| Commit message (Collapse) | Author | Age | Files | Lines |
| |
|
|
|
|
|
| |
Co-authored-by: Miguel Brito <5544985+miguendes@users.noreply.github.com>
Co-authored-by: Łukasz Langa <lukasz@langa.pl>
(cherry picked from commit 0897253f426068ea6a6fbe0ada01689af9ef1019)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(GH-27946) (GH-27975)
Various date parsing utilities in the email module, such as
email.utils.parsedate(), are supposed to gracefully handle invalid
input, typically by raising an appropriate exception or by returning
None.
The internal email._parseaddr._parsedate_tz() helper used by some of
these date parsing routines tries to be robust against malformed input,
but unfortunately it can still crash ungracefully when a non-empty but
whitespace-only input is passed. This manifests as an unexpected
IndexError.
In practice, this can happen when parsing an email with only a newline
inside a ‘Date:’ header, which unfortunately happens occasionally in the
real world.
Here's a minimal example:
$ python
Python 3.9.6 (default, Jun 30 2021, 10:22:16)
[GCC 11.1.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import email.utils
>>> email.utils.parsedate('foo')
>>> email.utils.parsedate(' ')
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/usr/lib/python3.9/email/_parseaddr.py", line 176, in parsedate
t = parsedate_tz(data)
File "/usr/lib/python3.9/email/_parseaddr.py", line 50, in parsedate_tz
res = _parsedate_tz(data)
File "/usr/lib/python3.9/email/_parseaddr.py", line 72, in _parsedate_tz
if data[0].endswith(',') or data[0].lower() in _daynames:
IndexError: list index out of range
The fix is rather straight-forward: guard against empty lists, after
splitting on whitespace, but before accessing the first element.
(cherry picked from commit 989f6a3800f06b2bd31cfef7c3269a443ad94fac)
Co-authored-by: wouter bolsterlee <wouter@bolsterl.ee>
|
| |
|
|
|
|
|
|
| |
It wasn't actually detecting the regression due to the
assertion being too lenient.
(cherry picked from commit e60ab843cbb016fb6ff8b4f418641ac05a9b2fcc)
Co-authored-by: Gregory P. Smith <greg@krypto.org>
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
| |
Continue (GH-25916) (GH-25934)
Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response.
Co-authored-by: Gregory P. Smith <greg@krypto.org>
(cherry picked from commit 47895e31b6f626bc6ce47d175fe9d43c1098909d)
Co-authored-by: Gen Xu <xgbarry@gmail.com>
|
| |
|
|
|
|
|
|
|
|
|
|
| |
and tabs. (GH-25923)
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
(cherry picked from commit 76cd81d60310d65d01f9d7b48a8985d8ab89c8b4)
Co-authored-by: Senthil Kumaran <senthil@uthcode.com>
(cherry picked from commit 515a7bc4e13645d0945b46a8e1d9102b918cd407)
Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
|
| |
|
|
|
|
| |
Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit 3447750073aff229b049e4ccd6217db2811dcfd1)
Co-authored-by: Christian Heimes <christian@python.org>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(GH-24915) (GH-24928)
Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.
See:
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <christian@python.org>.
(cherry picked from commit f6c6b5821bff815bdc810de53992fd1fbdb2edd4)
Co-authored-by: Christian Heimes <christian@python.org>
|
| |
|
|
|
|
|
| |
sys.stderr (GH-25075). (GH-25085)
(cherry picked from commit 09b90a037d18f5d4acdf1b14082e57bda78e85d3)
Co-authored-by: Pablo Galindo <Pablogsal@gmail.com>
|
| |
|
|
|
|
|
|
|
|
|
|
| |
CVE-2021-3426: Remove the "getfile" feature of the pydoc module which
could be abused to read arbitrary files on the disk (directory
traversal vulnerability). Moreover, even source code of Python
modules can contain sensitive data like passwords. Vulnerability
reported by David Schwörer.
(cherry picked from commit 9b999479c0022edfc9835a8a1f06e046f3881048)
Co-authored-by: Victor Stinner <vstinner@python.org>
Co-authored-by: Victor Stinner <vstinner@python.org>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(GH-24881) (GH-24883)
The IPv4 address value returned from the server in response to the PASV command
should not be trusted. This prevents a malicious FTP server from using the
response to probe IPv4 address and port combinations on the client network.
Instead of using the returned address, we use the IP address we're
already connected to. This is the strategy other ftp clients adopted,
and matches the only strategy available for the modern IPv6 EPSV command
where the server response must return a port number and nothing else.
For the rare user who _wants_ this ugly behavior, set a `trust_server_pasv_ipv4_address`
attribute on your `ftplib.FTP` instance to True..
(cherry picked from commit 0ab152c6b5d95caa2dc1a30fa96e10258b5f188e)
Co-authored-by: Gregory P. Smith <greg@krypto.org>
(cherry picked from commit 664d1d16274b47eea6ec92572e1ebf3939a6fa0c)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
bpo-42967: [security] Address a web cache-poisoning issue reported in
urllib.parse.parse_qsl().
urllib.parse will only us "&" as query string separator by default
instead of both ";" and "&" as allowed in earlier versions. An optional
argument seperator with default value "&" is added to specify the
separator.
Co-authored-by: Éric Araujo <merwok@netwok.org>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Adam Goldschmidt <adamgold7@gmail.com>
(cherry picked from commit fcbe0cb04d35189401c0c880ebfb4311e952d776)
|
| |
|
|
|
|
|
| |
(GH-24037) (GH-24041)
(cherry picked from commit ec3165320e81ac87edcb85c86c452528ddbaec1c)
Co-authored-by: Dong-hee Na <donghee.na@python.org>
|
| |
|
|
|
|
|
|
|
|
|
| |
* Prevent some possible DoS attacks via providing invalid Plist files
with extremely large number of objects or collection sizes.
* Raise InvalidFileException for too large bytes and string size instead of returning garbage.
* Raise InvalidFileException instead of ValueError for specific invalid datetime (NaN).
* Raise InvalidFileException instead of TypeError for non-hashable dict keys.
* Add more tests for invalid Plist files..
(cherry picked from commit 34637a0ce21e7261b952fbd9d006474cc29b681f)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
|
| |
|
|
|
|
|
| |
codec tests (GH-22566) (GH-22578)
(cherry picked from commit 2ef5caa58febc8968e670e39e3d37cf8eef3cab8)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
|
| |
|
| |
Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com>
|
| |
|
|
|
| |
Note: macOS 11 is not yet released, this release of Python is not
fully supported on 11.0, and not all tests pass.
|
| |
|
|
|
|
|
|
| |
(GH-7467) (GH-21878)
(cherry picked from commit 52698c7ad9eae9feb35839fde17a7d1da8036a9b)
Co-authored-by: Yury Selivanov <yury@magic.io>
|
| |
|
|
|
|
| |
reject control chars in http method in http.client.putrequest to prevent http header injection
(cherry picked from commit 8ca8a2e8fb068863c1138f07e3098478ef8be12e)
Co-authored-by: AMIR <31338382+amiremohamadi@users.noreply.github.com>
|
| | |
|
| |
|
|
|
|
|
|
| |
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121a1f3ef5ad7c105ee378cc79a3eac0c7d4)
Co-authored-by: Rishi <rishi_devan@mail.com>
|
| |
|
|
|
|
| |
Automerge-Triggered-By: @tiran
(cherry picked from commit 4f309abf55f0e6f8950ac13d6ec83c22b8d47bf8)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
(GH-21033) (GH-21231)
CVE-2020-14422
The __hash__() methods of classes IPv4Interface and IPv6Interface had issue
of generating constant hash values of 32 and 128 respectively causing hash collisions.
The fix uses the hash() function to generate hash values for the objects
instead of XOR operation
(cherry picked from commit b30ee26e366bf509b7538d79bfec6c6d38d53f28)
Co-authored-by: Ravi Teja P <rvteja92@gmail.com>
Signed-off-by: Tapas Kundu <tkundu@vmware.com>
|
| |
|
|
|
|
|
|
| |
Signed-off-by: Christian Heimes <christian@python.org>
Automerge-Triggered-By: @tiran.
(cherry picked from commit bb6ec14479f18c32e71e43f2785f177aa17aabbd)
Co-authored-by: Christian Heimes <christian@python.org>
|
| |
|
|
|
|
| |
Co-authored-by: Xavier Fernandez <xav.fernandez@gmail.com>
(cherry picked from commit e63cc2f64668bd1d4581f8efa7089af7e08863b8)
Co-authored-by: Ned Deily <nad@python.org>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
ensurepip optionally installs or upgrades 'pip' and 'setuptools' using
the version of those modules bundled with Python. The internal PIP
installation routine by default temporarily uses its cache, if it
exists. This is undesirable as Python builds and installations may be
independent of the user running the build, whilst PIP cache location
is dependent on the user's environment and outside of the build
environment.
At the same time, there's no value in using the cache while installing
bundled modules.
This change disables PIP caching when used in ensurepip.
(cherry picked from commit 4a3a682b12f93a03888e8b59f439bc5fe30d6055)
Co-authored-by: Krzysztof Konopko <kkonopko@users.noreply.github.com>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(GH-20892)
In Python 3.7 the behavior of parse_multipart changed requiring CONTENT-LENGTH
header, this fix remove this header as required and fix FieldStorage
read_lines_to_outerboundary, by not using limit when it's negative,
since by default it's -1 if not content-length and keeps substracting what
was read from the file object.
Also added a test case for this problem.
(cherry picked from commit d8cf3514dd4682419a66f6e834bb384ee34afc95)
Co-authored-by: roger <rogerduran@gmail.com>
Automerge-Triggered-By: @ned-deily
|
| |
|
|
|
|
| |
Remote host cyrus.andrew.cmu.edu is blocking incoming connections and is
causing test suite to fail.
Signed-off-by: Christian Heimes <christian@python.org>
|
| |
|
|
| |
require `_generate_next_value_` to be defined before members
(cherry picked from commit d9a43e20facdf4ad10186f820601c6580e1baa80)
|
| | |
|
| |
|
|
|
| |
precisions (GH-20748)
This reverts commit c6f95543b4832c3f0170179da39bcf99b40a7aa8.
|
| |
|
|
|
|
| |
A tiny sliver of a 3.9 PEG parser patch needed to backport the test added by GH-20486.
(cherry picked from commit a5d6aba318ead9cc756ba750a70da41f5def3f8f)
Co-authored-by: Terry Jan Reedy <tjreedy@udel.edu>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
encoded-words. (gh-17620)
* bpo-39040: Fix parsing of email headers with encoded-words inside a quoted string.
It is fairly common to find malformed mime headers (especially content-disposition
headers) where the parameter values, instead of being encoded to RFC
standards, are "encoded" by doing RFC 2047 "encoded word" encoding, and
then enclosing the whole thing in quotes. The processing of these malformed
headers was incorrectly leaving the spaces between encoded words in the decoded
text (whitespace between adjacent encoded words is supposed to be stripped on
decoding). This changeset fixes the encoded word processing inside quoted strings
(bare-quoted-string) to do correct RFC 2047 decoding by stripping that
whitespace.
(cherry picked from commit 21017ed904f734be9f195ae1274eb81426a9e776)
Co-authored-by: Abhilash Raj <maxking@users.noreply.github.com>
|
| |
|
|
|
|
| |
Disallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks.
(cherry picked from commit 614f17211c5fc0e5b828be1d3320661d1038fe8f)
Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>
|
| |
|
|
|
|
|
|
|
|
| |
(GH-20419)
struct.error is now raised if there is a null character in a struct
format string.
(cherry picked from commit 3f59b55316f4c6ab451997902579aa69020b537c)
(cherry picked from commit 5ff5edfef63b3dbc1abb004b3fa4b3db87e79ff9)
Co-authored-by: Zackery Spytz <zspytz@gmail.com>
|
| |
|
|
|
|
|
| |
ast_unparse.c (GH-20156). (GH-20192)
(cherry picked from commit 2135e10dc717c00d10d899d232bebfc59bb25032)
Co-authored-by: Batuhan Taskaya <batuhanosmantaskaya@gmail.com>
|
| |
|
|
|
|
| |
test_gdb and test.pythoninfo now check gdb command exit code.
(cherry picked from commit ec9bea4a3766bd815148a27f61eb24e7dd459ac7)
Co-authored-by: Victor Stinner <vstinner@python.org>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* bpo-37421: multiprocessing tests call _run_finalizers() (GH-14527)
multiprocessing tests now call explicitly _run_finalizers() to remove
immediately temporary directories created by
multiprocessing.util.get_temp_dir().
(cherry picked from commit 039fb49c185570ab7b02f13fbdc51c859cfd831e)
Co-authored-by: Victor Stinner <vstinner@redhat.com>
(cherry picked from commit 632cb36084dc9d13f1cdb31a0e7e3ba80745a51a)
* bpo-37421: multiprocessing tests now stop ForkServer (GH-14601)
multiprocessing tests now stop the ForkServer instance if it's
running: close the "alive" file descriptor to ask the server to stop
and then remove its UNIX address.
(cherry picked from commit 8fbeb14312b4c1320d31ad86e69749515879d1c3)
Co-authored-by: Victor Stinner <vstinner@redhat.com>
(cherry picked from commit 229f6e85f8b4d57a2e742e0d3fc361c5bd15f1cb)
* bpo-38546: multiprocessing tests stop the resource tracker (GH-17641) (GH-17647)
Multiprocessing and concurrent.futures tests now stop the resource
tracker process when tests complete.
Add ResourceTracker._stop() method to
multiprocessing.resource_tracker.
Add _cleanup_tests() helper function to multiprocessing.util: share
code between multiprocessing and concurrent.futures tests.
(cherry picked from commit 9707e8e22d80ca97bf7a9812816701cecde6d226)
(cherry picked from commit 35acb3597208e10a101140474adec86859d57f61)
* Remove NEWS about resource tracker
Python 3.7 multiprocessing does not have resource tracker.
Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
|
| |
|
|
|
|
|
| |
bpo-32759, bpo-39932: Fix multiprocessing test_heap():
a new Heap object is now created for each test run.
Partial backport of commit e4679cd644aa19f9d9df9beb1326625cf2b02c15
by Antoine Pitrou.
|
| |
|
|
|
|
|
|
|
|
| |
It is possible to use either '-isysroot /some/path' (with a space) or
'-isysroot/some/path' (no space in between). Support both forms in
places where special handling of -isysroot is done, rather than just
the first form.
Co-authored-by: Ned Deily <nad@python.org>
(cherry picked from commit b310700976524b4b99ee319c947ca40468716fc9)
Co-authored-by: Joshua Root <jmr@macports.org>
|
| |
|
|
|
|
|
|
| |
Fix the Windows implementation of os.waitpid() for exit code
larger than "INT_MAX >> 8". The exit status is now interpreted as an
unsigned number.
(cherry picked from commit b07350901cac9197aef41855d8a4d56533636b91)
Co-authored-by: Victor Stinner <vstinner@python.org>
|
| |
|
|
|
|
| |
https://bugs.python.org/issue39942
(cherry picked from commit a25a04fea5446b1712cde0cff556574be139285a)
Co-authored-by: HongWeipeng <hongweichen8888@sina.com>
|
| |
|
|
|
|
|
| |
(GH-19584)
Co-authored-by: Ammar Askar <ammar@ammaraskar.com>
(cherry picked from commit 12446e6a605f066d837d3a595d0a73e4f3b43b65)
|
| |
|
|
|
|
| |
It has not returned the file position after the seek.
(cherry picked from commit 485e715cb1ff92bc9882cd51ec32589f9cb30503)
Co-authored-by: Inada Naoki <songofacandy@gmail.com>
|
| |
|
|
|
|
| |
(cherry picked from commit 5565c30f0b25996a0e73477fc0e1e1aced52b926)
Co-authored-by: Batuhan Taşkaya <batuhanosmantaskaya@gmail.com>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* bpo-36670: regrtest bug fixes (GH-16537)
* Fix TestWorkerProcess.__repr__(): start_time is only valid
if _popen is not None.
* Fix _kill(): don't set _killed to True if _popen is None.
* _run_process(): only set _killed to False after calling
run_test_in_subprocess().
(cherry picked from commit 2ea71a07d0a720707094ee55f78fd232c40724bc)
* [3.8] Update libregrtest from master (GH-19516)
* bpo-37531: regrtest now catchs ProcessLookupError (GH-16827)
Fix a warning on a race condition on TestWorkerProcess.kill(): ignore
silently ProcessLookupError rather than logging an useless warning.
(cherry picked from commit a661392f8fb5ac4fc095aa1845d1eb7a25c4e9be)
* bpo-38502: regrtest uses process groups if available (GH-16829)
test.regrtest now uses process groups in the multiprocessing mode
(-jN command line option) if process groups are available: if
os.setsid() and os.killpg() functions are available.
(cherry picked from commit ecb035cd14c11521276343397151929a94018a22)
* bpo-37957: Allow regrtest to receive a file with test (and subtests) to ignore (GH-16989)
When building Python in some uncommon platforms there are some known tests that will fail. Right now, the test suite has the ability to ignore entire tests using the -x option and to receive a filter file using the --matchfile filter. The problem with the --matchfile option is that it receives a file with patterns to accept and when you want to ignore a couple of tests and subtests, is too cumbersome to lists ALL tests that are not the ones that you want to accept and he problem with -x is that is not easy to ignore just a subtests that fail and the whole test needs to be ignored.
For these reasons, add a new option to allow to ignore a list of test and subtests for these situations.
(cherry picked from commit e0cd8aa70a3ce19c3d3712568940aa0cbd9aa97b)
* regrtest: log timeout at startup (GH-19514)
Reduce also worker timeout.
(cherry picked from commit 4cf65a630a8d45bad3fe5cdc4c2632ec64e7ba27)
Co-authored-by: Pablo Galindo <Pablogsal@gmail.com>
(cherry picked from commit 67b8a1f0f0f78ec38b8626fa9f5b2f5a55c17e15)
* bpo-36842: Fix reference leak in tests by running out-of-proc (GH-13556)
(cherry picked from commit 9ddc416e9f6635376312c3615193f19480ac772a)
* Backport libregrtest changes from master
Co-authored-by: Steve Dower <steve.dower@python.org>
|
| |
|
|
|
| |
(cherry picked from commit 96515e9f6785328c52ebc5d4ce60e0087a9adc2d)
Co-authored-by: Zackery Spytz <zspytz@gmail.com>
|
| |
|
|
|
| |
_elementtree.XMLParser object (GH-3997) (GH-19487)
(cherry picked from commit 402e1cdb132f384e4dcde7a3d7ec7ea1fc7ab527)
|
| |
|
|
|
|
|
| |
variables (GH-19391)
(cherry picked from commit 799d7d61a91eb0ad3256ef9a45a90029cef93b7c)
Co-authored-by: Pablo Galindo <Pablogsal@gmail.com>
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
(GH-19316) (GH-19318)
test_builtin.PtyTests now registers an handler for SIGHUP signal.
Closing the PTY file descriptor can emit a SIGHUP signal: just ignore
it.
run_child() now also closes the PTY file descriptor before waiting
for the process completition, otherwise the test hangs on AIX.
(cherry picked from commit 7a51a7e19f0143f75f8fc9ff68f93ed40937aec6)
(cherry picked from commit 745bd91bab8e57c52d63a2d541465551d7551f78)
|