Adding `max_num_fields` to `cgi.FieldStorage` to make DOS attacks harder by
limiting the number of `MiniFieldStorage` objects created by `FieldStorage`.
(cherry picked from commit 209144831b)
catch_warnings(), and clean up the API.
While expanding the test suite, a bug was found where a warning about the
'line' argument to showwarning() was not letting functions with '*args' go
without a warning.
Closes issue 3602.
Code review by Benjamin Peterson.
class FieldStorage: this patch changes read_lines() and co. to use a
StringIO() instead of a real file. The write() calls are redirected
to a private method that replaces it with a real, external file only
when it gets too big (> 1000 bytes).
This avoids problems in forms using the multipart/form-data encoding
with many fields. The original code created a temporary file for
*every* field (not just for file upload fields), thereby sometimes
exceeding the open file limit of some systems.
Note that the simpler solution "use a real file only for file uploads"
can't be used because the form field parser has no way to tell which
fields correspond to file uploads.
It's *possible* but extremely unlikely that this would break someone's
code; they would have to be stepping way outside the documented
interface for FieldStorage and use f.file.fileno(), or depend on
overriding make_file() to return a file-like object with additional
known properties.
added test script and expected output file as well
this closes patch 103297.
__all__ attributes will be added to other modules without first submitting
a patch, just adding the necessary line to the test script to verify
more-or-less correct implementation.
file uploads.
In response to SF bugs 110674 and 119806, and discussions on
python-dev, we are removing the self.lines attribute from the
FieldStorage class. Specifically touched where methods __init__(),
read_lines_to_eof(), and skip_lines().
No one can remember why self.lines was added. Technically, it's part
of the public interface for the class, but it was never documented.
It's possible clever or nosy code will break because of this, but it
was decided to remove it and see who complains.
This resolution also closes the second half of the cgi.py entry in PEP
42. The first half of that PEP concerns specifically binary file
uploads, where there may be no end-of-line marker for a very long
time. This patch does not address that issue.
matthewbelisle-wf
Martin Panter
Serhiy Storchaka
Ezio Melotti
Senthil Kumaran
Senthil Kumaran
Florent Xicluna
Benjamin Peterson
Philip Jenvey
Fred Drake
Facundo Batista
Brett Cannon
Georg Brandl
Guido van Rossum
Armin Rigo
Skip Montanaro
Johannes Gijsbers
Raymond Hettinger
Neil Schemenauer
Walter Dörwald
Tim Peters
Neal Norwitz
Eric S. Raymond
Barry Warsaw