python maintainers2020-09-291-44/+88
| | | | | | | | | | | | | | | | | | | 00146 # Support OpenSSL FIPS mode (e.g. when OPENSSL_FORCE_FIPS_MODE=1 is set) - handle failures from OpenSSL (e.g. on attempts to use MD5 in a FIPS-enforcing environment) - add a new "usedforsecurity" keyword argument to the various digest algorithms in hashlib so that you can whitelist a callsite with "usedforsecurity=False" (sent upstream for python 3 as http://bugs.python.org/issue9216; this is a backport to python 2.7; see RHEL6 patch 119) - enforce usage of the _hashlib implementation: don't fall back to the _md5 and _sha* modules (leading to clearer error messages if fips selftests fail) - don't build the _md5 and _sha* modules; rely on the _hashlib implementation of hashlib (for example, md5.py will use _hashlib's implementation of MD5, if permitted by the FIPS setting) (rhbz#563986)
* 00142-skip-failing-pty-tests-in-rpmbuild.patchFedora Python maintainers2020-09-292-0/+2
| | | | | 00142 # Some pty tests fail when run in mock (rhbz#714627):
* 00139-skip-test_float-known-failure-on-arm.patchFedora Python maintainers2020-09-291-0/+1
| | | | | | 00139 # ARM-specific: skip known failure in test_float: http://bugs.python.org/issue8265 (rhbz#706253)
* 00136-skip-tests-of-seeking-stdin-in-rpmbuild.patchFedora Python maintainers2020-09-291-0/+1
| | | | | | 00136 # Some tests try to seek on sys.stdin, but don't work as expected when run within Koji/mock; skip them within the rpm build:
* 00133-skip-test_dl.patchFedora Python maintainers2020-09-291-0/+3
| | | | | 00133 # "dl" is deprecated, and test_dl doesn't work on 64-bit builds:
* 00131-disable-tests-in-test_io.patchFedora Python maintainers2020-09-291-0/+1
| | | | | | | | 00131 # The four tests in test_io built on top of check_interrupted_write_retry fail when built in Koji, for ppc and ppc64; for some reason, the SIGALRM handlers are never called, and the call to write runs to completion (rhbz#732998)
* python-2.7.1-fix_test_abc_with_COUNT_ALLOCS.patchFedora Python maintainers2020-09-291-2/+8
| | | | | | | | 00128 # 2.7.1 (in r84230) added a test to test_abc which fails if python is configured with COUNT_ALLOCS, which is the case for our debug build (the COUNT_ALLOCS instrumentation keeps "C" alive). Not yet sent upstream
* 00102-2.7.13-lib64.patchFedora Python maintainers2020-09-291-4/+7
| | | | | | | | Only used when "%%{_lib}" == "lib64" Fixup various paths throughout the build and in distutils from "lib" to "lib64", and add the /usr/lib64/pythonMAJOR.MINOR/site-packages to sitedirs, in front of /usr/lib/pythonMAJOR.MINOR/site-packages Not upstream
* Update macOS installer build for 2.7.18 end-of-life. (GH-19352)Ned Deily2020-04-041-1/+5
|
* [2.7] closes bpo-38576: Disallow control characters in hostnames in ↵Matěj Cepl2020-03-192-8/+37
| | | | | | | | | http.client. (GH-19052) Add host validation for control characters for more CVE-2019-18348 protection. (cherry picked from commit 83fc70159b24) Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>
* bpo-27973 - Use test.support.temp_dir instead of NamedTemporaryFile for the ↵Senthil Kumaran2020-01-041-4/+4
| | | | | | | (#17774) desired behavior under windows platform. Suggestion by David Bolen
* [2.7] bpo-27973 - Fix for urllib.urlretrieve() failing on second ftp ↵Senthil Kumaran2019-12-311-1/+38
| | | | | | | | transfer (#1040) * bpo-27973: Fix urllib.urlretrieve failing on subsequent ftp transfers from the same host. * bpo-35411: Skip test_urllibnet FTP tests on Travis CI.
* bpo-38295: prevent test_relative_path of test_py_compile failure on macOS ↵Miss Islington (bot)2019-12-171-1/+1
| | | | | | | Catalina (GH-17636) (cherry picked from commit bf3aa1060a29a05813abbe877193af16e3e7131e) Co-authored-by: Ned Deily <nad@python.org>
* [2.7] bpo-38945: UU Encoding: Don't let newline in filename corrupt the ↵Matthew Rollings2019-12-031-0/+10
| | | | | | | output format (GH-17418). (#17452) (cherry picked from commit a62ad4730c9b575f140f24074656c0257c86a09a) Co-authored-by: Matthew Rollings <1211162+stealthcopter@users.noreply.github.com>
* bpo-38804: Fix REDoS in http.cookiejar (GH-17157) (GH-17345)Victor Stinner2019-11-241-1/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The regex http.cookiejar.LOOSE_HTTP_DATE_RE was vulnerable to regular expression denial of service (REDoS). LOOSE_HTTP_DATE_RE.match is called when using http.cookiejar.CookieJar to parse Set-Cookie headers returned by a server. Processing a response from a malicious HTTP server can lead to extreme CPU usage and execution will be blocked for a long time. The regex contained multiple overlapping \s* capture groups. Ignoring the ?-optional capture groups the regex could be simplified to \d+-\w+-\d+(\s*\s*\s*)$ Therefore, a long sequence of spaces can trigger bad performance. Matching a malicious string such as LOOSE_HTTP_DATE_RE.match("1-c-1" + (" " * 2000) + "!") caused catastrophic backtracking. The fix removes ambiguity about which \s* should match a particular space. You can create a malicious server which responds with Set-Cookie headers to attack all python programs which access it e.g. from http.server import BaseHTTPRequestHandler, HTTPServer def make_set_cookie_value(n_spaces): spaces = " " * n_spaces expiry = f"1-c-1{spaces}!" return f"b;Expires={expiry}" class Handler(BaseHTTPRequestHandler): def do_GET(self): self.log_request(204) self.send_response_only(204) # Don't bother sending Server and Date n_spaces = ( int(self.path[1:]) # Can GET e.g. /100 to test shorter sequences if len(self.path) > 1 else 65506 # Max header line length 65536 ) value = make_set_cookie_value(n_spaces) for i in range(99): # Not necessary, but we can have up to 100 header lines self.send_header("Set-Cookie", value) self.end_headers() if __name__ == "__main__": HTTPServer(("", 44020), Handler).serve_forever() This server returns 99 Set-Cookie headers. Each has 65506 spaces. Extracting the cookies will pretty much never complete. Vulnerable client using the example at the bottom of https://docs.python.org/3/library/http.cookiejar.html : import http.cookiejar, urllib.request cj = http.cookiejar.CookieJar() opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj)) r = opener.open("http://localhost:44020/") The popular requests library was also vulnerable without any additional options (as it uses http.cookiejar by default): import requests requests.get("http://localhost:44020/") * Regression test for http.cookiejar REDoS If we regress, this test will take a very long time. * Improve performance of http.cookiejar.ISO_DATE_RE A string like "444444" + (" " * 2000) + "A" could cause poor performance due to the 2 overlapping \s* groups, although this is not as serious as the REDoS in LOOSE_HTTP_DATE_RE was. (cherry picked from commit 1b779bfb8593739b11cbb988ef82a883ec9d077e)
* [2.7] bpo-38535: Fix positions for AST nodes for calls without arguments in ↵Serhiy Storchaka2019-10-261-0/+9
| | | | | | decorators. (GH-16861). (GH-16931) (cherry picked from commit 26ae9f6d3d755734c9f371b9356325afe5764813)
* [2.7] bpo-38216, bpo-36274: Allow subclasses to separately override ↵Jason R. Coombs2019-10-081-0/+14
| | | | | | | | | | | | | validation and encoding behavior (GH-16476) Backporting this change, I observe a couple of things: 1. The _encode_request call is no longer meaningful because the request construction will implicitly encode the request using the default encoding when the format string is used (request = '%s %s %s'...). In order to keep the code as consistent as possible, I decided to include the call as a pass-through. I'd be just as happy to remove it entirely, but I'll leave that up to the reviewer to decide. It's okay that this functionality is disabled on Python 2 because this functionality was mainly around bpo-36274, which was mainly a concern with the transition to Python 3. 2. Because _encode_request is no longer meaningful, neither is the test for it, so I've removed that test. Therefore, the meaningful part of this test is that for bpo-38216, adding a (underscore-protected) hook to customize/disable validation. (cherry picked from commit 7774d7831e8809795c64ce27f7df52674581d298) Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>
* [2.7] bpo-38338, test.pythoninfo: add more ssl infos (GH-16543)Victor Stinner2019-10-021-0/+60
| | | | | | | test.pythoninfo now logs environment variables used by OpenSSL and Python ssl modules, and logs attributes of 3 SSL contexts (SSLContext, default HTTPS context, stdlib context). (cherry picked from commit 1df1c2f8df53d005ff47af81aa02c58752b84e20)
* [2.7] bpo-38243: Escape the server title of DocXMLRPCServer (GH-16447)Dong-hee Na2019-10-011-0/+20
| | | | Escape the server title of DocXMLRPCServer.DocXMLRPCServer when rendering the document page as HTML.
* [2.7] bpo-34410: Fix a crash in the tee iterator when re-enter it. ↵Serhiy Storchaka2019-09-091-0/+41
| | | | | | | (GH-15625) (GH-15740) RuntimeError is now raised in this case. (cherry picked from commit 526a01467b3277f9fcf7f91e66c23321caa1245d)
* test_multiprocessing removes temporary files (GH-15421)Victor Stinner2019-08-231-0/+2
| | | (cherry picked from commit d0b10a64351069aa9246d40cb8bd207cc9209cee)
* bpo-35518: Skip test that relies on a deceased network service. (GH-15349)Miss Islington (bot)2019-08-211-0/+1
| | | | | | | | | | | | | | | | If this service had thoroughly vanished, we could just ignore the test until someone gets around to either recreating such a service or redesigning the test to somehow work locally. The `support.transient_internet` mechanism catches the failure to resolve the domain name, and skips the test. But in fact the domain snakebite.net does still exist, as do its nameservers -- and they can be quite slow to reply. As a result this test can easily take 20-30s before it gets auto-skipped. So, skip the test explicitly up front. (cherry picked from commit 5b95a1507e349da5adae6d2ab57deac3bdd12f15) Co-authored-by: Greg Price <gnprice@gmail.com>
* [2.7] bpo-37411: Rewrite test_wsgiref.testEnviron() (GH-14394) (GH-14404)Miss Islington (bot)2019-06-261-26/+56
| | | | | | | | | | | Fix test_wsgiref.testEnviron() to no longer depend on the environment variables (don't fail if "X" variable is set). testEnviron() now overrides os.environ to get a deterministic environment. Test full TestHandler.environ content: not only a few selected variables. (cherry picked from commit 5150d327924959639215ed0a78feffc0d88258da) Co-authored-by: Victor Stinner <vstinner@redhat.com>
* bpo-37124: Fix reference leak in test_msilib (GH-13750) (GH-14340)Victor Stinner2019-06-241-0/+1
| | | (cherry picked from commit c0295dba259accc4b247beb22a0b2cc2f31d9850)
* bpo-37359: Add --cleanup option to python3 -m test (GH-14332) (GH-14333)Victor Stinner2019-06-241-1/+20
| | | | | | | * regrtest: Add --cleanup option to remove "test_python_*" directories of previous failed test jobs. * Add "make cleantest" to run "python -m test --cleanup". (cherry picked from commit 47fbc4e45b35b3111e2d947a66490a43ac21d363)
* bpo-37362: test_gdb now ignores stderr (GH-14287) (GH-14297)Victor Stinner2019-06-211-34/+13
| | | | | | | test_gdb no longer fails if it gets an "unexpected" message on stderr: it now ignores stderr. The purpose of test_gdb is to test that python-gdb.py commands work as expected, not to test gdb. (cherry picked from commit e56a123fd0acaa295a28b98d2e46d956b97d1263)
* [2.7] bpo-35647: Fix path check in cookiejar. (GH-11436) (GH-13427)Xtreak2019-06-151-0/+29
|
* [2.7] bpo-35121: prefix dot in domain for proper subdomain validation ↵Xtreak2019-06-151-0/+30
| | | | | | | | (GH-10258) (GH-13426) This is a manual backport of ca7fe5063593958e5efdf90f068582837f07bd14 since 2.7 has `http.cookiejar` in `cookielib` https://bugs.python.org/issue35121
* [2.7] bpo-36742: Fix urlparse.urlsplit() error message for Unicode URL ↵Victor Stinner2019-06-111-0/+9
| | | | | | | | (GH-13937) If urlparse.urlsplit() detects an invalid netloc according to NFKC normalization, the error message type is now str rather than unicode, and use repr() to format the URL, to prevent <exception str() failed> when display the error message.
* bpo-36742: Corrects fix to handle decomposition in usernames (GH-13812)Steve Dower2019-06-041-6/+7
|
* [2.7] bpo-12639: msilib.Directory.start_component() fails if *keyfile* is ↵Miss Islington (bot)2019-05-311-0/+8
| | | | | | | | | | not None (GH-13688) * bpo-12639: msilib.Directory.start_component() fails if *keyfile* is not None (GH-13688) msilib.Directory.start_component() was passing an extra argument to CAB.gen_id(). (cherry picked from commit c8d5bf6c3fa09b43f6a5ee779d493d251dbcc53c) Co-authored-by: Zackery Spytz <zspytz@gmail.com>
* bpo-26423: Fix test_descr.test_wrap_lenfunc_bad_cast() on 32-bit Windows ↵Victor Stinner2019-05-281-1/+5
| | | | | (GH-13629) Skip the test if xrange(sys.maxsize) raises an OverflowError.
* bpo-26423: Fix possible overflow in wrap_lenfunc() (GH-13606) (GH-13625)Victor Stinner2019-05-281-0/+4
| | | | | | Fix possible overflow in wrap_lenfunc() when sizeof(long) < sizeof(Py_ssize_t) (e.g., 64-bit Windows). (cherry picked from commit 05f16416d99dc9fc76fef11e56f16593e7a5955e)
* bpo-35907: Complete test_urllib.test_local_file_open() (GH-13506)Victor Stinner2019-05-221-1/+5
| | | | Test also URLopener().open(), URLopener().retrieve(), and DummyURLopener().retrieve().
* bpo-35907, CVE-2019-9948: urllib rejects local_file:// scheme (GH-11842)SH2019-05-211-0/+7
| | | CVE-2019-9948: Avoid file reading as disallowing the unnecessary URL scheme in urllib.urlopen().
* bpo-30458: Disallow control chars in http URLs (GH-12755) (GH-13154) (GH-13315)Victor Stinner2019-05-213-2/+82
| | | | | | | | | | | | | | | | | | | | | | | Disallow control chars in http URLs in urllib2.urlopen. This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected. Disable https related urllib tests on a build without ssl (GH-13032) These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures. Use httplib.InvalidURL instead of ValueError as the new error case's exception. (GH-13044) Backport Co-Authored-By: Miro Hrončok <miro@hroncok.cz> (cherry picked from commit 7e200e0763f5b71c199aaf98bd5588f291585619) Notes on backport to Python 2.7: * test_urllib tests urllib.urlopen() which quotes the URL and so is not vulerable to HTTP Header Injection. * Add tests to test_urllib2 on urllib2.urlopen(). * Reject non-ASCII characters: range 0x80-0xff.
* closes bpo-36755: Suppress noisy error output in test HTTPS server by ↵Benjamin Peterson2019-05-171-0/+5
| | | | | | | default. (GH-13370) TLS 1.3 has a more efficient handshake protocol. The client can reject the server's credentials and close the connection before the server has even finished writing out all of its initial data. Depending on whether the server finishes writing the rest of its handshake before the it sees the connection is reset, the server will read an empty line or see a ECONNRESET OSError. Nothing is really wrong here with the server or client, so just suppress the error output in the OSError case to fix the test. This fix isn't required in Python 3 because clients that reject the server's certificate will shut down the TLS layer before closing the TCP connection.
* [2.7] bpo-35925: Skip SSL tests that fail due to weak external certs or old ↵Gregory P. Smith2019-05-131-0/+33
| | | | | | | | | | | | | | | | | | | | TLS (GH-13124) (GH-13253) Modern Linux distros such as Debian Buster have default OpenSSL system configurations that reject connections to servers with weak certificates by default. This causes our test suite run with external networking resources enabled to skip these tests when they encounter such a failure. Fixing the network servers is a separate issue. (cherry picked from commit 2cc0223) Changes to test_ssl.py required as 2.7 has legacy protocol tests. The test_httplib.py change is omitted from this backport as self-signed.pythontest.net's certificate was updated and the test_nntplib.py change is not applicable on 2.7. Authored-by: Gregory P. Smith greg@krypto.org
* [2.7] bpo-36816: Update the self-signed.pythontest.net cert (GH-13192) ↵Gregory P. Smith2019-05-092-14/+66
| | | | | | | | | | | | | | | | | (GH-13199) * [2.7] bpo-36816: Update the self-signed.pythontest.net cert (GH-13192) We updated the server, our testsuite must match. https://bugs.python.org/issue36816 ✈️ CLE -> DEN ✈️ #pycon2019 #beyonce (cherry picked from commit 6bd81734de0b73f1431880d6a75fb71bcbc65fa1) The 2.7 tree also needed a certificate in the capath directory updated. The filename for that was determined by `openssl x509 -in $cert.pem -subject_hash`. Authored-by: Gregory P. Smith <greg@krypto.org>
* [2.7] bpo-14546: Fix the argument handling in Tools/scripts/lll.py ↵Zackery Spytz2019-05-021-0/+27
| | | | | (GH-13026) (GH-13063) (cherry picked from commit c4e78b116f9a4299f3b3bfbbd18ef49782bb1143)
* Change bisect to bisect_cmd in docstring (GH-13040)Miss Islington (bot)2019-05-021-3/+3
| | | | | (cherry picked from commit 11e4a941e9c6225776a986b05230a1963e83f4fb) Co-authored-by: Xtreak <tir.karthi@gmail.com>
* bpo-36742: Fixes handling of pre-normalization characters in urlsplit() ↵Steve Dower2019-05-011-0/+6
| | | | (GH-13017)
* bpo-35952: Sync test.pythoninfo from master (GH-13010)Victor Stinner2019-04-291-8/+65
|
generated by cgit v0.12 at 2025-08-09 08:42:13 (GMT)