summaryrefslogtreecommitdiffstats
path: root/Misc
Commit message (Collapse)AuthorAgeFilesLines
* bpo-37228: Fix loop.create_datagram_endpoint()'s usage of SO_REUSEADDR (#17311)Kyle Stanley2019-12-091-0/+6
|
* bpo-39006: Fix asyncio when the ssl module is missing (GH-17524)Victor Stinner2019-12-091-0/+2
| | | | Fix asyncio when the ssl module is missing: only check for ssl.SSLSocket instance if the ssl module is available.
* bpo-38916: array.array: remove fromstring() and tostring() (GH-17487)Victor Stinner2019-12-091-0/+3
| | | | array.array: Remove tostring() and fromstring() methods. They were aliases to tobytes() and frombytes(), deprecated since Python 3.2.
* bpo-38547: Fix test_pty if the process is the session leader (GH-17519)Victor Stinner2019-12-091-0/+3
| | | | | Fix test_pty: if the process is the session leader, closing the master file descriptor raises a SIGHUP signal: simply ignore SIGHUP when running the tests.
* bpo-38673: dont switch to ps2 if the line starts with comment or whitespace ↵Batuhan Taşkaya2019-12-091-0/+1
| | | | | (GH-17421) https://bugs.python.org/issue38673
* bpo-38708: email: Fix a potential IndexError when parsing Message-ID (GH-17504)Abhilash Raj2019-12-091-0/+1
| | | | Fix a potential IndexError when passing an empty value to the message-id parser. Instead, HeaderParseError should be raised.
* bpo-38698: Add a new InvalidMessageID token to email header parser. (GH-17503)Abhilash Raj2019-12-091-0/+3
| | | | This adds a new InvalidMessageID token to the email header parser which can be used to represent invalid message-id headers in the parse tree.
* bpo-38994: Implement __class_getitem__ for PathLike (GH-17498)Batuhan Taşkaya2019-12-081-0/+1
| | | https://bugs.python.org/issue38994
* bpo-38669: patch.object now raises a helpful error (GH17034)Elena Oat2019-12-081-0/+1
| | | This means a clearer message is now shown when patch.object is called with two string arguments, rather than a class and a string argument.
* bpo-38979: fix ContextVar "__class_getitem__" method (GH-17497)AMIR2019-12-081-0/+1
| | | | | | | | | | now contextvars.ContextVar "__class_getitem__" method returns ContextVar class, not None. https://bugs.python.org/issue38979 Automerge-Triggered-By: @asvetlov
* bpo-38852: Set thread stack size to 8 Mb for debug builds on android ↵xdegaye2019-12-081-0/+1
| | | | platforms (GH-17337)
* bpo-38991: Remove test.support.strip_python_stderr() (GH-17490)Victor Stinner2019-12-081-0/+5
| | | | | test.support: run_python_until_end(), assert_python_ok() and assert_python_failure() functions no longer strip whitespaces from stderr.
* bpo-38820: OpenSSL 3.0.0 compatibility. (GH-17190)Christian Heimes2019-12-071-0/+2
| | | | | | | | | | test_openssl_version now accepts version 3.0.0. getpeercert() no longer returns IPv6 addresses with a trailing new line. Signed-off-by: Christian Heimes <christian@python.org> https://bugs.python.org/issue38820
* bpo-38652: Remove provisional note for asyncio.BufferedProtocol (GH-17047)Anj-A2019-12-071-0/+1
| | | https://bugs.python.org/issue38652
* bpo-37404: Raising value error if an SSLSocket is passed to asyncio ↵idomic2019-12-071-0/+2
| | | | | functions (GH-16457) https://bugs.python.org/issue37404
* Make repr of C accelerated TaskWakeupMethWrapper the same as of pure Python ↵Andrew Svetlov2019-12-071-0/+2
| | | | version (GH-17484)
* bpo-38529: Fix asyncio stream warning (GH-17474)Andrew Svetlov2019-12-071-0/+2
|
* bpo-38978: Implement __class_getitem__ for asyncio objects (GH-17491)Batuhan Taşkaya2019-12-071-0/+2
| | | https://bugs.python.org/issue38978
* bpo-37931: Fix crash on OSX re-initializing os.environ (GH-15428)Benoit Hudson2019-12-062-0/+4
| | | | | | | | | | On most platforms, the `environ` symbol is accessible everywhere. In a dylib on OSX, it's not easily accessible, you need to find it with _NSGetEnviron. The code was caching the *value* of environ. But a setenv() can change the value, leaving garbage at the old value. Fix: don't cache the value of environ, just read it every time.
* bpo-38982: Fix asyncio PidfdChildWatcher on waitpid() error (GH-17477)Victor Stinner2019-12-061-0/+5
| | | | | | If waitpid() is called elsewhere, waitpid() call fails with ChildProcessError: use return code 255 in this case, and log a warning. It ensure that the pidfd file descriptor is closed if this error occurs.
* bpo-36820: Break unnecessary cycle in socket.py, codeop.py and dyld.py ↵Mario Corchero2019-12-061-0/+3
| | | | | | | | | | | | (GH-13135) Break cycle generated when saving an exception in socket.py, codeop.py and dyld.py as they keep alive not only the exception but user objects through the ``__traceback__`` attribute. https://bugs.python.org/issue36820 Automerge-Triggered-By: @pablogsal
* bpo-27413: json.tool: Add --no-ensure-ascii option. (GH-17472)wim glenn2019-12-061-0/+2
|
* bpo-38698: Prevent UnboundLocalError to pop up in parse_message_id (GH-17277)Claudiu Popa2019-12-051-0/+5
| | | | | | | | | parse_message_id() was improperly using a token defined inside an exception handler, which was raising `UnboundLocalError` on parsing an invalid value. https://bugs.python.org/issue38698
* bpo-38965: Fix faulthandler._stack_overflow() on GCC 10 (GH-17467)Victor Stinner2019-12-041-0/+3
| | | | Use the "volatile" keyword to prevent tail call optimization on any compiler, rather than relying on compiler specific pragma.
* bpo-38634: Allow non-apple build to cope with libedit (GH-16986)serge-sans-paille2019-12-041-0/+2
| | | | | | | | | | | The readline module now detects if Python is linked to libedit at runtime on all platforms. Previously, the check was only done on macOS. If Python is used as a library by a binary linking to libedit, the linker resolves the rl_initialize symbol required by the readline module against libedit instead of libreadline, which leads to a segfault. Take advantage of the existing supporting code to have readline module being compatible with both situations.
* bpo-33684: json.tool: Use utf-8 for infile and outfile. (GH-17460)Inada Naoki2019-12-041-0/+2
|
* bpo-29636: Add --(no-)indent arguments to json.tool (GH-345)Daniel Himmelstein2019-12-041-0/+5
|
* bpo-38945: UU Encoding: Don't let newline in filename corrupt the output ↵Matthew Rollings2019-12-021-0/+1
| | | | format (#17418)
* bpo-37523: Raise ValueError for I/O operations on a closed ↵Daniel Hillier2019-11-301-0/+1
| | | | | zipfile.ZipExtFile. (GH-14658) Raises ValueError when calling the following on a closed zipfile.ZipExtFile: read, readable, seek, seekable, tell.
* bpo-38920: Add audit hooks for when sys.excepthook and sys.unraisable hooks ↵Steve Dower2019-11-281-0/+2
| | | | | are invoked (GH-17392) Also fixes some potential segfaults in unraisable hook handling.
* bpo-38927: Use python -m pip to upgrade venv deps (GH-17403)Tzu-ping Chung2019-11-271-0/+1
| | | I suggest you add `bpo-NNNNN: ` as a prefix for the first commit for future PRs. Thanks!
* bpo-38928: Fix versionadded for venv's upgrade_deps function (GH-17404)Tzu-ping Chung2019-11-271-0/+2
|
* bpo-26730: Fix SpooledTemporaryFile data corruption (GH-17400)Inada Naoki2019-11-271-0/+2
| | | | | | | SpooledTemporaryFile.rollback() might cause data corruption when it is in text mode. Co-Authored-By: Serhiy Storchaka <storchaka@gmail.com>
* bpo-38688, shutil.copytree: consume iterator and create list of entries to ↵Bruno P. Kinoshita2019-11-271-0/+5
| | | | prevent infinite recursion (GH-17098)
* bpo-38922: Raise code.__new__ audit event when code object replace() is ↵Steve Dower2019-11-271-0/+2
| | | | called (GH-17394)
* bpo-38045: Improve the performance of _decompose() in enum.py (GH-16483)HongWeipeng2019-11-261-0/+1
| | | | | | * Improve the performance of _decompose() in enum.py Co-Authored-By: Brandt Bucher <brandtbucher@gmail.com>
* bpo-38892: Improve docs for audit event (GH-17361)Terry Jan Reedy2019-11-261-0/+1
|
* bpo-22377: Fixes documentation for %Z in datetime (GH-16507)Karl Dubost2019-11-261-0/+2
| | | | | | | | | | This fixes the issue discussed in https://bugs.python.org/issue22377 and fixes it according to the comments made by Paul Ganssle @pganssle * It clarifies which values are acceptable in the table * It extends the note with a clearer information on the valid values https://bugs.python.org/issue22377
* bpo-27145: small_ints[x] could be returned in long_add and long_sub (GH-15716)HongWeipeng2019-11-261-0/+1
|
* bpo-38328: Speed up the creation time of constant list and set display. ↵Brandt Bucher2019-11-261-0/+2
| | | | (GH-17114)
* bpo-20928: support base-URL and recursive includes in etree.ElementInclude ↵Stefan Behnel2019-11-251-0/+1
| | | | | | | | | | | | (#5723) * bpo-20928: bring elementtree's XInclude support en-par with the implementation in lxml by adding support for recursive includes and a base-URL. * bpo-20928: Support xincluding the same file multiple times, just not recursively. * bpo-20928: Add 'max_depth' parameter to xinclude that limits the maximum recursion depth to 6 by default. * Add news entry for updated ElementInclude support
* bpo-38870: Expose a function to unparse an ast object in the ast module ↵Pablo Galindo2019-11-241-0/+4
| | | | | | | (GH-17302) Add ast.unparse() as a function in the ast module that can be used to unparse an ast.AST object and produce a string with code that would produce an equivalent ast.AST object when parsed.
* bpo-38862: IDLE Strip Trailing Whitespace fixes end newlines (GH-17366)Terry Jan Reedy2019-11-241-0/+2
| | | Extra newlines are removed at the end of non-shell files. If the file only has newlines after stripping other trailing whitespace, all are removed, as is done by patchcheck.py.
* bpo-38876: Raise pickle.UnpicklingError when loading an item from memo for ↵Claudiu Popa2019-11-241-0/+9
| | | | | | | | | | | | | | | invalid input (GH-17335) The previous code was raising a `KeyError` for both the Python and C implementation. This was caused by the specified index of an invalid input which did not exist in the memo structure, where the pickle stores what objects it has seen. The malformed input would have caused either a `BINGET` or `LONG_BINGET` load from the memo, leading to a `KeyError` as the determined index was bogus. https://bugs.python.org/issue38876 https://bugs.python.org/issue38876
* Better runtime TypedDict (GH-17214)Zac Hatfield-Dodds2019-11-241-0/+3
| | | | | This patch enables downstream projects inspecting a TypedDict subclass at runtime to tell which keys are optional. This is essential for generating test data with Hypothesis or validating inputs with typeguard or pydantic.
* bpo-38881: choices() raises ValueError when all weights are zero (GH-17362)Raymond Hettinger2019-11-231-0/+1
|
* bpo-38899: virtual environment activation for fish should use `source` ↵Brett Cannon2019-11-231-0/+3
| | | | | | | | | | | | (GH-17359) The previously documented use of `.` is considered deprecated (https://fishshell.com/docs/current/commands.html#source). https://bugs.python.org/issue38899 Automerge-Triggered-By: @brettcannon
* bpo-38896: Remove PyUnicode_ClearFreeList() function (GH-17354)Victor Stinner2019-11-231-0/+2
| | | | Remove PyUnicode_ClearFreeList() function: the Unicode free list has been removed in Python 3.3.
* bpo-38686: fix HTTP Digest handling in request.py (#17045)PypeBros2019-11-221-0/+1
| | | | | | | | | | | | | | | | | | | | | * fix HTTP Digest handling in request.py There is a bug triggered when server replies to a request with `WWW-Authenticate: Digest` where `qop="auth,auth-int"` rather than mere `qop="auth"`. Having both `auth` and `auth-int` is legitimate according to the `qop-options` rule in §3.2.1 of [[https://www.ietf.org/rfc/rfc2617.txt|RFC 2617]]: > qop-options = "qop" "=" <"> 1#qop-value <"> > qop-value = "auth" | "auth-int" | token > **qop-options**: [...] If present, it is a quoted string **of one or more** tokens indicating the "quality of protection" values supported by the server. The value `"auth"` indicates authentication; the value `"auth-int"` indicates authentication with integrity protection This is description confirmed by the definition of the [//n//]`#`[//m//]//rule// extended-BNF pattern defined in §2.1 of [[https://www.ietf.org/rfc/rfc2616.txt|RFC 2616]] as 'a comma-separated list of //rule// with at least //n// and at most //m// items'. When this reply is parsed by `get_authorization`, request.py only tests for identity with `'auth'`, failing to recognize it as one of the supported modes the server announced, and claims that `"qop 'auth,auth-int' is not supported"`. * 📜🤖 Added by blurb_it. * bpo-38686 review fix: remember why. * fix trailing space in Lib/urllib/request.py Co-Authored-By: Brandt Bucher <brandtbucher@gmail.com>
* bpo-38804: Fix REDoS in http.cookiejar (GH-17157)bcaller2019-11-222-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The regex http.cookiejar.LOOSE_HTTP_DATE_RE was vulnerable to regular expression denial of service (REDoS). LOOSE_HTTP_DATE_RE.match is called when using http.cookiejar.CookieJar to parse Set-Cookie headers returned by a server. Processing a response from a malicious HTTP server can lead to extreme CPU usage and execution will be blocked for a long time. The regex contained multiple overlapping \s* capture groups. Ignoring the ?-optional capture groups the regex could be simplified to \d+-\w+-\d+(\s*\s*\s*)$ Therefore, a long sequence of spaces can trigger bad performance. Matching a malicious string such as LOOSE_HTTP_DATE_RE.match("1-c-1" + (" " * 2000) + "!") caused catastrophic backtracking. The fix removes ambiguity about which \s* should match a particular space. You can create a malicious server which responds with Set-Cookie headers to attack all python programs which access it e.g. from http.server import BaseHTTPRequestHandler, HTTPServer def make_set_cookie_value(n_spaces): spaces = " " * n_spaces expiry = f"1-c-1{spaces}!" return f"b;Expires={expiry}" class Handler(BaseHTTPRequestHandler): def do_GET(self): self.log_request(204) self.send_response_only(204) # Don't bother sending Server and Date n_spaces = ( int(self.path[1:]) # Can GET e.g. /100 to test shorter sequences if len(self.path) > 1 else 65506 # Max header line length 65536 ) value = make_set_cookie_value(n_spaces) for i in range(99): # Not necessary, but we can have up to 100 header lines self.send_header("Set-Cookie", value) self.end_headers() if __name__ == "__main__": HTTPServer(("", 44020), Handler).serve_forever() This server returns 99 Set-Cookie headers. Each has 65506 spaces. Extracting the cookies will pretty much never complete. Vulnerable client using the example at the bottom of https://docs.python.org/3/library/http.cookiejar.html : import http.cookiejar, urllib.request cj = http.cookiejar.CookieJar() opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj)) r = opener.open("http://localhost:44020/") The popular requests library was also vulnerable without any additional options (as it uses http.cookiejar by default): import requests requests.get("http://localhost:44020/") * Regression test for http.cookiejar REDoS If we regress, this test will take a very long time. * Improve performance of http.cookiejar.ISO_DATE_RE A string like "444444" + (" " * 2000) + "A" could cause poor performance due to the 2 overlapping \s* groups, although this is not as serious as the REDoS in LOOSE_HTTP_DATE_RE was.
generated by cgit v0.12 at 2025-01-11 20:56:54 (GMT)