delta/cpython-git.git, branch v3.8.14

Python 3.8.14

2022-09-06T20:59:22+00:00

[3.8] gh-95778: CVE-2020-10735: Prevent DoS by very large int() (#96503)

2022-09-05T20:26:09+00:00

* Correctly pre-check for int-to-str conversion

Converting a large enough `int` to a decimal string raises `ValueError` as expected. However, the raise comes _after_ the quadratic-time base-conversion algorithm has run to completion. For effective DOS prevention, we need some kind of check before entering the quadratic-time loop. Oops! =)

The quick fix: essentially we catch _most_ values that exceed the threshold up front. Those that slip through will still be on the small side (read: sufficiently fast), and will get caught by the existing check so that the limit remains exact.

The justification for the current check. The C code check is:
```c
max_str_digits / (3 * PyLong_SHIFT) <= (size_a - 11) / 10
```

In GitHub markdown math-speak, writing $M$ for `max_str_digits`, $L$ for `PyLong_SHIFT` and $s$ for `size_a`, that check is:
$$\left\lfloor\frac{M}{3L}\right\rfloor \le \left\lfloor\frac{s - 11}{10}\right\rfloor$$

From this it follows that
$$\frac{M}{3L} < \frac{s-1}{10}$$
hence that
$$\frac{L(s-1)}{M} > \frac{10}{3} > \log_2(10).$$
So
$$2^{L(s-1)} > 10^M.$$
But our input integer $a$ satisfies $|a| \ge 2^{L(s-1)}$, so $|a|$ is larger than $10^M$. This shows that we don't accidentally capture anything _below_ the intended limit in the check.


* Issue: gh-95778


Co-authored-by: Gregory P. Smith [Google LLC] 
Co-authored-by: Christian Heimes 
Co-authored-by: Mark Dickinson

[3.8] gh-90359: Update documentation to follow PEP 495. (gh-94800). (GH-94834)

2022-07-28T19:30:13+00:00

(cherry picked from commit 07374cce52abb7fd39729dc1b646ca3029b64c64)

Co-authored-by: Dong-hee Na

[3.8] gh-94208: Add more TLS version/protocol checks for FreeBSD (GH-94347) (GH-95313)

2022-07-27T21:43:29+00:00

Three test cases were failing on FreeBSD with latest OpenSSL.
(cherry picked from commit 1bc86c26253befa006c0f52eebb6ed633c7d1e5c)

Co-authored-by: Christian Heimes

[3.8] gh-90355: Add isolated flag if currently isolated (GH-92857) (GH-94571)

2022-07-05T16:07:36+00:00

Co-authored-by: Carter Dodd 
Co-authored-by: Éric 
Co-authored-by: Łukasz Langa 
(cherry picked from commit c8556bcf6c0b05ac46bd74880626a2853e7c99a1)

[3.8] gh-81054: Document that SimpleHTTPRequestHandler follows symbolic links (GH-94416) (GH-94495)

2022-07-01T16:42:13+00:00

(cherry picked from commit 80aaeabb8bd1e6b49598a7e23e0f8d99b3fcecaf)

Co-authored-by: Sam Ezeh

gh-91172: Create a workflow for verifying bundled pip and setuptools (GH-31885) (GH-94124)

2022-06-22T14:07:57+00:00

Co-authored-by: Hugo van Kemenade 
Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com>
(cherry picked from commit d36954b7ead06daead3dcf9b0dd9f8002eab508f)

Co-authored-by: Illia Volochii

gh-87389: Fix an open redirection vulnerability in http.server. (GH-93879) (GH-94094)

2022-06-22T08:42:52+00:00

Fix an open redirection vulnerability in the `http.server` module when
an URI path starts with `//` that could produce a 301 Location header
with a misleading target.  Vulnerability discovered, and logic fix
proposed, by Hamza Avvan (@hamzaavvan).

Test and comments authored by Gregory P. Smith [Google].
(cherry picked from commit 4abab6b603dd38bec1168e9a37c40a48ec89508e)

Co-authored-by: Gregory P. Smith

gh-83728: Add hmac.new default parameter deprecation (GH-91939) (GH-93547)

2022-06-06T17:10:34+00:00

(cherry picked from commit 56b5daf15970be449d44e91f08db84c698ac5506)

Co-authored-by: Stanley <46876382+slateny@users.noreply.github.com>

bpo-46114: Fix OpenSSL version check for 3.0.1 (GH-30170) (GH-92954)

2022-06-06T16:46:16+00:00

(cherry picked from commit 2985feac4e02d590bb78bcce9e30864be53280ac)

Co-authored-by: Christian Heimes