bpo-40791: Make compare_digest more constant-time. (GH-23438)
The existing volatile `left`/`right` pointers guarantee that the reads will all occur, but does not guarantee that they will be _used_. So a compiler can still short-circuit the loop, saving e.g. the overhead of doing the xors and especially the overhead of the data dependency between `result` and the reads. That would change performance depending on where the first unequal byte occurs. This change removes that optimization.
Serhiy Storchaka [Tue, 10 Nov 2020 19:54:15 +0000 (21:54 +0200)]
[3.7] bpo-42103: Improve validation of Plist files. (GH-22882) (#23117)
* Prevent some possible DoS attacks via providing invalid Plist files
with extremely large number of objects or collection sizes.
* Raise InvalidFileException for too large bytes and string size instead of returning garbage.
* Raise InvalidFileException instead of ValueError for specific invalid datetime (NaN).
* Raise InvalidFileException instead of TypeError for non-hashable dict keys.
* Add more tests for invalid Plist files..
(cherry picked from commit 34637a0ce21e7261b952fbd9d006474cc29b681f)
bpo-39603: Prevent header injection in http methods (GH-18485) (GH-21538)
reject control chars in http method in http.client.putrequest to prevent http header injection
(cherry picked from commit 8ca8a2e8fb068863c1138f07e3098478ef8be12e)
Co-authored-by: AMIR <31338382+amiremohamadi@users.noreply.github.com>
bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (GH-21484)
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121a1f3ef5ad7c105ee378cc79a3eac0c7d4)
Tapas Kundu [Tue, 30 Jun 2020 19:20:21 +0000 (00:50 +0530)]
[3.7] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interface (GH-21033) (GH-21231)
CVE-2020-14422
The __hash__() methods of classes IPv4Interface and IPv6Interface had issue
of generating constant hash values of 32 and 128 respectively causing hash collisions.
The fix uses the hash() function to generate hash values for the objects
instead of XOR operation
(cherry picked from commit b30ee26e366bf509b7538d79bfec6c6d38d53f28)
Co-authored-by: Ravi Teja P <rvteja92@gmail.com> Signed-off-by: Tapas Kundu <tkundu@vmware.com>
Ned Deily [Wed, 17 Jun 2020 07:18:55 +0000 (03:18 -0400)]
bpo-39580: add check for CLI installation on macOS
Adds a simple check for whether or not the package is being installed in the GUI or using installer on the command line. This addresses an issue where CLI-based software management tools (such as Munki) unexpectedly open Finder windows into a GUI session during installation runs.
ensurepip optionally installs or upgrades 'pip' and 'setuptools' using
the version of those modules bundled with Python. The internal PIP
installation routine by default temporarily uses its cache, if it
exists. This is undesirable as Python builds and installations may be
independent of the user running the build, whilst PIP cache location
is dependent on the user's environment and outside of the build
environment.
At the same time, there's no value in using the cache while installing
bundled modules.
[3.7] bpo-34226: fix cgi.parse_multipart without content_length (GH-8530) (GH-20892)
In Python 3.7 the behavior of parse_multipart changed requiring CONTENT-LENGTH
header, this fix remove this header as required and fix FieldStorage
read_lines_to_outerboundary, by not using limit when it's negative,
since by default it's -1 if not content-length and keeps substracting what
was read from the file object.
bpo-29620: iterate over a copy of sys.modules (GH-4800) (GH-20817)
unittest.TestCase.assertWarns no longer raises a RuntimeException
when accessing a module's ``__warningregistry__`` causes importation of a new
module, or when a new module is imported in another thread.
(cherry picked from commit 46398fba4d66ad342cf2504ef947b5fb857423b2)
Antoine Pitrou [Wed, 10 Jun 2020 20:37:21 +0000 (22:37 +0200)]
[3.7] bpo-40895: Update weakref documentation to remove old warnings (GH-20687) (GH-20793)
The doccumentation at https://docs.python.org/3.10/library/weakref.html cautions that the `WeakKeyDictionary` and `WeakValueDictionary` are susceptible to the problem of dictionary mutation during iteration.
These notes present the user with a problem that has no easy solution.
I dug into the implementation and found that fortunately, Antoine Pitrou already addressed this challenge (10 years ago!) by introducing an `_IterationGuard` context manager to the implementation, which delays mutation while an iteration is in progress.
I asked for confirmation and @pitrou agreed that these notes could be removed:
https://github.com/python/cpython/commit/c1baa601e2b558deb690edfdf334fceee3b03327GH-commitcomment-39514438.
(cherry picked from commit 1642c0ef750f96664a98cadb09301d492098d2fb)
Co-authored-by: Daniel Fortunov <asqui@users.noreply.github.com> Automerge-Triggered-By: @pitrou
Before
```
content.txt is 42 bytes in size and isa regular file.
folder is 420 bytes in size and isa directory.
magic is 4200 bytes in size and issomething else.
```
After:
```
content.txt is 42 bytes in size and is a regular file.
folder is 420 bytes in size and is a directory.
magic is 4200 bytes in size and is something else.
```
bpo-40767: Allow pure Wayland to get default XDG web browser (GH-20382)
Would be nice to backport to python 3.7+. I don't think it's worth the hassle to backport this all the way down to 3.10. But I'll let the maintainers decide.
This is hard to test because the test setup already includes this [environment variable](https://github.com/python/cpython/blob/master/Lib/test/pythoninfo.pyGH-L292)
Let me know if something doesn't match the PR guidelines. This is my first PR in the python source code.
(cherry picked from commit c822efeda9a0afe87cf3429724732fc8e19a01fb)
Co-authored-by: Jeremy Attali <jeremy.attali@gmail.com>
Fix :mod:`ssl`` code to be compatible with OpenSSL 1.1.x builds that use
``no-deprecated`` and ``--api=1.1.0``.
Note: Tests assume full OpenSSL API and fail with limited API.
Signed-off-by: Christian Heimes <christian@python.org> Co-authored-by: Mark Wright <gienah@gentoo.org>
(cherry picked from commit a871f692b4a2e6c7d45579693e787edc0af1a02c)
Co-authored-by: Christian Heimes <christian@python.org>
bpo-39885: Make IDLE context menu cut and copy work again (GH-18951)
Leave selection when right click within. This exception to clearing selections when right-clicking was omitted from the previous commit, 4ca060d. I did not realize that this completely disabled the context menu entries, and I should have merged a minimal fix immediately. An automated test should follow.
(cherry picked from commit 97e4e0f53d6690db6b942678489716a30925b8af)
Co-authored-by: Terry Jan Reedy <tjreedy@udel.edu>
[3.8] bpo-25872: Fix KeyError in linecache when multithreaded (GH-18007) (GH-20092)
Backporting to 3.8 and adding a NEWS item (I should have added one to the master branch -- oh well).
(cherry picked from commit b86636bff4b29ce23c886df079715dd951f13a07)
bpo-39040: Fix parsing of email mime headers with whitespace between encoded-words. (gh-17620)
* bpo-39040: Fix parsing of email headers with encoded-words inside a quoted string.
It is fairly common to find malformed mime headers (especially content-disposition
headers) where the parameter values, instead of being encoded to RFC
standards, are "encoded" by doing RFC 2047 "encoded word" encoding, and
then enclosing the whole thing in quotes. The processing of these malformed
headers was incorrectly leaving the spaces between encoded words in the decoded
text (whitespace between adjacent encoded words is supposed to be stripped on
decoding). This changeset fixes the encoded word processing inside quoted strings
(bare-quoted-string) to do correct RFC 2047 decoding by stripping that
whitespace.
(cherry picked from commit 21017ed904f734be9f195ae1274eb81426a9e776)
* Use a more universal explanation of string interpolation rather than specifically referencing sprintf(), which depends on the reader having a C background.
bpo-13097: ctypes: limit callback to 1024 arguments (GH-19914)
ctypes now raises an ArgumentError when a callback
is invoked with more than 1024 arguments.
The ctypes module allocates arguments on the stack in
ctypes_callproc() using alloca(), which is problematic
when large numbers of arguments are passed. Instead
of a stack overflow, this commit raises an ArgumentError
if more than 1024 parameters are passed.
(cherry picked from commit 29a1384c040d39659e7d01f1fd7b6eb71ef2634e)
Co-authored-by: Sean Gillespie <sean@swgillespie.me>
bpo-39073: validate Address parts to disallow CRLF (GH-19007)
Disallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks.
(cherry picked from commit 614f17211c5fc0e5b828be1d3320661d1038fe8f)
Fix the link to ncurses patch download in macos installer build script (GH-20421)
Reason: the link `ftp://invisible-island.net/ncurses//5.9/ncurses-5.9-20120616-patch.sh.bz2` is dead, which prevents `Mac/BuildScript/build-installer.py` from completing. Looks like the host of the FTP server was changed to `ftp.invisible-island.net`, thus this proposal.
bpo-39631: Fix file association MIME type in the Windows installer (GH-20205)
Use text/x-python instead of text/plain to avoid issues with tools assuming that "ShellExecute(script)" is a non-executable operation.
(cherry picked from commit 8c862e51248c5ebfec787badec88eb58c9267e1e)
distutils.tests now saves/restores warnings filters to leave them
unchanged. Importing tests imports docutils which imports
pkg_resources which adds a warnings filter.
(cherry picked from commit 6e57237faf0da8904e0130a11350cae3c5062b82)
Co-authored-by: Victor Stinner <vstinner@python.org>
[3.8] bpo-40548: GitHub Action workflow: skip jobs on doc only PRs (GH-20100)
* bpo-40548: Always run GitHub action, even on doc PRs (GH-19981)
Always run GitHub action jobs, even on documentation-only pull
requests. So it will be possible to make a GitHub action job, like
the Windows (64-bit) job, mandatory.
Co-authored-by: Filipe Laíns <filipe.lains@gmail.com> Co-authored-by: Filipe Laíns <lains@archlinux.org>
(cherry picked from commit 07bd5cf3d9551ae84100e6400836163fcd507f07)
Co-authored-by: Victor Stinner <vstinner@python.org>
bpo-40561: Add docstrings for webbrowser open functions (GH-19999)
Co-authored-by: Brad Solomon <brsolomon@deloitte.com> Co-authored-by: Terry Jan Reedy <tjreedy@udel.edu>
(cherry picked from commit ef7973a981ff8f4687ef3fdb85a69fa15aa11fe5)
projects / thirdparty / Python / cpython.git / log
