[issue36161] Use thread-safe functions instead of unsafe ones (crypt, ttyname)

Martin Panter added the comment: In Issue 28503, “crypt_r” was added to Python 3.7 and 3.8+, and it looks like it is still there. Regarding error handling for “crypt”, it is not documented, but the Python function returns None on error. You would have to consider backwards compatibility to

[issue36172] csv module internal consistency

Martin Panter added the comment: The documentation <https://docs.python.org/dev/library/csv.html#module-contents> says you should “open the files with newline=''.” IMO this is an unfortunate quirk of the CSV module. Everything else that I know of in the Python built-in libra

[issue36226] multipart/related header causes false positive StartBoundaryNotFoundDefect and MultipartInvariantViolationDefect

Martin Panter added the comment: Probably the same as Issue 29353. I remember than enabling "headersonly" can create inconsistencies in the message object. But I don't remember the details. According to Issue 29991 (another duplicate), my patch for Issue 24363 might help. Bu

[issue36246] csv.writer lineterminator affects csv escaping

Martin Panter added the comment: This is the result that I see: >>> output = StringIO() >>> csv.writer(output, lineterminator='\n').writerow(["Whoa!\rNewlines!"]) 16 >>> output.getvalue() 'Whoa!\rNewlines!\n' For comparison, this is th

[issue25476] close() behavior on non-blocking BufferedIO objects with sockets

Change by Martin Panter : -- stage: -> resolved status: pending -> closed ___ Python tracker <https://bugs.python.org/issue25476> ___ ___ Python-bugs-list

[issue36293] Nonblocking read sys.stdin raises error

Martin Panter added the comment: This is the same story as in Issue 35762. Both “sys.stdin” and “subprocess.Popen.stderr” (when universal_newlines=True is enabled) use the TextIOWrapper class, which I don’t think was implemented with non-blocking mode in mind. Issue 24560 is similar, but is

[issue36294] `io.BufferedIOBase` returns `None`

Martin Panter added the comment: The general problem of non-blocking reads with BufferedIOBase is covered by Issue 13322. The documentation and implementations do not agree. I suggest to not rely on any particular behaviour reading BufferedIOBase objects in non-blocking mode. The problem of

[issue36304] When using bz2 and lzma in mode 'wt', the BOM is not written

Martin Panter added the comment: I suspect this is caused by TextIOWrapper guessing if it is writing the start of a file versus in the middle, and being confused by “seekable” returning False. GzipFile implements some “seek” calls in write mode, but LZMAFile and BZ2File do not. Using this

[issue33319] `subprocess.run` documentation doesn't tell is using `stdout=PIPE` safe

Martin Panter added the comment: This is a regression in the 3.7+ documentation. It previously said “To [capture output], pass PIPE for the ‘stdout’ and/or ‘stderr’ arguments”. This was removed by Bo Bayles in Issue 32102. -- keywords: +3.7regression nosy: +bbayles, gregory.p.smith

[issue36464] Python 2.7 build install fails intermittently with -j on MacOS

Martin Panter added the comment: On Linux, Gnu’s “install” command is happy if the target directory already exists; it just changes the mode (-m) etc. So the race isn’t a big deal. This is like the race I described (theoretical at the time) at <https://bugs.python.org/issue25696#msg255

[issue36483] Missing line in documentation example

Martin Panter added the comment: Did you read the bracketed paragraph directly below, or try running the code with your “break” statement? I expect it would stop at the first prime number (two). But the output continues with more prime numbers. -- nosy: +martin.panter resolution

[issue35403] support application/wasm in mimetypes and http.server

Martin Panter added the comment: According to Issue 34758, this was already added to 3.8’s “mimetypes”. -- nosy: +martin.panter resolution: -> out of date stage: -> resolved status: open -> closed ___ Python tracker <https://bug

[issue35403] support application/wasm in mimetypes and http.server

Change by Martin Panter : -- superseder: -> http.server module sets incorrect mimetype for WebAssembly files ___ Python tracker <https://bugs.python.org/issu

[issue36293] Nonblocking read sys.stdin raises error

Martin Panter added the comment: I wasn’t sure about closing it, in case Cyker came back with more details. E.g. what was the use case? Were they mislead by the documentation? Do they just think the error should be different, or do they think there should be no error in this case? But I

[issue36293] Nonblocking read sys.stdin raises error

Change by Martin Panter : -- resolution: -> duplicate ___ Python tracker <https://bugs.python.org/issue36293> ___ ___ Python-bugs-list mailing list Unsubscrib

[issue30458] [security][CVE-2019-9740][CVE-2019-9947] HTTP Header Injection (follow-up of CVE-2016-5699)

Martin Panter added the comment: Gregory, I haven’t tried recent Python code, but I expect the problem with percent decoding is still there. If you did try my example, what results did you see? Be aware that these techniques only work if the OS co-operates and connects to localhost when you

[issue36600] re-enable test in nntplib

Martin Panter added the comment: Does the test still depend on real-world posts? If so, see Issue 19613. I don’t think the problem has been fixed. -- nosy: +martin.panter superseder: -> test_nntplib: sporadic failures, test_article_head_b

[issue17267] datetime.time support for '+' and '-'

Martin Panter added the comment: A real use case that I have had was with a protocol to activate a device with a daily schedule. The protocol takes start and end hours and minutes of the day. To test the device by activating it over the next few minutes, my ideal way would have taken the

[issue33632] undefined behaviour: signed integer overflow in threadmodule.c

Martin Panter added the comment: Victor, if you run the test suite, one of the test cases should trigger the overflow. I used to compile with Undefined Behaviour Sanitizer to print messages when these errors occur; see <https://bugs.python.org/issue1621#msg271118> for my setup at the t

[issue36701] module 'urllib' has no attribute 'request'

Martin Panter added the comment: The “urllib” package also contains “urllib.parse”, which is a lot more lightweight than “urllib.request”. In a quick experiment, importing “urllib.request” is more than 2 times slower than importing “urllib.parse” on its own. And importing “urllib” by itself

[issue36711] duplicate method definition in Lib/email/feedparser.py

Martin Panter added the comment: This is caused by Serhiy’s first change to 2.7 in Issue 21448. Compare Mercurial rev. 1b1f92e39462 (3.4 branch) with ba90bd01c5f1 (2.7). In 2.7, he applied the Python 3 version of the code, which used “str.splitlines” rather than a regular expression

[issue22742] IDLE shows traceback when printing non-BMP character

Martin Panter added the comment: I haven’t looked at the code, but I suspect Idle implements a custom “sys.displayhook”: >>> help(sys.displayhook) Help on function displayhook in module idlelib.rpc: displayhook(value) Override standard display hook to use non-locale

[issue23298] Add ArgumentParser.add_mutually_dependence_group

Change by Martin Panter : -- superseder: -> Add "necessarily inclusive" groups to argparse ___ Python tracker <https://bugs.python.org/issue23298> ___

[issue23930] http.cookies.SimpleCookie doesn't parse comma-only separated cookies correctly

Change by Martin Panter : -- resolution: -> rejected status: open -> pending ___ Python tracker <https://bugs.python.org/issue23930> ___ ___ Python-bugs-

[issue1564508] RFC 2965 BaseCookie does not support "$Port"

Martin Panter added the comment: The original report comes from <https://code.djangoproject.com/ticket/2806>. Anders was trying to parse a HTTP request Cookie field, something like: BaseCookie('sessionid=a2be2e7debe71af8d88d350c4d14d768;$Path=/;$Domain=192.168.0.2;$Port="8000

[issue12144] cookielib.CookieJar.make_cookies fails for cookies with 'expires' set

Martin Panter added the comment: Karthikeyan, it looks like your test will pass even when the bug is not fixed. A test calling code that writes error message does not necessarily mean the test itself will fail, I don’t think. I suggest you look at raising an exception when the UserWarning is

[issue33017] Special set-cookie setting will bypass Cookielib

Martin Panter added the comment: I think LCatro is saying that Python should accept the cookies and discard only the offending attributes. This makes sense to me and tends to agree with the specifications, but the three cases seem all seem unimportant to me. PoC 1, Max-age: >>> fro

[issue35824] http.cookies._CookiePattern modifying regular expressions

Martin Panter added the comment: Test_http_cookies line 19 has the following test case: {'data': 'keebler="E=mc2; L=\\"Loves\\"; fudge=\\012;"', 'dict': {'keebler' : 'E=mc2; L="Loves"; fudge=\012;'}, 'repr&#

[issue36726] Empty select() on windows gives error.

Martin Panter added the comment: I think this is a duplicate of Issue 29256. Issue 25680 also discusses platform differences with no file descriptors. -- nosy: +martin.panter resolution: -> duplicate stage: -> resolved status: open -> closed superseder: -> Windows sel

[issue36760] subprocess.run fails with capture_output=True and stderr=STDOUT

Martin Panter added the comment: Python 3.7 added the "capture_output" parameter, for Issue 32102. Before that change, you could use "subprocess.PIPE": https://docs.python.org/3.6/library/subprocess.html#subprocess.run “To [capture output], pass PIPE for the ‘stdout’ and/o

[issue36863] argparse doesn't like options in the middle of arguments

Martin Panter added the comment: The “cmd” module doesn’t use “argparse” as far as I can see. You might have to provide more information or code for someone to make sense of or reproduce your bug. Also, see Issue 14191 which added new “parse_[known]_intermixed_args” APIs in 3.7, and have a

[issue32537] multiprocessing.pool.Pool.starmap_async - wrong parameter name

Martin Panter added the comment: This was supposed to be fixed in 3.6+ by Issue 31304. In general, 3.5 only gets security fixes at this stage. I’m not sure if it is easy or worth back porting this. -- nosy: +martin.panter ___ Python tracker

[issue32475] Add ability to query number of buffered bytes available on buffered I/O

Martin Panter added the comment: If I remember the implementation of “peek” right, it may do what you want. But the documentation doesn’t guarantee much about its behaviour; see Issue 5811. Anyway, I agree that a “getbuffn” method (or property) would be nice. (Perhaps with a better name

[issue32561] Add API to io objects for non-blocking reads/writes

Martin Panter added the comment: BufferedIOBase is an abstract class and, despite the name, doesn’t necessitate a buffer or cache. Adding methods and properties might break compatibility with third-party implementations, or get ugly with optional methods and multiple versions of the API. It

[issue32561] Add API to io objects for non-blocking reads/writes

Change by Martin Panter : -- dependencies: +Add ability to query number of buffered bytes available on buffered I/O ___ Python tracker <https://bugs.python.org/issue32

[issue32600] SpooledTemporaryFile should implement IOBase

Martin Panter added the comment: There is apparently some work done on this already in Issue 26175. -- nosy: +martin.panter resolution: -> duplicate stage: -> resolved status: open -> closed superseder: -> Fully implement IOBase abstract on SpooledT

[issue26175] Fully implement IOBase abstract on SpooledTemporaryFile

Martin Panter added the comment: It may also be worth implementing BufferedIOBase and TextIOBase. (It seems buffering=0 isn’t reliable, e.g. rollover with limited disk space, so it may not be worth implementing RawIOBase.) To implement BufferedIOBase, “read1” and “readinto1” should be added

[issue32634] Message parsing fails where it has incompele headers

Martin Panter added the comment: Looks like a dupe of Issue 27321 -- nosy: +martin.panter resolution: -> duplicate superseder: -> Email parser creates a message object that can't be flattened ___ Python tracker <https://bugs.python.

[issue32673] update tutorial dict part to reflect dict is ordered

Martin Panter added the comment: See Issue 32337 -- nosy: +martin.panter ___ Python tracker <https://bugs.python.org/issue32673> ___ ___ Python-bugs-list mailin

[issue32698] Improper gzip compression if output file extension is not "gz"

Martin Panter added the comment: According to the documentation, you can use the lower-level GzipFile constructor’s “filename” argument: >>> with open(output_path, 'wb') as f_out, \ ... gzip.GzipFile(fileobj=f_out, mode='wb', filename=input_path) as f_out, \

[issue20104] expose posix_spawn(p)

Martin Panter added the comment: Pablo’s code looked unfinished to me. As well as missing documentation, I suspect there may be memory leaks and poor error handling. The two calls above the “fail:” label look like dead code. The “parse_envlist” result appears to be leaked. I’m curious why

[issue20104] expose posix_spawn(p)

Martin Panter added the comment: Does the PySequence_Fast result need releasing if the following “for” loop fails? There is a Py_DECREF only in the successful case, which seems inconsistent. Does Python still support non-UTF-8 locales and bytes filenames? I haven’t been keeping up, but I

[issue20104] expose posix_spawn(p)

Martin Panter added the comment: TypeError if “posix_spawn_file_actions_init” fails doesn’t seem right. I suggest OSError, MemoryError, or even plain Exception instead. “File_actionsp” is set to point to a local variable “_file_actions”, but the variable goes out of scope before the pointer

[issue20104] expose posix_spawn(p)

Martin Panter added the comment: Your assumption about calling “file_actions_destroy” would be okay if the posix_spawn_file_actions_t object was a simple object or structure. But I imagine most implementations would allocate memory when you call one of the “add” methods. Especially “addopen

[issue32875] Add __exit__() method to event loops

Martin Panter added the comment: Maybe already discussed in Issue 24795? -- nosy: +martin.panter superseder: -> Make event loops with statement context managers ___ Python tracker <https://bugs.python.org/issu

[issue32867] argparse assertion failure with multiline metavars

Martin Panter added the comment: This looks like the same assertion failure as described in Issue 16360. Paul pointed to a patch in Issue 11874, so that may also be relevant. However I agree that embedding newlines in a metavar doesn’t make much sense. What’s the use case? -- nosy

[issue32993] urllib and webbrowser.open() can open w/ file: protocol

Martin Panter added the comment: Hi Yao, I tend to agree with Ned. The support for “file:” URLs is by design. I don’t see any security problems. I suggest to close this. In Issue 11662, it was decided that a web server redirecting to a “file:” URL was a security problem. This is because the

[issue33062] ssl_renegotiate() doesn't seem to be exposed

Martin Panter added the comment: I have also wanted to force renegotation for testing with Python. As a workaround, I have used the "openssl s_server" program, which I described at <https://bugs.python.org/issue25919#msg257508> (use the lower-case "r" command). Mor

[issue27069] webbrowser creates zombi processes in the background mode

Martin Panter added the comment: It does look similar. They probably could be merged. The main difference is in Issue 5993 Eivind suggested to somehow use a “wait” system call, while here Victor suggested “fork” (perhaps to orphan a grandchild process

[issue32270] subprocess closes redirected fds even if they are in pass_fds

Change by Martin Panter : -- nosy: +martin.panter ___ Python tracker <https://bugs.python.org/issue32270> ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue31823] Opaque default value for close_fds argument in Popen.__init__

Martin Panter added the comment: The close_fds= in that signature seems fine to me. If you read the documentation, it says the default mode depends on the platform, and on other parameters. However I think the signature at <https://docs.python.org/release/3.6.4/library/subprocess.h

[issue33079] subprocess: document the interaction between subprocess.Popen and os.set_inheritable

Martin Panter added the comment: There is no “open_fds” parameter as far as I know. I presume you meant heritable descriptors are still closed with close_fds=True (not open_fds=False). Are you sure about the second part? In my experiments on Linux, unless I use “pass_fds” or one of the

[issue22781] ctypes: Differing results between Python and C.

Martin Panter added the comment: Eryk Sun’s explanation makes this sound like a duplicate of Issue 15453, which shows GCC on Linux packing structures into a single byte, and ctypes using the size of the expanded integer type. -- nosy: +martin.panter resolution: -> duplic

[issue33012] Invalid function cast warnings with gcc 8 for METH_NOARGS

Martin Panter added the comment: Siddhesh, it looks like your fixes make the C function signatures match the signature expected in the PyMethodDef structure. If so, I suggest to remove the (PyCFunction) casts from those structure definitions as well. For instance, now that we have

[issue33012] Invalid function cast warnings with gcc 8 for METH_NOARGS

Martin Panter added the comment: Sorry, I realize there is a problem remaining with the pointer types for "Noddy_name" (Noddy vs PyObject pointers), so you can't remove the cast there. But my suggestion should still apply to other places, for instance the "error_out&

[issue33300] Bad usage example in id() DocString

Martin Panter added the comment: It is supposed to be a function signature, similar to the syntax when you define your own function, rather than a usage example of calling the function. In this case, the slash notation is described by PEP 457. It is supposed to indicate that “obj” is a

[issue28627] [alpine] shutil.copytree fail to copy a direcotry with broken symlinks

Martin Panter added the comment: This looks like it may be covered by Issue 31940, about the “shutil.copystat” API. See Anthony’s initial proposal at <https://bugs.python.org/issue31940#msg305528>. Max: I think you need the “else” branch to reraise the exception if “errno” doesn’t

[issue33411] All console message are in the error output in bash interpretor

Martin Panter added the comment: The exception message and stack trace is documented to go to stderr: <https://docs.python.org/2/library/sys.html#sys.excepthook>. Whether the prompt “>>>” goes to stderr or stdout depends on quirks of the environment. Issue 1927 currently prop

[issue20104] expose posix_spawn(p)

Martin Panter added the comment: To wrap “posix_spawnattr_setschedparam” perhaps you could combine it with the scheduler policy: # Inherit current policy and parameters: posix_spawn(..., scheduler=None) # Set new policy with parameters: posix_spawn(..., scheduler=(policy, param)) # Inherit

[issue20104] expose posix_spawn(p)

Martin Panter added the comment: Can you use the existing sched_param class? https://docs.python.org/3/library/os.html#os.sched_param -- ___ Python tracker <https://bugs.python.org/issue20

[issue20104] expose posix_spawn(p)

Martin Panter added the comment: I suggested the “scheduler” tuple to bring the two related parameters (scheduling policy and sched_param) together, similar to how they are paired as the second and third parameters to “os.sched_setscheduler”, and because I thought it would imply that a

[issue32393] nav menu jitter in old documentation

Martin Panter added the comment: Maybe related to Issue 24712? -- nosy: +martin.panter ___ Python tracker <https://bugs.python.org/issue32393> ___ ___ Python-bug

[issue33481] configparser.write() does not save comments.

Martin Panter added the comment: Looks like Issue 1410680 has a new function to merge comments with new config values (among other things). -- nosy: +martin.panter ___ Python tracker <https://bugs.python.org/issue33

[issue31520] ResourceWarning: unclosed warning

Martin Panter added the comment: I’m curious how you manage to trigger the warning in the “closed” state. The Python I have handy is half a year out of date, but all my attempts to trigger the warning either produce the less confusing version, ResourceWarning: unclosed or there is no

[issue30576] http.server should support HTTP compression (gzip)

Martin Panter added the comment: Regarding the compressed data generator, it would be better if there were no restrictions on the generator yielding empty chunks. This would match how the upload “body” parameter for HTTPConnection.request can be an iterator without worrying about empty

[issue31158] test_pty: test_basic() fails randomly on Travis CI

Martin Panter added the comment: I prefer Cornelius’s current proposal (rev 4f8137b) because it fixes both sites, rather than just patching the immediate problem site. I don’t think read(1) is a big problem, just less efficient. But if you prefer to do larger reads, that should be fine too

[issue31639] http.server and SimpleHTTPServer hang after a few requests

Martin Panter added the comment: The change in handling KeyboardInterrupt was my intention in Issue 23430. I hope it isn’t a problem on its own :) Running the module with “python -m http.server” uses the HTTPServer class, based on socketserver.TCPServer. This only accepts one connection at a

[issue31639] http.server and SimpleHTTPServer hang after a few requests

Martin Panter added the comment: . Actually take back a lot of what I wrote above. I forgot that SimpleHTTPRequestHandler only supports HTTP 1.0; I don’t think it uses keep-alive or persistent connections, so it should close its TCP connections promptly. There may be something else going on

[issue31639] http.server and SimpleHTTPServer hang after a few requests

Change by Martin Panter : -- Removed message: https://bugs.python.org/msg303440 ___ Python tracker <https://bugs.python.org/issue31639> ___ ___ Python-bugs-list m

[issue31656] Bitwise operations for bytes-type

Martin Panter added the comment: There’s already a bug open for this: Issue 19251. Only equal-length strings should be supported. -- nosy: +martin.panter ___ Python tracker <https://bugs.python.org/issue31

[issue31712] subprocess with stderr=subprocess.STDOUT hang

Martin Panter added the comment: Presumuing your file descriptor 3 is the read end of the pipe to the child’s output, then there is probably a process somewhere that could still write to the write end. Normally “check_output” waits until it has read all possible output from the pipe(s

[issue31712] subprocess with stderr=subprocess.STDOUT hang

Martin Panter added the comment: Scanning over the Open SSH commits for 7.3p1 https://github.com/openssh/openssh-portable/compare/V_7_2_P2...V_7_3_P1 it looks like this commit https://github.com/openssh/openssh-portable/commit/d2d6bf864e52af8491a60dd507f85b74361f5da3 may fix your problem

[issue31760] Re-definition of _POSIX_C_SOURCE with Fedora 26.

Martin Panter added the comment: Looks the same as Issue 31374 -- nosy: +martin.panter resolution: -> duplicate stage: -> resolved status: open -> closed superseder: -> expat: warning: "_POSIX_C_SOURCE" redefined ___

[issue31800] datetime.strptime: Support for parsing offsets with a colon

Martin Panter added the comment: Sorry, I meant Net BSD not Free BSD -- ___ Python tracker <https://bugs.python.org/issue31800> ___ ___ Python-bugs-list mailin

[issue31800] datetime.strptime: Support for parsing offsets with a colon

Martin Panter added the comment: FWIW it looks like “strptime” in glibc, and Open and Free BSD support parsing this and even more formats (RFC 822 and RFC 3339; includes “Z”, U.S. time zones, ±HH). Also, there is Issue 24954 for adding “%:z” like Gnu “date”. -- nosy: +martin.panter

[issue18670] Using read_mime_types function from mimetypes module gives resource warning

Martin Panter added the comment: The patches would mask an OSError raised by the “readfp” call, which would be a change in behaviour. But moving the call does not seem to be necessary; why not leave it outside the “try” statement? -- nosy: +martin.panter

[issue24291] Many servers (wsgiref, http.server, etc) can truncate large output blobs

Martin Panter added the comment: Closing because I understand it is too late to do anything for 3.5 now. -- resolution: -> out of date stage: patch review -> resolved status: open -> closed ___ Python tracker <https://bugs.python.or

[issue22671] Typo in class io.BufferedIOBase docs

Martin Panter added the comment: I’m unlikely to soon, but I don’t mind if someone else uses my patch. -- ___ Python tracker <https://bugs.python.org/issue22

[issue31749] Request: Human readable byte amounts in the standard library

Martin Panter added the comment: Ken Kundert started a related discussion a while back on Python-ideas: <https://www.mail-archive.com/search?l=mid&q=20160830203427.ge2...@kundert.designers-guide.com>. This was about SI-prefixed units in general; not restricted to bytes. Also, t

[issue31894] test_timestamp_naive failed on NetBSD

Martin Panter added the comment: Are you sure it is a “system” bug? As far as I understand, at least Posix does not require support for local time before 1970. See <http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap04.html#tag_04_16>. But why is localtime(14400) relevan

[issue31935] subprocess.run() timeout not working with grandchildren and stdout=PIPE

Martin Panter added the comment: This proposal sounds like a race condition. Closing the output pipe as a child exits means you risk missing recent output. On the other hand, if you don’t care about the output any more, close the pipe first and then wait for the child. Related discussions

[issue21790] Change blocksize in http.client to the value of resource.getpagesize

Martin Panter added the comment: Issue 31945 proposes adding a “blocksize” parameter to HTTPConnection objects, so I suggest to closing in favour of that one. -- resolution: -> rejected superseder: -> Configurable blocksize in HTTP(S)Conn

[issue29710] Incorrect representation caveat on bitwise operation docs

Martin Panter added the comment: I find the model in terms of “bit_length” hard to understand. You have to understand what bit_length returns, and why you added 1. Bit_length is awkward for negative numbers. It only uses the absolute value, which would give off-by-one problems with negative

[issue25942] subprocess.call SIGKILLs too liberally

Martin Panter added the comment: https://github.com/python/cpython/pull/4283 adds a secondary timeout, which defaults to 1 s when there is no main timeout. But this seems complicated and arbitrary. As I understand, the main use case discussed here was waiting without a timeout for a child

[issue31959] Directory at `TemporaryDirectory().name` does not exist

Martin Panter added the comment: The documentation says “On . . . destruction of the temporary directory object the newly created temporary directory and all its contents are removed”. If you had enabled warnings, you may have seen a hint: $ python -Wdefault -c 'import tempfile;

[issue31959] Directory at `TemporaryDirectory().name` does not exist

Change by Martin Panter : -- nosy: +serhiy.storchaka resolution: wont fix -> not a bug stage: -> resolved ___ Python tracker <https://bugs.python.org/i

[issue31526] Allow setting timestamp in gzip-compressed tarfiles

Martin Panter added the comment: Perhaps you can compress the tar file using the “gzip.GzipFile” class. It accepts a custom “mtime” parameter (see Issue 4272, added in 2.7 and 3.1+): >>> gztar = BytesIO() >>> tar = GzipFile(fileobj=gztar, mode="w", mtime=0) >&g

[issue32009] seg fault when using Cntrl-q keymap to exit app

Martin Panter added the comment: This looks the same as Issue 25259. The trigger is that multiple lines are generated at the same time, but Python only expects the first line. -- nosy: +martin.panter resolution: -> duplicate stage: -> resolved status: open -> closed s

[issue26228] pty.spawn hangs on FreeBSD 9.3, 10.x

Martin Panter added the comment: If it helps, here is a basic test case I wrote for “pty.spawn”. I hope that it exposes the problem on Free BSD, but I have only tested it on Linux. parent = r'''\ import pty, sys pty.spawn((sys.executable, "-c", sys.argv[1])) &#x

[issue19613] test_nntplib: sporadic failures, test_article_head_body()

Martin Panter added the comment: Victor opened Issue 32128 with the same complaint. I think I found the offending article: >>> server = NNTP_SSL("nntp.aioe.org") >>> [response, count, first, last, name] = server.group("comp.lang.python") >>>

[issue28778] wsgiref HTTP Response Header Injection: CRLF Injection

Martin Panter added the comment: Issue 11671 is closely related and has a patch proposing to ban control characters including CRLF (but not spaces). Also see Issue 22928 which added header field validation to the HTTP client module. -- dependencies: +Security hole in

[issue30458] CRLF Injection in httplib

Change by Martin Panter : -- type: -> security ___ Python tracker <https://bugs.python.org/issue30458> ___ ___ Python-bugs-list mailing list Unsubscrib

[issue32085] [Security] A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!

Martin Panter added the comment: The square □ in the strings represents a space. Issue 1 (CRLF in HTTP request path): it looks like the %0D%0A would have to be decoded by an earlier step in the chain to "http://127.0.0.1:25/\r\nHELO . . .". This becomes like the header injection I

[issue30458] CRLF Injection in httplib

Martin Panter added the comment: Actually, the CRLF + space can be injected via percent encoding, so just dealing with literal CRLFs and spaces wouldn’t be enough. You would have to validate the hostname after it is decoded. urlopen("http://127.0.0.1%0D%0A%20SLAVEOF . . .

[issue10231] SimpleHTTPRequestHandler directory bugs

Martin Panter added the comment: The first two bugs ("foo/dir?baz" and "foo/dir?baz/") were solved by Issue 23112. The third (".../foo.html/") was solved by Issue 17324. That leaves the fourth complaint, which I don’t understand: ‘translate_path() does not

[issue32084] [Security] http.server can be abused to redirect to (almost) arbitrary URL

Martin Panter added the comment: Maybe a good fix would be to “escape” the double slash with “/.”: if os.path.isdir(path): url = self.path if url.startswith('//'): # E.g. "//www.python.org/%2f.." url = "/." + url # Becomes "

[issue10231] SimpleHTTPRequestHandler directory bugs

Martin Panter added the comment: I read in PEP 11 that Mac OS 9 support was dropped in Python 2.4. I agree that eliminating “.” and “..” components makes sense, since that is how they should be handled when resolving relative URLs. But it seems low priority, since this doesn’t happen on

[issue32143] os.statvfs lacks f_fsid

Martin Panter added the comment: The doc string for the result object, and the main Python 2 documentation, both say that the result is a 10-tuple. So perhaps any new field should only be an attribute, and the tuple should stay the same size, to maintain compatibility. This was done in other

[issue32085] [Security] A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!

Martin Panter added the comment: Issue 32185 proposes to stop sending IP addresses in the TLS SNI protocol. Maybe this will help; it depends if it will catch IP address strings with with whitespace or if there are other ways to inject invalid hostnames. -- dependencies

[issue26439] ctypes.util.find_library fails when ldconfig/glibc not available (e.g., AIX)

Martin Panter added the comment: Michael Felt: if you still want the code compatible with Python 2 and 3 (and others are happy with that), I suggest documenting that in a code comment. -- ___ Python tracker <https://bugs.python.org/issue26

<    1   2   3   4   5   6   7   8   9   10   >