<div dir="ltr"><br><br><div class="gmail_quote"><div dir="ltr">On Wed, 11 May 2016 at 09:07 Thomas Heller <<a href="mailto:theller@ctypes.org">theller@ctypes.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Am 11.05.2016 um 18:04 schrieb Brett Cannon:<br>
><br>
><br>
> On Wed, 11 May 2016 at 04:35 Thomas Heller <<a href="mailto:theller@ctypes.org" target="_blank">theller@ctypes.org</a><br>
> <mailto:<a href="mailto:theller@ctypes.org" target="_blank">theller@ctypes.org</a>>> wrote:<br>
><br>
> Am 10.05.2016 um 19:39 schrieb Brett Cannon:<br>
> ><br>
> ><br>
> > On Tue, 10 May 2016 at 01:18 Martin Panter <<a href="mailto:vadmium%2Bpy@gmail.com" target="_blank">vadmium+py@gmail.com</a><br>
> <mailto:<a href="mailto:vadmium%252Bpy@gmail.com" target="_blank">vadmium%2Bpy@gmail.com</a>><br>
> > <mailto:<a href="mailto:vadmium%252Bpy@gmail.com" target="_blank">vadmium%2Bpy@gmail.com</a> <mailto:<a href="mailto:vadmium%25252Bpy@gmail.com" target="_blank">vadmium%252Bpy@gmail.com</a>>>><br>
> wrote:<br>
> ><br>
> > I am working on <<a href="https://bugs.python.org/issue22636" rel="noreferrer" target="_blank">https://bugs.python.org/issue22636</a>>, to fix shell<br>
> > injection problems with ctypes.util.find_library(). The<br>
> proposal for<br>
> > Python 3 is to change os.popen(shell-script) calls to use<br>
> > subprocess.Popen().<br>
> ><br>
> > However the Python 2.7 version of the module has a comment<br>
> which says<br>
> > “This file should be kept compatible with Python 2.3, see PEP<br>
> 291.”<br>
> > Looking at <<a href="https://www.python.org/dev/peps/pep-0291/" rel="noreferrer" target="_blank">https://www.python.org/dev/peps/pep-0291/</a>>, it is not<br>
> > clear why we have to maintain this compatibility. My best guess is<br>
> > that there may be an external ctypes package that people<br>
> want(ed) to<br>
> > keep compatible with 2.3, and also keep synchronized with 2.7.<br>
> ><br>
> ><br>
> > That's correct and the maintainer is/was Thomas Heller who I have<br>
> cc'ed<br>
> > to see if he's okay with lifting the restriction.<br>
><br>
> For me it is totally ok to lift this restriction.<br>
><br>
><br>
> Great! I'll also update PEP 291.<br>
<br>
Cool. While you're at it, the compatibility restriction for<br>
modulefinder could also be lifted.<br></blockquote><div><br></div><div>Will do. </div></div></div>