delta/cpython-git.git, branch v3.6.13

3.6.13

2021-02-16T01:30:33+00:00

[3.6] bpo-42967: only use '&' as a query string separator (GH-24297) (GH-24532)

2021-02-15T19:16:43+00:00

bpo-42967: [security] Address a web cache-poisoning issue reported in
urllib.parse.parse_qsl().

urllib.parse will only us "&" as query string separator by default
instead of both ";" and "&" as allowed in earlier versions. An optional
argument seperator with default value "&" is added to specify the
separator.

Co-authored-by: Éric Araujo 
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Adam Goldschmidt

[3.6] closes bpo-42938: Replace snprintf with Python unicode formatting in ctypes param reprs. (GH-24250)

2021-01-18T21:11:46+00:00

(cherry picked from commit 916610ef90a0d0761f08747f7b0905541f0977c7)

Co-authored-by: Benjamin Peterson

[3.6] Bring Python into the new year. (GH-24036). (GH-24054)

2021-01-02T05:27:18+00:00

(cherry picked from commit de6f20a6de48d63066b2cf5b317f50629f01d74a)

Co-authored-by: Dong-hee Na

bpo-42794: Update test_nntplib to use offical group name for testing (GH-24037) (GH-24042)

2021-01-01T18:42:16+00:00

(cherry picked from commit ec3165320e81ac87edcb85c86c452528ddbaec1c)

Co-authored-by: Dong-hee Na

bpo-40791: Make compare_digest more constant-time. (GH-23438) (GH-23767)

2020-12-14T17:04:57+00:00

The existing volatile `left`/`right` pointers guarantee that the reads will all occur, but does not guarantee that they will be _used_. So a compiler can still short-circuit the loop, saving e.g. the overhead of doing the xors and especially the overhead of the data dependency between `result` and the reads. That would change performance depending on where the first unequal byte occurs. This change removes that optimization.

(This is change GH-1 from https://bugs.python.org/issue40791 .)
(cherry picked from commit 31729366e2bc09632e78f3896dbce0ae64914f28)

Co-authored-by: Devin Jeanpierre

bpo-35560: Remove assertion from format(float, "n") (GH-11288) (GH-23231)

2020-11-10T19:58:27+00:00

Fix an assertion error in format() in debug build for floating point
formatting with "n" format, zero padding and small width. Release build is
not impacted. Patch by Karthikeyan Singaravelan.
(cherry picked from commit 3f7983a25a3d19779283c707fbdd5bc91b1587ef)

Co-authored-by: Xtreak

[3.6] bpo-42103: Improve validation of Plist files. (GH-22882) (GH-23118)

2020-11-10T19:57:32+00:00

* Prevent some possible DoS attacks via providing invalid Plist files
  with extremely large number of objects or collection sizes.
* Raise InvalidFileException for too large bytes and string size instead of returning garbage.
* Raise InvalidFileException instead of ValueError for specific invalid datetime (NaN).
* Raise InvalidFileException instead of TypeError for non-hashable dict keys.
* Add more tests for invalid Plist files..
(cherry picked from commit 34637a0ce21e7261b952fbd9d006474cc29b681f)

Co-authored-by: Serhiy Storchaka

[3.6] Remove 3.5 from Doc version switcher in master. (GH-22886) (#22891)

2020-10-22T15:55:36+00:00

(cherry picked from commit 283f9a253b4ff4df728558205629b3bb3af6e47f)

bpo-41944: No longer call eval() on content received via HTTP in the CJK codec tests (GH-22566) (GH-22579)

2020-10-20T04:46:10+00:00

(cherry picked from commit 2ef5caa58febc8968e670e39e3d37cf8eef3cab8)

Co-authored-by: Serhiy Storchaka