Ben Darnell [Wed, 12 Jun 2024 01:35:51 +0000 (21:35 -0400)]
docs: Update sphinx (and the rest of the deps)
Remove pin to sphinx 5.x and remove sphinx-asyncio. Sphinx now supports
asyncio out of the box. Everything I've checked looks fine although I
haven't looked at every page.
Ben Darnell [Tue, 11 Jun 2024 16:16:55 +0000 (12:16 -0400)]
twisted: Delete TwistedResolver class
This class was deprecated and slated for deletion in Tornado 7.0.
However, it has become broken due to the adoption of RFC 8482
(which limits the use of the ANY query type in DNS) and it now fails
for most domain names (with the exception of localhost).
The upstream issue https://github.com/twisted/twisted/issues/10062
has been open for years which is a pretty good sign that no one
is depending on this class and it's safe to remove it ahead of
schedule.
This class was primarily intended to provide thread-free non-blocking
DNS resolution. If that is still required,
`tornado.platform.caresresolver` is the next best option, although it
has its own limitations which differ from TwistedResolver.
Ben Darnell [Mon, 10 Jun 2024 16:22:54 +0000 (12:22 -0400)]
test: Fix some lint issues after #3298
That PR arrived while our CI was broken and I
manually verified that the tests passed but didn't
run the linters. These changes are running in to
https://github.com/python/mypy/issues/5088
Ben Darnell [Fri, 7 Jun 2024 19:23:45 +0000 (15:23 -0400)]
web: Improve typing for UIModule.render
In practice, UIModule.render often returns the
result of self.render_string, which returns bytes.
In fact, we have an example of that in this file
which had a type ignore comment. UIModule.render
may now return either str or bytes and downstream
code is responsible for handling this. (Note that
the new call to _unicode appears to be redundant
since the Template module's bytes return was
already working correctly, but this conversion is
necessary to satisfy the type checker.)
Ben Darnell [Fri, 7 Jun 2024 18:42:28 +0000 (14:42 -0400)]
httputil: Add types for elements of HTTPHeaders
Revealed an issue in websocket.py in which bytes were used when it
should have been str. This avoided being a bug because something
down the line was converting it to str but it was still a logical
type error.
The change to httputil.py was taken from #3329 (thanks mslynch).
Ben Darnell [Wed, 5 Jun 2024 20:50:37 +0000 (16:50 -0400)]
httputil: Only strip tabs and spaces from header values
The RFC specifies that only tabs and spaces should be stripped.
Removing additonal whitespace characters can lead to framing
errors with certain proxies.
Ben Darnell [Wed, 5 Jun 2024 20:50:11 +0000 (16:50 -0400)]
http1connection: Stricter handling of transfer-encoding
Unexpected transfer-encoding values were previously ignored and treated
as the HTTP/1.0 default of read-until-close. This can lead to framing
issues with certain proxies. We now treat any unexpected value as an
error.
Ben Darnell [Wed, 5 Jun 2024 19:43:45 +0000 (15:43 -0400)]
curl_httpclient,http1connection: Prohibit CR and LF in headers
libcurl does not check for CR and LF in headers, making this the
application's responsibility. However, Tornado's other HTTP interfaces
check for linefeeds so we should do the same here so that switching
between the simple and curl http clients does not introduce header
injection vulnerabilties.
http1connection previously checked only for LF in headers (alone or in a
CRLF pair). It now prohibits bare CR as well, following the requirement
in RFC 9112.
Ben Darnell [Tue, 4 Jun 2024 01:05:22 +0000 (21:05 -0400)]
ci: Update action versions for node deprecation
The changes to checkout and setup-python shouldn't have been major
version bumps. upload-artifact and download-artifact should have had
updated node versions on v3 so we don't have to adapt to incompatible
changes here. But anyway, here we are.
build.yml has updates from
https://github.com/pypa/cibuildwheel/blob/main/examples/github-deploy.yml
This commit also moves the pypi upload step to use OIDC instead of
a static token.
Ben Darnell [Mon, 3 Jun 2024 19:49:59 +0000 (15:49 -0400)]
testing: Replace _TestMethodWrapper with _callTestMethod
Overriding _callTestMethod (which was introduced in python 3.8) is a
less hacky way to detect tests that fail to use ``@gen_test`` where
needed. It's not documented, but since Python 3.11 has introduced a
similar check to the standard library we'll be able to remove it in the
near future.
The major impetus for this change is an incompatibility with
Pytest 8.2, which has made a change that tries to instantiate test
classes at discovery time without an existing method name.
Ben Darnell [Tue, 14 Nov 2023 03:02:32 +0000 (22:02 -0500)]
iostream_test: Test check_hostname functionality.
In #3337, the removal of ssl.match_hostname revealed that we did not
have any test coverage of hostname checking in tornado.iostream.
Since we were forced to remove the manual check that we had in place
for old versions of Python, we need a test to make sure that we didn't
inadvertently break hostname checking.
Ben Darnell [Wed, 11 Oct 2023 00:39:25 +0000 (20:39 -0400)]
test: Close the thread pool in run_on_executor test
If this executor was left around it would be GC'd at an unpredictable
time and would often be reported as a failure in other circlerefs tests.
(For unknown reasons this would occur most often in i686 (i.e. 32-bit)
linux builds).
Ben Darnell [Sat, 14 Oct 2023 02:39:41 +0000 (22:39 -0400)]
*: Lint on the newest version of python too.
We previously only typechecked on the oldest version of python we
supported, incorrectly assuming nothing we depended on would be
removed. Now we typecheck on the latest version of python.
Assume support for modern version of ssl and remove some pre-SNI
code paths which rely on functions that are now removed.
Ben Darnell [Sat, 14 Oct 2023 01:27:20 +0000 (21:27 -0400)]
docs: Update intersphinx references for python 3.12
Intersphinx links are currently an unpinned dependency, so when
a new version of python is released it's possible (although relatively
rare) for it to break our links. 3.12 removed a few members of
the ssl module.
Ben Darnell [Wed, 23 Aug 2023 01:27:05 +0000 (21:27 -0400)]
escape: Use the standard library where possible
Many of these functions were necessary in Python 2, but are now
redundant. We can simply use the standard library in many cases.
The only major change is in xhtml_unescape, where we now reject
invalid character references such as surrogates and control characters.
Update docs throughout to be more specific about differences from the
standard library. Also be more complete about the ``plus`` option to
the url escaping functions.
Ben Darnell [Tue, 22 Aug 2023 03:03:39 +0000 (23:03 -0400)]
ioloop,concurrent: Fix reference cycles
In a few places we were referring to a future via a closure instead
of using the reference passed as an argument to the callback. This
sometimes causes a reference cycle that can slow GC. This commit
adds a test which covers two of the cases (chain_future and the
concurrent.future branch of add_future) while the third was found by
inspecting other calls to add_done_callback for obvious instances of
this pattern.
This test has recently become flaky on windows CI, and before
investigating further, see if it's just because the CI machines are
overloaded and subprocesses are slower on windows.
projects / thirdparty / tornado.git / log
