delta/cpython-git.git, branch v3.9.16

Python 3.9.16

2022-12-06T17:59:46+00:00

[3.9] gh-100001: Omit control characters in http.server stderr logs. (GH-100002) (#100032)

2022-12-06T10:22:12+00:00

* gh-100001: Omit control characters in http.server stderr logs. (GH-100002)

Replace control characters in http.server.BaseHTTPRequestHandler.log_message with an escaped \xHH sequence to avoid causing problems for the terminal the output is printed to.
(cherry picked from commit d8ab0a4dfa48f881b4ac9ab857d2e9de42f72828)

Co-authored-by: Gregory P. Smith 

* also escape \s (backport of PR #100038).

* add versionadded and remove extra 'to'

Co-authored-by: Gregory P. Smith

[3.9] gh-87604: Avoid publishing list of active per-interpreter audit hooks via the gc module (GH-99373) (GH-99493)

2022-11-21T18:13:33+00:00

[3.9] gh-98433: Fix quadratic time idna decoding. (GH-99092) (GH-99222) (#99230)

2022-11-10T15:57:41+00:00

There was an unnecessary quadratic loop in idna decoding. This restores
the behavior to linear.

(cherry picked from commit d315722564927c7202dd6e111dc79eaf14240b0d)
(cherry picked from commit a6f6c3a3d6f2b580f2d87885c9b8a9350ad7bf15)

Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Co-authored-by: Gregory P. Smith

[3.9] gh-97514: Don't use Linux abstract sockets for multiprocessing (GH-98501) (#98504)

2022-10-28T10:08:30+00:00

Linux abstract sockets are insecure as they lack any form of filesystem
permissions so their use allows anyone on the system to inject code into
the process.

This removes the default preference for abstract sockets in
multiprocessing introduced in Python 3.9+ via
https://github.com/python/cpython/pull/18866 while fixing
https://github.com/python/cpython/issues/84031.

Explicit use of an abstract socket by a user now generates a
RuntimeWarning.  If we choose to keep this warning, it should be
backported to the 3.7 and 3.8 branches.
(cherry picked from commit 49f61068f49747164988ffc5a442d2a63874fc17)

Co-authored-by: Gregory P. Smith

[3.9] gh-98517: Fix buffer overflows in _sha3 module (GH-98519) (#98526)

2022-10-28T10:08:06+00:00

This is a port of the applicable part of XKCP's fix [1] for
CVE-2022-37454 and avoids the segmentation fault and the infinite
loop in the test cases published in [2].

[1]: https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc38364248975e08e340a
[2]: https://mouha.be/sha-3-buffer-overflow/

Regression test added by: Gregory P. Smith [Google LLC] 
(cherry picked from commit 0e4e058602d93b88256ff90bbef501ba20be9dd3)

Co-authored-by: Theo Buehler

[3.9] gh-98739: Update libexpat from 2.4.9 to 2.5.0 (GH-98742) (#98786)

2022-10-28T10:07:32+00:00

Update libexpat from 2.4.9 to 2.5.0 to address CVE-2022-43680.

Co-authored-by: Shaun Walbridge 
(cherry picked from commit 3e07f827b359617664ad0880f218f17ae4483299)

[3.9] gh-96710: Make the test timing more lenient for the int/str DoS regression test. (GH-96717) (#98196)

2022-10-11T21:13:54+00:00

gh-96710: Make the test timing more lenient for the int/str DoS regression test. (GH-96717)

A regression would still absolutely fail and even a flaky pass isn't
harmful as it'd fail most of the time across our N system test runs.

Windows has a low resolution timer and CI systems are prone to odd
timing so this just gives more leeway to avoid flakiness.
(cherry picked from commit 11e3548fd1d3445ccde971d613633b58d73c3016)

Co-authored-by: Gregory P. Smith

[3.9] gh-68966: Make mailcap refuse to match unsafe filenames/types/params (GH-91993) (#98190)

2022-10-11T21:13:18+00:00

gh-68966: Make mailcap refuse to match unsafe filenames/types/params (GH-91993)
(cherry picked from commit b9509ba7a9c668b984dab876c7926fe1dc5aa0ba)

Co-authored-by: Petr Viktorin

Post 3.9.15

2022-10-11T15:38:29+00:00