summaryrefslogtreecommitdiff
path: root/Lib
Commit message (Collapse)AuthorAgeFilesLines
...
* bpo-38688, shutil.copytree: consume iterator and create list of entries to ↵Bruno P. Kinoshita2019-11-272-6/+18
| | | | prevent infinite recursion (GH-17098)
* bpo-38045: Improve the performance of _decompose() in enum.py (GH-16483)HongWeipeng2019-11-261-23/+10
| | | | | | * Improve the performance of _decompose() in enum.py Co-Authored-By: Brandt Bucher <brandtbucher@gmail.com>
* bpo-27145: small_ints[x] could be returned in long_add and long_sub (GH-15716)HongWeipeng2019-11-261-0/+8
|
* bpo-38328: Speed up the creation time of constant list and set display. ↵Brandt Bucher2019-11-261-1/+1
| | | | (GH-17114)
* bpo-20928: support base-URL and recursive includes in etree.ElementInclude ↵Stefan Behnel2019-11-252-7/+131
| | | | | | | | | | | | (#5723) * bpo-20928: bring elementtree's XInclude support en-par with the implementation in lxml by adding support for recursive includes and a base-URL. * bpo-20928: Support xincluding the same file multiple times, just not recursively. * bpo-20928: Add 'max_depth' parameter to xinclude that limits the maximum recursion depth to 6 by default. * Add news entry for updated ElementInclude support
* bpo-38870: Remove dependency on contextlib to avoid performance regression ↵Pablo Galindo2019-11-251-7/+13
| | | | | | | | | on import (GH-17376) https://bugs.python.org/issue38870 Automerge-Triggered-By: @pablogsal
* bpo-38870: Expose a function to unparse an ast object in the ast module ↵Pablo Galindo2019-11-242-47/+750
| | | | | | | (GH-17302) Add ast.unparse() as a function in the ast module that can be used to unparse an ast.AST object and produce a string with code that would produce an equivalent ast.AST object when parsed.
* bpo-38862: IDLE Strip Trailing Whitespace fixes end newlines (GH-17366)Terry Jan Reedy2019-11-245-40/+65
| | | Extra newlines are removed at the end of non-shell files. If the file only has newlines after stripping other trailing whitespace, all are removed, as is done by patchcheck.py.
* bpo-38876: Raise pickle.UnpicklingError when loading an item from memo for ↵Claudiu Popa2019-11-242-4/+18
| | | | | | | | | | | | | | | invalid input (GH-17335) The previous code was raising a `KeyError` for both the Python and C implementation. This was caused by the specified index of an invalid input which did not exist in the memo structure, where the pickle stores what objects it has seen. The malformed input would have caused either a `BINGET` or `LONG_BINGET` load from the memo, leading to a `KeyError` as the determined index was bogus. https://bugs.python.org/issue38876 https://bugs.python.org/issue38876
* Remove unnecessary variable definition (GH-17368)Batuhan Taşkaya2019-11-241-1/+0
|
* Better runtime TypedDict (GH-17214)Zac Hatfield-Dodds2019-11-242-3/+22
| | | | | This patch enables downstream projects inspecting a TypedDict subclass at runtime to tell which keys are optional. This is essential for generating test data with Hypothesis or validating inputs with typeguard or pydantic.
* bpo-38881: choices() raises ValueError when all weights are zero (GH-17362)Raymond Hettinger2019-11-232-1/+8
|
* bpo-38899: virtual environment activation for fish should use `source` ↵Brett Cannon2019-11-221-2/+2
| | | | | | | | | | | | (GH-17359) The previously documented use of `.` is considered deprecated (https://fishshell.com/docs/current/commands.html#source). https://bugs.python.org/issue38899 Automerge-Triggered-By: @brettcannon
* bpo-38686: fix HTTP Digest handling in request.py (#17045)PypeBros2019-11-221-2/+4
| | | | | | | | | | | | | | | | | | | | | * fix HTTP Digest handling in request.py There is a bug triggered when server replies to a request with `WWW-Authenticate: Digest` where `qop="auth,auth-int"` rather than mere `qop="auth"`. Having both `auth` and `auth-int` is legitimate according to the `qop-options` rule in §3.2.1 of [[https://www.ietf.org/rfc/rfc2617.txt|RFC 2617]]: > qop-options = "qop" "=" <"> 1#qop-value <"> > qop-value = "auth" | "auth-int" | token > **qop-options**: [...] If present, it is a quoted string **of one or more** tokens indicating the "quality of protection" values supported by the server. The value `"auth"` indicates authentication; the value `"auth-int"` indicates authentication with integrity protection This is description confirmed by the definition of the [//n//]`#`[//m//]//rule// extended-BNF pattern defined in §2.1 of [[https://www.ietf.org/rfc/rfc2616.txt|RFC 2616]] as 'a comma-separated list of //rule// with at least //n// and at most //m// items'. When this reply is parsed by `get_authorization`, request.py only tests for identity with `'auth'`, failing to recognize it as one of the supported modes the server announced, and claims that `"qop 'auth,auth-int' is not supported"`. * 📜🤖 Added by blurb_it. * bpo-38686 review fix: remember why. * fix trailing space in Lib/urllib/request.py Co-Authored-By: Brandt Bucher <brandtbucher@gmail.com>
* bpo-38804: Fix REDoS in http.cookiejar (GH-17157)bcaller2019-11-222-6/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The regex http.cookiejar.LOOSE_HTTP_DATE_RE was vulnerable to regular expression denial of service (REDoS). LOOSE_HTTP_DATE_RE.match is called when using http.cookiejar.CookieJar to parse Set-Cookie headers returned by a server. Processing a response from a malicious HTTP server can lead to extreme CPU usage and execution will be blocked for a long time. The regex contained multiple overlapping \s* capture groups. Ignoring the ?-optional capture groups the regex could be simplified to \d+-\w+-\d+(\s*\s*\s*)$ Therefore, a long sequence of spaces can trigger bad performance. Matching a malicious string such as LOOSE_HTTP_DATE_RE.match("1-c-1" + (" " * 2000) + "!") caused catastrophic backtracking. The fix removes ambiguity about which \s* should match a particular space. You can create a malicious server which responds with Set-Cookie headers to attack all python programs which access it e.g. from http.server import BaseHTTPRequestHandler, HTTPServer def make_set_cookie_value(n_spaces): spaces = " " * n_spaces expiry = f"1-c-1{spaces}!" return f"b;Expires={expiry}" class Handler(BaseHTTPRequestHandler): def do_GET(self): self.log_request(204) self.send_response_only(204) # Don't bother sending Server and Date n_spaces = ( int(self.path[1:]) # Can GET e.g. /100 to test shorter sequences if len(self.path) > 1 else 65506 # Max header line length 65536 ) value = make_set_cookie_value(n_spaces) for i in range(99): # Not necessary, but we can have up to 100 header lines self.send_header("Set-Cookie", value) self.end_headers() if __name__ == "__main__": HTTPServer(("", 44020), Handler).serve_forever() This server returns 99 Set-Cookie headers. Each has 65506 spaces. Extracting the cookies will pretty much never complete. Vulnerable client using the example at the bottom of https://docs.python.org/3/library/http.cookiejar.html : import http.cookiejar, urllib.request cj = http.cookiejar.CookieJar() opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj)) r = opener.open("http://localhost:44020/") The popular requests library was also vulnerable without any additional options (as it uses http.cookiejar by default): import requests requests.get("http://localhost:44020/") * Regression test for http.cookiejar REDoS If we regress, this test will take a very long time. * Improve performance of http.cookiejar.ISO_DATE_RE A string like "444444" + (" " * 2000) + "A" could cause poor performance due to the 2 overlapping \s* groups, although this is not as serious as the REDoS in LOOSE_HTTP_DATE_RE was.
* bpo-38866: Remove asyncore from test_pyclbr.py (GH-17316)jacksonriley2019-11-221-1/+1
| | | Co-Authored-By: Kyle Stanley <aeros167@gmail.com>
* bpo-38863: Improve is_cgi() in http.server (GH-17312)Siwon Kang2019-11-222-2/+28
| | | | | | | | | | | | | | | | | | | is_cgi() function of http.server library does not currently handle a cgi script if one of the cgi_directories is located at the sub-directory of given path. Since is_cgi() in CGIHTTPRequestHandler class separates given path into (dir, rest) based on the first seen '/', multi-level directories like /sub/dir/cgi-bin/hello.py is divided into head=/sub, rest=dir/cgi-bin/hello.py then check whether '/sub' exists in cgi_directories = [..., '/sub/dir/cgi-bin']. This patch makes the is_cgi() keep expanding dir part to the next '/' then checking if that expanded path exists in the cgi_directories. Signed-off-by: Siwon Kang <kkangshawn@gmail.com> https://bugs.python.org/issue38863
* Defer import of shutil which only needed for help and usage (GH-17334)Raymond Hettinger2019-11-211-3/+3
|
* bpo-37838: get_type_hints for wrapped functions with forward reference ↵benedwards142019-11-213-1/+27
| | | | | | (GH-17126) https://bugs.python.org/issue37838
* bpo-38692: Skip test_posix.test_pidfd_open() on EPERM (GH-17290)Victor Stinner2019-11-211-0/+2
| | | | | | Skip the test_posix.test_pidfd_open() test if os.pidfd_open() fails with a PermissionError. This situation can happen in a Linux sandbox using a syscall whitelist which doesn't allow the pidfd_open() syscall yet (like systemd-nspawn).
* bpo-38875: test_capi: trashcan tests require cpu resource (GH-17314)Victor Stinner2019-11-211-0/+2
| | | test_capi: trashcan tests now require the test "cpu" resource.
* Produce cleaner bytecode for 'with' and 'async with' by generating separate ↵Mark Shannon2019-11-214-41/+63
| | | | | | code for normal and exceptional paths. (#6641) Remove BEGIN_FINALLY, END_FINALLY, CALL_FINALLY and POP_FINALLY bytecodes. Implement finally blocks by code duplication. Reimplement frame.lineno setter using line numbers rather than bytecode offsets.
* bpo-38857: AsyncMock fix for awaitable values and StopIteration fix [3.8] ↵Jason Fried2019-11-202-41/+95
| | | | (GH-17269)
* bpo-38841: Skip asyncio test_create_datagram_endpoint_existing_sock_unix ↵xdegaye2019-11-201-1/+1
| | | | | | | | | | | | | (GH-17294) on platforms lacking a functional bind() for named unix domain sockets https://bugs.python.org/issue38841 Automerge-Triggered-By: @asvetlov
* bpo-38821: Fix crash in argparse when using gettext (GH-17192)Federico Bond2019-11-201-2/+3
|
* bpo-38636: Fix IDLE tab toggle and file indent width (GH-17008)Terry Jan Reedy2019-11-204-6/+45
| | | | | These Format menu functions (default shortcuts Alt-T and Alt-U) were mistakenly disabled in 3.7.5 and 3.8.0.
* closes bpo-38712: Add signal.pidfd_send_signal. (GH-17070)Benjamin Peterson2019-11-191-0/+19
| | | | | | | | This exposes a Linux-specific syscall for sending a signal to a process identified by a file descriptor rather than a pid. For simplicity, we don't support the siginfo_t parameter to the syscall. This parameter allows implementing a pidfd version of rt_sigqueueinfo(2), which Python also doesn't support.
* Merge tag 'v3.9.0a1'Łukasz Langa2019-11-201-228/+338
|\
| * Python 3.9.0a1v3.9.0a1Łukasz Langa2019-11-191-228/+338
| |
* | bpo-37957: Allow regrtest to receive a file with test (and subtests) to ↵Pablo Galindo2019-11-196-24/+166
| | | | | | | | | | | | | | ignore (GH-16989) When building Python in some uncommon platforms there are some known tests that will fail. Right now, the test suite has the ability to ignore entire tests using the -x option and to receive a filter file using the --matchfile filter. The problem with the --matchfile option is that it receives a file with patterns to accept and when you want to ignore a couple of tests and subtests, is too cumbersome to lists ALL tests that are not the ones that you want to accept and he problem with -x is that is not easy to ignore just a subtests that fail and the whole test needs to be ignored. For these reasons, add a new option to allow to ignore a list of test and subtests for these situations.
* | Remove binding of captured exceptions when not used to reduce the chances of ↵Pablo Galindo2019-11-1928-39/+39
| | | | | | | | | | | | | | creating cycles (GH-17246) Capturing exceptions into names can lead to reference cycles though the __traceback__ attribute of the exceptions in some obscure cases that have been reported previously and fixed individually. As these variables are not used anyway, we can remove the binding to reduce the chances of creating reference cycles. See for example GH-13135
* | bpo-38707: Fix for multiprocessing.Process MainThread.native_id (GH-17088)Jake Tesler2019-11-192-0/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR implements a fix for `multiprocessing.Process` objects; the error occurs when Processes are created using either `fork` or `forkserver` as the `start_method`. In these instances, the `MainThread` of the newly created `Process` object retains all attributes from its parent's `MainThread` object, including the `native_id` attribute. The resulting behavior is such that the new process' `MainThread` captures an incorrect/outdated `native_id` (the parent's instead of its own). This change forces the Process object to update its `native_id` attribute during the bootstrap process. cc @vstinner https://bugs.python.org/issue38707 Automerge-Triggered-By: @pitrou
* | bpo-38839: Fix some unused functions in tests (GH-17189)Adam Johnson2019-11-197-12/+11
| |
* | bpo-35409: Ignore GeneratorExit in async_gen_athrow_throw (GH-14755)Vincent Michel2019-11-191-0/+27
|/ | | | | | | | | Ignore `GeneratorExit` exceptions when throwing an exception into the `aclose` coroutine of an asynchronous generator. https://bugs.python.org/issue35409
* bpo-22367: Update test_fcntl.py for spawn process mode (#17154)Dong-hee Na2019-11-191-9/+19
|
* bpo-38807: Add os.PathLike to exception message raised by _check_arg_types ↵Tomás Farías2019-11-181-2/+2
| | | | (#17160)
* bpo-38622: Add missing audit events for ctypes module (GH-17158)Steve Dower2019-11-181-0/+4
|
* bpo-38722: Runpy use io.open_code() (GH-17234)jsnklln2019-11-181-2/+3
| | | | | | | https://bugs.python.org/issue38722 Automerge-Triggered-By: @taleinat
* Revert "bpo-38811: Check for presence of os.link method in pathlib. ↵Victor Stinner2019-11-182-26/+1
| | | | | (GH-17170)" (#17219) This reverts commit 111772fc27cfe388bc060f019d68a3e33481ec65.
* bpo-38811: Check for presence of os.link method in pathlib. (GH-17170)Toke Høiland-Jørgensen2019-11-172-1/+26
| | | | | Fix also the Path.symplink() method implementation for the case when symlinks are not supported.
* bpo-38724: Implement subprocess.Popen.__repr__ (GH-17151)Andrey Doroschenko2019-11-172-0/+33
|
* Fix typo in Lib/socketserver.py (GH-17024)Jason (Perry) Taylor2019-11-161-1/+1
| | | | changed 'This is bad class design, but save some typing' into 'This is bad class design, but saves some typing'.
* bpo-28286: Deprecate opening GzipFile for writing implicitly. (GH-16417)Serhiy Storchaka2019-11-162-1/+11
| | | | Always specify the mode argument for writing.
* bpo-38639: Optimize floor(), ceil() and trunc() for floats. (GH-16991)Serhiy Storchaka2019-11-161-21/+40
|
* bpo-38453: Ensure correct short path is obtained for test (GH-17184)Steve Dower2019-11-151-3/+21
|
* bpo-38453: Ensure ntpath.realpath correctly resolves relative paths (GH-16967)Steve Dower2019-11-153-45/+105
| | | | | Ensure isabs() is always True for \\?\ prefixed paths Avoid unnecessary usage of readlink() to avoid resolving broken links incorrectly Ensure shutil tests run in test directory
* bpo-38692: Add asyncio.PidfdChildWatcher to __all__ (GH-17161)Kyle Stanley2019-11-141-1/+1
| | | | | | | | | | /cc @asvetlov @1st1 https://bugs.python.org/issue38692 Automerge-Triggered-By: @benjaminp
* closes bpo-38692: Add a pidfd child process watcher to asyncio. (GH-17069)Benjamin Peterson2019-11-132-0/+85
|
* bpo-38785: Prevent asyncio from crashing (GH-17144)Andrew Svetlov2019-11-132-1/+43
| | | | | | | if parent `__init__` is not called from a constructor of object derived from `asyncio.Future` https://bugs.python.org/issue38785
* bpo-38786: Add parsing of https links to pydoc (GH-17143)Kirill2019-11-133-2/+13
|
View Lorry Controller Status