Commit Graph

3648 Commits

Author SHA1 Message Date
R. David Murray 5b2d9ddf69 #5871: protect against header injection attacks.
This makes Header.encode throw a HeaderParseError if it winds up
formatting a header such that a continuation line has no leading
whitespace and looks like a header.  Since Header accepts values
containing newlines and preserves them (and this is by design), without
this fix any program that took user input (say, a subject in a web form)
and passed it to the email package as a header was vulnerable to header
injection attacks.  (As far as we know this has never been exploited.)

Thanks to Jakub Wilk for reporting this vulnerability.
2011-01-09 02:35:24 +00:00
Victor Stinner 3ec899fc0d NEWS: merge #1777412 and #10827 entries 2011-01-08 16:37:47 +00:00
Victor Stinner f7d019ec9a Issue #1777412: document the change in the NEWS file 2011-01-08 16:31:24 +00:00
Antoine Pitrou 67b212e608 Issue #10859: Make `contextlib.GeneratorContextManager` officially
private by renaming it to `_GeneratorContextManager`.
2011-01-08 09:55:31 +00:00
Raymond Hettinger 23f9fc3448 Issue #10042: Fixed the total_ordering decorator to handle cross-type
comparisons that could lead to infinite recursion.
2011-01-08 07:01:56 +00:00
R. David Murray 9253214fd9 #10686: recode non-ASCII headers to 'unknown-8bit' instead of ?s.
This applies only when generating strings from non-RFC compliant binary
input; it makes the existing recoding behavior more consistent (ie:
now no data is lost when recoding).
2011-01-07 23:25:30 +00:00
R. David Murray 6f0022d84a Fix formatting of values with embedded newlines when rfc2047 encoding
Before this patch if a value being encoded had an embedded newline,
the line following the newline would have no leading whitespace,
and the whitespace it did have was encoded into the word.  Now
the existing whitespace gets turned into a blank, the way it does
in other header reformatting, and the _continuation_ws gets added
at the beginning of the encoded line.
2011-01-07 21:57:25 +00:00
Antoine Pitrou 3be412d971 Put NEWS entry in the right section. 2011-01-07 21:47:02 +00:00
Antoine Pitrou b7fb2e25fb Issue #8020: Avoid a crash where the small objects allocator would read
non-Python managed memory while it is being modified by another thread.
Patch by Matt Bandy.
2011-01-07 21:43:59 +00:00
Alexander Belopolsky c64708ae48 Issue #10827: Changed the rules for 2-digit years. The time.asctime
function will now format any year when time.accept2dyear is false and
will accept years >= 1000 otherwise.  The year range accepted by
time.mktime and time.strftime is still system dependent, but
time.mktime will now accept full range supported by the OS. Conversion
of 2-digit years to 4-digit is deprecated.
2011-01-07 19:59:19 +00:00
Victor Stinner 89e3436606 Issue #10841: set binary mode on files; the parser translates newlines
On Windows, set the binary mode on stdin, stdout, stderr and all
io.FileIO objects (to not translate newlines, \r\n <=> \n). The Python parser
translates newlines (\r\n => \n).
2011-01-07 18:47:22 +00:00
Brett Cannon 63eef1e0dd Get --coverage to be an acceptable flag for test.regrtest again. 2011-01-06 22:32:41 +00:00
Martin v. Löwis c83bc3c1fb Remove buffer API from stable ABI for now, see #10181. 2011-01-06 19:15:47 +00:00
Antoine Pitrou e85da7aa4f Issue #7858: Raise an error properly when os.utime() fails under Windows
on an existing file.

(this does not seem to be easily testable)
2011-01-06 18:25:55 +00:00
Antoine Pitrou b715fac819 Issue #3839: wsgiref should not override a Content-Length header set by
the application.  Initial patch by Clovis Fabricio.
2011-01-06 17:17:04 +00:00
David Malcolm f1397ad399 Issue #10655: Fix the build on PowerPC on Linux with GCC when building with
timestamp profiling (--with-tsc): the preprocessor test for the PowerPC
support now looks for "__powerpc__" as well as "__ppc__": the latter seems to
only be present on OS X; the former is the correct one for Linux with GCC.
2011-01-06 17:01:36 +00:00
Antoine Pitrou ca023cab4d Issue #1677694: Refactor and improve test_timeout. Original patch by
Björn Lindqvist.
2011-01-06 09:05:22 +00:00
Victor Stinner 4bd81725f2 Issue #10492: bdb.Bdb.run() only traces the execution of the code
And not the compilation (if the input is a string).
2011-01-06 00:49:38 +00:00
Antoine Pitrou dc51a3ca84 Fix mistake in NEWS 2011-01-05 22:43:26 +00:00
Antoine Pitrou 600232b562 Issue #7995: When calling accept() on a socket with a timeout, the returned
socket is now always non-blocking, regardless of the operating system.
2011-01-05 21:03:42 +00:00
Antoine Pitrou 452196fef1 Issue #5485: Add tests for the UseForeignDTD method of expat parser objects.
Patch by Jean-Paul Calderone and Sandro Tosi.
2011-01-05 18:44:14 +00:00
Victor Stinner 8786d3d0dc Issue #10756: add the author, Andreas Stührk 2011-01-05 03:56:22 +00:00
Victor Stinner 358e11d928 Issue #10756: atexit normalizes the exception before displaying it. 2011-01-05 03:54:25 +00:00
R. David Murray 477efb3944 #10790: make append work when output codec is different from input codec
There's still a bug here (the encode call shouldn't use the 'errors'
paramter), but I'll fix that later.
2011-01-05 01:39:32 +00:00
Alexander Belopolsky b9588b528a Issue #8013: time.asctime and time.ctime no longer call system asctime
and ctime functions.  The year range for time.asctime is now 1900
through maxint.  The range for time.ctime is the same as for
time.localtime.  The string produced by these functions is longer than
24 characters when year is greater than 9999.
2011-01-04 16:34:30 +00:00
Victor Stinner dc5554008f Issue #9015, #9611: stdprinter.write() clamps the length to 2^31-1 on Windows 2011-01-04 13:15:39 +00:00
Victor Stinner c3a51ecb85 Issue #10819: SocketIO.name property returns -1 when its closed, instead of
raising a ValueError, to fix repr().
2011-01-04 11:00:45 +00:00
Victor Stinner 8848c7a37f Issue #8650: zlib.compress() and zlib.decompress() raise an OverflowError if
the input buffer length doesn't fit into an unsigned int (length bigger than
2^32-1 bytes).
2011-01-04 02:07:36 +00:00
Victor Stinner b3c9e073fc Issue #8651: PyArg_Parse*() functions raise an OverflowError if the file
doesn't have PY_SSIZE_T_CLEAN define and the size doesn't fit in an int
(length bigger than 2^31-1).
2011-01-04 02:07:34 +00:00
Victor Stinner e6edec2371 Issue #9015, #9611: FileIO.readinto(), FileIO.write() and os.write() clamp the
length to 2^31-1 on Windows.
2011-01-04 00:29:35 +00:00
Antoine Pitrou 23683ef26d Issue #10333: Remove ancient GC API, which has been deprecated since
Python 2.2.
2011-01-04 00:00:31 +00:00
Gregory P. Smith 4d41968904 news for 6643 2011-01-03 21:09:23 +00:00
Antoine Pitrou 3c4402f879 Issue #6293: Have regrtest.py echo back sys.flags. This is done by default
in whole runs and enabled selectively using `--header` when running an
explicit list of tests.  Original patch by Collin Winter.
2011-01-03 20:38:52 +00:00
Antoine Pitrou f3fcd9f163 Issue #7716: Under Solaris, don't assume existence of /usr/xpg4/bin/grep in
the configure script but use $GREP instead.  Patch by Fabian Groffen.
2011-01-03 18:53:50 +00:00
Antoine Pitrou c9c83ba896 Issue #10806, issue #9905: Fix subprocess pipes when some of the standard
file descriptors (0, 1, 2) are closed in the parent process.  Initial
patch by Ross Lagerwall.
2011-01-03 18:23:55 +00:00
Michael Foord 32e1d8340c Enable unittest.TestCase to be instantiated without providing a method name.
Changed unittestgui to show number of discovered tests in the status bar.
2011-01-03 17:00:11 +00:00
Michael Foord 90efac7f37 Issue 10502: addition of unittestgui to Tools/ 2011-01-03 15:39:49 +00:00
Amaury Forgeot d'Arc a251a853c7 #8278: In the Windows implementation of stat() and utime(),
use time_t instead of int.  This gives support for dates after 2038,
at least when compiled with VS2003 or later, where time_t is 64bit.
2011-01-03 00:19:11 +00:00
Martin v. Löwis 9f6d48ba4e Issue #10798: Reject supporting concurrent.futures if the system has
too few POSIX semaphores.
2011-01-03 00:07:01 +00:00
Victor Stinner b6f424043d Issue #10807: Remove base64, bz2, hex, quopri, rot13, uu and zlib codecs from
the codec aliases. They are still accessible via codecs.lookup().
2011-01-02 19:50:36 +00:00
Antoine Pitrou c224458ef6 Issue #10475: Don't hardcode compilers for LDSHARED/LDCXXSHARED on NetBSD
and DragonFly BSD.  Patch by Nicolas Joly.
2011-01-02 19:34:03 +00:00
Georg Brandl 5ba11de845 #10801: In zipfile, support different encodings for the header and the filenames. Patch by MvL, test by Eli Bendersky. 2011-01-01 10:09:32 +00:00
Georg Brandl d30a0dd681 Fix issue references. 2011-01-01 10:07:30 +00:00
Terry Reedy 554e6fa86d Issue 6285: add NEWS entry for 3.2. 2011-01-01 02:54:11 +00:00
Raymond Hettinger 8dff4bada7 Typo. 2010-12-31 23:23:06 +00:00
Raymond Hettinger a673b1fd0e Fix OrderedDict.setdefault() to work for subclasses that define __missing__(). 2010-12-31 23:16:17 +00:00
Georg Brandl 59b44721e3 Remove mentions of the Demo directory. 2010-12-30 22:12:40 +00:00
Michael Foord 6f17e2df29 Issue 10786: unittest.TextTestRunner default stream no longer bound at import time 2010-12-30 19:36:29 +00:00
Terry Reedy 74901007a5 Minor clarification 2010-12-29 19:02:07 +00:00
Senthil Kumaran 299fa4cb21 Fix Issue 10753 - Don't quote ;=, in the PATH_INFO envvar. 2010-12-29 06:25:42 +00:00
Victor Stinner de3aa7fc62 Issue #10783: rephrase the changelog (new try) 2010-12-29 02:44:42 +00:00
Victor Stinner ece98d6e08 Issue #10783: rephrase the changelog (NEWS, What's new) 2010-12-28 23:35:10 +00:00
Terry Reedy dad532f7de Issue 10738: Fix webbrowser.Opera.raise_opts value. 2010-12-28 19:30:19 +00:00
R. David Murray e05ca2aff4 #9824: encode , and ; in cookie values so that browsers don't split on them
There is a small chance of backward incompatibility here, but only for
non-SimpleCookie applications reading SimpleCookie generated cookies.  Even
then, any such ap is likely to be handling escaped values already, and it would
take a fairly perverse implementation of unescaping to fail to unescape these
newly escaped chars, so the risk seems minimal.
2010-12-28 18:54:13 +00:00
Georg Brandl 8aa7e999b5 Add sys.flags.quiet attribute for the new -q option, as noted missing by Eric in #1772833. 2010-12-28 18:30:18 +00:00
Brian Curtin 3b4499c5c7 Fix #9333. The symlink function is always available now, raising OSError
when the user doesn't hold the symbolic link privilege rather than hiding it.
2010-12-28 14:31:47 +00:00
Victor Stinner da9ec995f6 Issue #10783: struct.pack() doesn't encode implicitly unicode to UTF-8
* Replace "bytes" by "bytes object" in struct error messages
 * Document the API change in What's new in Python 3.2
 * Fix test_wave
 * Remove also ugly implicit conversions in test_struct
2010-12-28 13:26:42 +00:00
Georg Brandl 68eb464bc7 Add news entry and clarify another. 2010-12-28 11:02:12 +00:00
Georg Brandl 780d5e08c4 #10768: fix ScrolledText widget construction, and make the example work from the interactive shell. 2010-12-28 10:56:20 +00:00
Georg Brandl 90b20675bd #10777: fix iteration over dict keys while mutating the dict. 2010-12-28 10:38:33 +00:00
Georg Brandl ff52f76019 #10679: install idle, pydoc, 2to3 scripts with X.Y suffix for make altinstall; create symlinks for make install. 2010-12-28 09:51:43 +00:00
Victor Stinner 92be939695 Issue #10780: PyErr_SetFromWindowsErrWithFilename() and
PyErr_SetExcFromWindowsErrWithFilename() decode the filename from the
filesystem encoding instead of UTF-8.
2010-12-28 00:28:21 +00:00
Victor Stinner cb428f0162 Issue #10779: PyErr_WarnExplicit() decodes the filename from the filesystem
encoding instead of UTF-8.
2010-12-27 20:10:36 +00:00
Vinay Sajip 67981ec536 Issue #10626: test_logging now preserves logger disabled states. 2010-12-27 18:34:25 +00:00
Vinay Sajip 60b4df15d6 Issue #10774: test_logging now removes temp files created during tests. 2010-12-27 11:18:52 +00:00
R. David Murray b4ca59b783 #5258/#10642: print fn, line, traceback and continue when .pth file is broken
If a .pth file contained an error, it could cause a traceback in site.py,
terminating its processing.  In 2.7 and 3.2, the interpreter will then not
start.  Previously, a message would print saying to use -v to get the
traceback.  In either case, the traceback generated for a failed .pth file did
not include the .pth filename, making it difficult to debug the problem.  Now
site.py reports not only the .pth filename but also the line number causing the
error, and just skips the remainder of the file.
2010-12-26 19:54:29 +00:00
Victor Stinner 667d4b577f Issue #10763: subprocess.communicate() closes stdout and stderr if both are
pipes (bug specific to Windows).

Improve also the unit test: write a portable unit test.
2010-12-25 22:40:32 +00:00
R. David Murray dfd7eb0ba2 #1693546: don't add quotes around RFC 2231 encoded values.
The RFC is bit hard to understand on this point, but the examples
clearly show that parameter values that are encoded according
to its charset/language rules don't have surrounding quotes, and
the ABNF does not allow for quotes.  So when we produce such
encoded values, we no longer add quotes.
2010-12-24 22:36:49 +00:00
Raymond Hettinger 1e7efdf2a0 Add news entry for 87471. 2010-12-24 10:04:00 +00:00
R. David Murray 4a62e89728 #1155362: allow hh:mm:ss-uuuu like we allow hh:mm:ss+uuuu in parsedate_tz
Original patch by Thomas Herve.
2010-12-23 20:35:46 +00:00
R. David Murray 8d855d8304 #4871: check that zipfile password is bytes, and give useful error message.
Previously passing a string in as the password would fail either with
an assertion error or a TypeError with a confusing error message.
Note that a string can't be accepted since zipfile has no way to
guess what encoding should be used to turn it into bytes.

Patch by Victor Stinner.
2010-12-21 21:53:37 +00:00
Antoine Pitrou 7f8f41808b Issue #10750: The `raw` attribute of buffered IO objects is now read-only. 2010-12-21 21:20:59 +00:00
Raymond Hettinger 8ebe27f300 Deprecate assertDictContainsSubset() 2010-12-21 19:24:26 +00:00
Senthil Kumaran 7bc0d872dd Issue3243 - Support iterable bodies in httplib. Patch contributions by Xuanji Li and Chris AtLee. 2010-12-19 10:49:52 +00:00
Georg Brandl 8a60e94802 Bump to 3.2b2. 2010-12-19 10:30:28 +00:00
Georg Brandl aedd2899c2 #6075: make idle work with both Carbon AquaTk and Cocoa AquaTk. Patch by Kevin Walzer and Ned Deily. 2010-12-19 10:10:32 +00:00
Michael Foord b3468f79ef Issue 10611. Issue 9857. Improve the way exception handling, including test skipping, is done inside TestCase.run 2010-12-19 03:19:47 +00:00
Ezio Melotti addc6f5a21 #10573: use actual/expected consistently in unittest methods. The order of the args of assertCountEqual is also changed. 2010-12-18 20:00:04 +00:00
R. David Murray 63563cdf9d #9286: Fix the rfc822 parser to preserve whitespace in address local part.
Such addresses are not RFC compliant except under the 'obsolete syntax'
rules, but before this fix the whitespace was dropped from the input,
concatenating the pieces.  That breaks one of the principles of the
email package, that of preserving the input as much as possible.
It also denies the application program the opportunity to apply its
own heuristics to interpretation of such non-compliant addresses.

It is possible users of the email package were depending on the local
part always being a single token, so this fix will not be backported.
2010-12-18 18:25:38 +00:00
Antoine Pitrou 2b37ce7f30 NEWS entry for r87373 2010-12-18 17:59:18 +00:00
R. David Murray b68a7bc70c #10404: Use ctl-button-1 for context menus on OSX Idle.
This provides access to the context menus where they previously could
not be accessed due to the way OSX Tk binds buttons.  It also
improves platform consistency.

Patch by Ned Deily.
2010-12-18 17:19:10 +00:00
Ezio Melotti ac53ab64a6 #5587: add a repr to dict_proxy objects. Patch by David Stanek and Daniel Urban. 2010-12-18 14:59:43 +00:00
Steven Bethard fd311a712d Add subparser aliases for argparse. Resolves issue 9324. Approved by Georg for beta2 on the tracker. 2010-12-18 11:19:23 +00:00
R. David Murray 52d1b4e62f #9907: call rl_initialize early when using editline on OSX
editline rl_initialize apparently discards any mappings done before it
is called, which makes tab revert to file completion instead of inserting
a tab.  So now on OSX we call rl_initialize first if we are using
readline, and then re-read the users .editrc (if any) afterward so they
can still override our defaults.

Patch by Ned Deily, modified by Ronald Oussoren.
2010-12-18 03:48:32 +00:00
Łukasz Langa 71b37a5d6d 100% test coverage, better mapping protocol compatibility, some minor bugfixes 2010-12-17 21:56:32 +00:00
Martin v. Löwis 0e74cacdff Upgrade to sqlite3 3.7.4. 2010-12-17 21:04:09 +00:00
Martin v. Löwis 910a4edbcd Upgrade Tcl/Tk to 8.5.9. 2010-12-17 20:43:27 +00:00
Antoine Pitrou 401edd69cf Issue #4188: Avoid creating dummy thread objects when logging operations
from the threading module (with the internal verbose flag activated).
2010-12-17 17:42:16 +00:00
Antoine Pitrou 988dbd7bc2 Issue #10711: Remove HTTP 0.9 support from http.client. The `strict`
parameter to HTTPConnection and friends is deprecated.
2010-12-17 17:35:56 +00:00
Senthil Kumaran dca5b86233 Fix Issue9721 - urljoin behavior when the relative url starts with ';' 2010-12-17 04:48:45 +00:00
Antoine Pitrou 20f0fb68aa Issue #10710: `Misc/setuid-prog.c` is removed from the source tree. 2010-12-16 18:25:24 +00:00
Antoine Pitrou c492437922 Issue #10714: Limit length of incoming request in http.server to 65536 bytes
for security reasons.  Initial patch by Ross Lagerwall.
2010-12-16 16:48:36 +00:00
Łukasz Langa 1ac0d7a7d3 Acknowledged renaming of SafeConfigParser to ConfigParser. 2010-12-16 01:42:36 +00:00
Raymond Hettinger 48f3bd331c Nits 2010-12-16 00:30:53 +00:00
Antoine Pitrou 810023db3e Issue #8844: Regular and recursive lock acquisitions can now be interrupted
by signals on platforms using pthreads.  Patch by Reid Kleckner.
2010-12-15 22:59:16 +00:00
Éric Araujo 60532bd6b6 Fix build_ext with VS 8.0. Patch by Hirokazu Yamamoto (#9558). 2010-12-15 21:07:22 +00:00
Raymond Hettinger 96f3410ebe Issue 10667: Fast path for collections.Counter 2010-12-15 16:30:37 +00:00
Antoine Pitrou 00c6b62939 Issue #10706: Remove outdated script runtests.sh. Either `make test`
or `python -m test` should be used instead.
2010-12-15 15:33:18 +00:00
R. David Murray ce4b170c5a #4236: avoid possible Fatal Error when import is called from __del__
Patch by Simon Cross, crasher test code by Martin von Löwis.
2010-12-14 23:06:25 +00:00
R. David Murray ec07331eea #775964: skip YP/NIS entries instead of failing the test
Also includes doc updates mentioning that these entries may not
be retrievable via getgrnam and getgrgid.

Patch by Bobby Impollonia.
2010-12-14 16:20:53 +00:00