Yeting Li [Wed, 7 Apr 2021 11:27:41 +0000 (19:27 +0800)]
bpo-43075: Fix ReDoS in urllib AbstractBasicAuthHandler (GH-24391)
Fix Regular Expression Denial of Service (ReDoS) vulnerability in
urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable regex
has quadratic worst-case complexity and it allows cause a denial of
service when identifying crafted invalid RFCs. This ReDoS issue is on
the client side and needs remote attackers to control the HTTP server.
Victor Stinner [Wed, 7 Apr 2021 11:01:09 +0000 (13:01 +0200)]
bpo-43244: Remove Yield macro from pycore_ast.h (GH-25243)
* pycore_ast.h no longer defines the Yield macro.
* Fix a compiler warning on Windows: "warning C4005: 'Yield': macro
redefinition".
* Python-ast.c now defines directly functions with their real
_Py_xxx() name, rather than xxx().
* Remove "#undef Yield" in C files including pycore_ast.h.
bpo-38605: Update "Future statements" docs since PEP 563 is always enabled (GH-25236)
Update documentation section for "Future statements" to reflect that `from __future__ import annotations` is on by default, and no features require using the future statement now.
Ken Jin [Tue, 6 Apr 2021 16:03:00 +0000 (00:03 +0800)]
Update pattern matching docs for changes to the PEP (#25185)
See:
- https://github.com/python/peps/pull/1909 (__match_args__ must be a tuple)
- https://github.com/python/peps/pull/1908 (allow keyword patterns for int(x) etc.)
Steve Dower [Tue, 6 Apr 2021 12:08:30 +0000 (13:08 +0100)]
bpo-43745: Actually updates Windows release to OpenSSL 1.1.1k. (GH-25213)
Earlier releases were mislabelled and included 1.1.1i again.
The tag/directory name is updated to ensure that builds get the fresh bits. However, the openssl-bin-1.1.1k tag in the repository has been forcibly updated, so fresh builds will be fine even without this change.
Replace broken example code with correct simpler code. (GH-25162)
The open() was missing 'w' to indicate it was in a write-mode.
Even then, the open().close() operation was distracting because
it is an unusual way to "touch" as file. Using os.remove()
instead is simpler and less distracting.
Victor Stinner [Fri, 2 Apr 2021 13:45:37 +0000 (15:45 +0200)]
bpo-43688: Support the limited C API in debug mode (GH-25131)
The limited C API is now supported if Python is built in debug mode
(if the Py_DEBUG macro is defined). In the limited C API, the
Py_INCREF() and Py_DECREF() functions are now implemented as opaque
function calls, rather than accessing directly the PyObject.ob_refcnt
member, if Python is built in debug mode and the Py_LIMITED_API macro
targets Python 3.10 or newer. It became possible to support the
limited C API in debug mode because the PyObject structure is the
same in release and debug mode since Python 3.8 (see bpo-36465).
The limited C API is still not supported in the --with-trace-refs
special build (Py_TRACE_REFS macro).
Reorganize pycore_interp_init() to initialize singletons before the
the first PyType_Ready() call. Fix an issue when Python is configured
using --without-doc-strings.
Victor Stinner [Thu, 1 Apr 2021 12:13:42 +0000 (14:13 +0200)]
bpo-43690: stable_abi.py no longer parses macros (GH-25136)
The stable_abi.py script no longer parse macros. Macro targets can be
static inline functions which are not part of the stable ABI, only
part of the limited C API.
Run "make regen-limited-abi" to exclude PyType_HasFeature from
Doc/data/stable_abi.dat.
Tim Peters [Thu, 1 Apr 2021 03:46:31 +0000 (22:46 -0500)]
When printing stats, move radix tree info to its own section. (GH-25125)
When printing stats, move radix tree info to its own section.
Restore that the breakdown of bytes in arenas exactly accounts for the total of arena bytes allocated.
Add an assert so that invariant doesn't break again.
Jessica Clarke [Wed, 31 Mar 2021 10:12:39 +0000 (11:12 +0100)]
bpo-43179: Generalise alignment for optimised string routines (GH-24624)
* Remove m68k-specific hack from ascii_decode
On m68k, alignments of primitives is more relaxed, with 4-byte and
8-byte types only requiring 2-byte alignment, thus using sizeof(size_t)
does not work. Instead, use the portable alternative.
Note that this is a minimal fix that only relaxes the assertion and the
condition for when to use the optimised version remains overly strict.
Such issues will be fixed tree-wide in the next commit.
NB: In C11 we could use _Alignof(size_t) instead, but for compatibility
we use autoconf.
* Optimise string routines for architectures with non-natural alignment
C only requires that sizeof(x) is a multiple of alignof(x), not that the
two are equal. Thus anywhere where we optimise based on alignment we
should be using alignof(x) not sizeof(x).
This is more annoying than it would be in C11 where we could just use
_Alignof(x) (and alignof(x) in C++11), but since we still require only
C99 we must plumb the information all the way from autoconf through the
various typedefs and defines.
Ethan Furman [Wed, 31 Mar 2021 04:17:26 +0000 (21:17 -0700)]
bpo-40066: Enum: modify `repr()` and `str()` (GH-22392)
* Enum: streamline repr() and str(); improve docs
- repr() is now ``enum_class.member_name``
- stdlib global enums are ``module_name.member_name``
- str() is now ``member_name``
- add HOW-TO section for ``Enum``
- change main documentation to be an API reference
Neil Schemenauer [Tue, 30 Mar 2021 02:51:15 +0000 (19:51 -0700)]
bpo-37448: Use radix tree for pymalloc address_in_range(). (GH-14474)
The radix tree approach is a relatively simple and memory sanitary
alternative to the old (slightly) unsanitary address_in_range().
To disable the radix tree map, set a preprocessor flag as follows:
-DWITH_PYMALLOC_RADIX_TREE=0.
Michael Felt [Mon, 29 Mar 2021 19:06:24 +0000 (21:06 +0200)]
bpo-43659: Fix test_curses on AIX (GH-25074)
curses.update_lines_cols() is only defined when the curses library
provides either resizeterm() or resize_term() functions which are optional
and are not provided on AIX.
Victor Stinner [Mon, 29 Mar 2021 12:40:40 +0000 (14:40 +0200)]
bpo-42988: Remove the pydoc getfile feature (GH-25015)
CVE-2021-3426: Remove the "getfile" feature of the pydoc module which
could be abused to read arbitrary files on the disk (directory
traversal vulnerability). Moreover, even source code of Python
modules can contain sensitive data like passwords. Vulnerability
reported by David Schwörer.