The attached patch adds the following behavior to the handling
of REDUCE codes:
- A user-defined type may have a __reduce__ method that returns
a string rather than a tuple, in which case the object is
saved as a global object with a name given by the string returned
by reduce.
This was a feature added to cPickle a long time ago.
- User-defined types can now support unpickling without
executing a constructor.
The second value returned from '__reduce__' can now be None,
rather than an argument tuple. On unpickling, if the
second value returned from '__reduce__' during pickling was
None, then rather than calling the first value returned from
'__reduce__', directly, the '__basicnew__' method of the
first value returned from '__reduce__' is called without
arguments.
I also got rid of a few of Chris' extra ()s, which he used
to make python ifs look like C ifs.
__builtins__ for all calls to eval(). This still allows someone to
write string.atof("[1]*1000000") (which Jim Fulton worries about) but
effectively disables access to system modules and functions.
have been configured, string.atof() should not fail when "import re"
fails (usually because pcre is not there).
This opens up a tiny security hole: *if* an attacker can make "import
re" fail, they can also make string.atof(arbitrary_string) evaluate
the arbitrary string. Nothing to keep me awake at night...
mode. The pickler always uses base 10 so the default base should be
fine. (The base gets us in trouble when there's no strop module, as
the atoi() in string.py only supports base 10. This is for JPython.)
not define __getinitargs__, bypass the __init__ constructor
completely. This uses the trick of instantiating an empty dummy class
and then changing inst.__class__ to the real class. This is done in
two places: once for the INST and once for the OBJ format code.
Also replaced the much outdated long doc string with a short summary
of the module; the information of that doc string is already
incorporated in the library reference manual.
Tools/scripts/h2py.py. This file contains many useful streamio(7)
constants, especially the ones that support passing open file
descriptors through a pipe: I_RECVFD and I_SENDFD.
In string.splitfields(), ignore maxsplit if <= 0, rather than ignoring
maxsplit=0 but effectively treating negative numbers the same as
maxsplit=1. Also made the test for maxsplit slightly more efficient
(set it to the length of the string when <= 0 so the test for its
presence can be omitted from the loop).
Guido van Rossum
Barry Warsaw