delta/cpython-git.git, branch v3.7.16

Python 3.7.16

2022-12-06T19:00:00+00:00

[3.7] gh-100001: Omit control characters in http.server stderr logs. (GH-100002) (GH-100034)

2022-12-05T23:10:10+00:00

Replace control characters in http.server.BaseHTTPRequestHandler.log_message with an escaped \xHH sequence to avoid causing problems for the terminal the output is printed to.
(cherry picked from commit d8ab0a4dfa48f881b4ac9ab857d2e9de42f72828)

Co-authored-by: Gregory P. Smith

[3.7] gh-98433: Fix quadratic time idna decoding. (GH-99092) (GH-99232)

2022-11-08T03:22:14+00:00

There was an unnecessary quadratic loop in idna decoding. This restores
the behavior to linear.

(cherry picked from commit a6f6c3a3d6f2b580f2d87885c9b8a9350ad7bf15)

Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Co-authored-by: Gregory P. Smith

[3.7] gh-98739: Update libexpat from 2.4.9 to 2.5.0 (GH-98742) (#98788)

2022-10-28T10:06:50+00:00

Update libexpat from 2.4.9 to 2.5.0 to address CVE-2022-43680.

Co-authored-by: Shaun Walbridge 
(cherry picked from commit 3e07f827b359617664ad0880f218f17ae4483299)

[3.7] gh-98517: Fix buffer overflows in _sha3 module (GH-98519) (GH-98528)

2022-10-22T03:37:54+00:00

This is a port of the applicable part of XKCP's fix [1] for
CVE-2022-37454 and avoids the segmentation fault and the infinite
loop in the test cases published in [2].

[1]: https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc38364248975e08e340a
[2]: https://mouha.be/sha-3-buffer-overflow/

Regression test added by: Gregory P. Smith [Google LLC] 
(cherry picked from commit 0e4e058602d93b88256ff90bbef501ba20be9dd3)

Co-authored-by: Theo Buehler

[3.7] gh-96710: Make the test timing more lenient for the int/str DoS regression test. (GH-96717) (#98195)

2022-10-11T21:14:05+00:00

gh-96710: Make the test timing more lenient for the int/str DoS regression test. (GH-96717)

A regression would still absolutely fail and even a flaky pass isn't
harmful as it'd fail most of the time across our N system test runs.

Windows has a low resolution timer and CI systems are prone to odd
timing so this just gives more leeway to avoid flakiness.
(cherry picked from commit 11e3548fd1d3445ccde971d613633b58d73c3016)

Co-authored-by: Gregory P. Smith

[3.7] gh-68966: Make mailcap refuse to match unsafe filenames/types/params (GH-91993) (GH-98191)

2022-10-11T20:27:14+00:00

gh-68966: Make mailcap refuse to match unsafe filenames/types/params (GH-91993)
(cherry picked from commit b9509ba7a9c668b984dab876c7926fe1dc5aa0ba)

Co-authored-by: Petr Viktorin

Post release updates

2022-10-11T07:36:35+00:00

3.7.15

2022-10-10T12:34:53+00:00

[3.7] gh-97612: Fix shell injection in get-remote-certificate.py (#97613) (#97634)

2022-10-05T21:56:13+00:00

Fix a shell code injection vulnerability in the
get-remote-certificate.py example script. The script no longer uses a
shell to run "openssl" commands. Issue reported and initial fix by
Caleb Shortt.

Remove the Windows code path to send "quit" on stdin to the "openssl
s_client" command: use DEVNULL on all platforms instead.

Co-authored-by: Caleb Shortt 
(cherry picked from commit 83a0f44ffd8b398673ae56c310cf5768d359c341)