Gregory P. Smith [Tue, 21 Jun 2022 20:16:57 +0000 (13:16 -0700)]
gh-87389: Fix an open redirection vulnerability in http.server. (#93879)
Fix an open redirection vulnerability in the `http.server` module when
an URI path starts with `//` that could produce a 301 Location header
with a misleading target. Vulnerability discovered, and logic fix
proposed, by Hamza Avvan (@hamzaavvan).
Test and comments authored by Gregory P. Smith [Google].
Mark Dickinson [Tue, 21 Jun 2022 19:36:35 +0000 (20:36 +0100)]
Minor optimization for Fractions.limit_denominator (GH-93730)
When we construct the upper and lower candidates in limit_denominator,
the numerator and denominator are already relatively prime (and the
denominator positive) by construction, so there's no need to go through
the usual normalisation in the constructor. This saves a couple of
potentially expensive gcd calls.
Suggested by Michael Scott Asato Cuthbert in GH-93477.
Victor Stinner [Tue, 21 Jun 2022 13:21:22 +0000 (15:21 +0200)]
gh-54781: Move Lib/lib2to3/tests/ to Lib/test/test_lib2to3/ (#94049)
* Move Lib/lib2to3/tests/ to Lib/test/test_lib2to3/.
* Remove Lib/test/test_lib2to3.py.
* Update imports.
* all_project_files(): use different paths and sort files
to make the tests more reproducible.
* Update references to tests.
On Windows, PyOS_StdioReadline() now gets
PyConfig.legacy_windows_stdio from _PyOS_ReadlineTState, rather than
using the deprecated global Py_LegacyWindowsStdioFlag variable.
Fix also a compiler warning in Py_SetStandardStreamEncoding().
Explicitly note that transactions are only closed if there is an open
transation at `__exit__`, and that transactions are not implicitly
opened during `__enter__`.
Co-authored-by: CAM Gerlach <CAM.Gerlach@Gerlach.CAM> Co-authored-by: Stanley <46876382+slateny@users.noreply.github.com> Automerge-Triggered-By: GH:erlend-aasland
Christian Heimes [Sun, 19 Jun 2022 16:28:55 +0000 (18:28 +0200)]
gh-84461: Fix Emscripten umask and permission issues (GH-94002)
- Emscripten's default umask is too strict, see
https://github.com/emscripten-core/emscripten/issues/17269
- getuid/getgid and geteuid/getegid are stubs that always return 0
(root). Disable effective uid/gid syscalls and fix tests that use
chmod() current user.
- Cannot drop X bit from directory.
Reformat the pthread implementation of PyThread_acquire_lock_timed()
using a mutex and a conditioinal variable.
* Add goto to avoid multiple indentation levels and exit quickly
* Use "while(1)" and make the control flow more obvious.
* PEP 7: Add braces around if blocks.
Jason R. Coombs [Sat, 18 Jun 2022 20:47:27 +0000 (16:47 -0400)]
gh-93975: Nicer error reporting in test_venv (GH-93959)
- gh-93957: Provide nicer error reporting from subprocesses in test_venv.EnsurePipTest.test_with_pip.
- Update changelog
This change does three things:
1. Extract a function for trapping output in subprocesses.
2. Emit both stdout and stderr when encountering an error.
3. Apply the change to `ensurepip._uninstall` check.
CAM Gerlach [Fri, 17 Jun 2022 21:05:21 +0000 (16:05 -0500)]
gh-92611: Add details on replacements for cgi utility funcs (GH-92792)
Per @brettcannon 's [suggestions on the Discourse thread](https://discuss.python.org/t/pep-594-take-2-removing-dead-batteries-from-the-standard-library/13508/51), discussed in #92611 and as a followup to PR #92612 , this PR add additional specific per-function replacement information for the utility functions in the `cgi` module deprecated by PEP 594 (PEP-594).
@brettcannon , should this be backported (without the `deprecated-removed` , which I would update it accordingly and re-add in my other PR adding that to the others for 3.11+), or just go in 3.11+?
test_asyncio, test_logging, test_socket and test_socketserver now
create AF_UNIX domains in the current directory to no longer fail
with OSError("AF_UNIX path too long") if the temporary directory (the
TMPDIR environment variable) is too long.
Modify the following tests to use create_unix_domain_name():
Victor Stinner [Thu, 16 Jun 2022 19:48:26 +0000 (21:48 +0200)]
gh-93353: regrtest supports checking tmp files with -j2 (#93909)
regrtest now also implements checking for leaked temporary files and
directories when using -jN for N >= 2. Use tempfile.mkdtemp() to
create the temporary directory. Skip this check on WASI.
samtygier [Thu, 16 Jun 2022 13:41:51 +0000 (14:41 +0100)]
gh-91577: SharedMemory move imports out of methods (#91579)
SharedMemory.unlink() uses the unregister() function from resource_tracker. Previously it was imported in the method, but this can fail if the method is called during interpreter shutdown, for example when unlink is part of a __del__() method.
Moving the import to the top of the file, means that the unregister() method is available during interpreter shutdown.
The register call in SharedMemory.__init__() can also use this imported resource_tracker.
Christian Heimes [Thu, 16 Jun 2022 06:42:36 +0000 (08:42 +0200)]
gh-93820: Fix copy() regression in enum.Flag (GH-93876)
GH-26658 introduced a regression in copy / pickle protocol for combined
`enum.Flag`s. `copy.copy(re.A | re.I)` would fail with
`AttributeError: ASCII|IGNORECASE`.
`enum.Flag` now has a `__reduce_ex__()` method that reduces flags by
combined value, not by combined name.
Victor Stinner [Wed, 15 Jun 2022 16:28:31 +0000 (18:28 +0200)]
test_asyncore: Optimize capture_server() (#93867)
Remove time.sleep(0.01) in test_asyncore capture_server(). The sleep
was redundant and inefficient, since the loop starts with
select.select() which also implements a sleep (poll for socket data
with a timeout).
run_until() of test.test_asyncio.utils now uses an exponential sleep
delay (max: 1 second), rather than a fixed delay of 1 ms. Similar
design than support.sleeping_retry() wait strategy that applies
exponential backoff.
Victor Stinner [Wed, 15 Jun 2022 12:09:56 +0000 (14:09 +0200)]
Use support.sleeping_retry() and support.busy_retry() (#93848)
* Replace time.sleep(0.010) with sleeping_retry() to
use an exponential sleep.
* support.wait_process(): reuse sleeping_retry().
* _test_eintr: remove unused variables.
gh-79579: Improve DML query detection in sqlite3 (#93623)
The fix involves using pysqlite_check_remaining_sql(), not only to check
for multiple statements, but now also to strip leading comments and
whitespace from SQL statements, so we can improve DML query detection.
pysqlite_check_remaining_sql() is renamed lstrip_sql(), to more
accurately reflect its function, and hardened to handle more SQL comment
corner cases.