Mailman 3 July 2010 - docs

[issue9086] Wrong linking terminology in windows FAQ
by John Miller Oct. 17, 2010

Oct. 17, 2010

New submission from John Miller <gyuval(a)gmail.com>: The 'How can I embed Python' section in the 'Python on Windows FAQ' (http://docs.python.org/faq/windows.html) uses wrong terms: What the FAQ calls static linking and dynamic linking are actally two forms of dynamic linking - load-time dynamic linking and run-time dynamic linking, respectively. Static linking means something else entirely - linking with a library that itself contains the implementation, i.e. there will be no usage of … [View More]

5 4

audioop module documentation bug
by Kalle Karjalainen Oct. 17, 2010

Oct. 17, 2010

Hello, I found a bug in http://docs.python.org/library/audioop.html In the example method, def mul_stereo(sample, width, lfactor, rfactor), the result of its first two lines: lsample = audioop.tomono(sample, width, 1, 0) rsample = audioop.tomono(sample, width, 0, 1) ... is discarded by the following two lines: lsample = audioop.mul(sample, width, lfactor) rsample = audioop.mul(sample, width, rfactor) ... resulting in a sample twice as long being returned as is intended, i.e. "slowing down”… [View More]

2 1

[issue8968] token type constants are not documented
by Ilya Sandler Oct. 17, 2010

Oct. 17, 2010

New submission from Ilya Sandler <ilya.sandler(a)gmail.com>: the token module defines constants for token types e.g NAME = 1 NUMBER = 2 STRING = 3 NEWLINE = 4 etc. These constants are very useful for any code which needs to tokenize python source, yet they are not listed in the documentation. Is this a documentation bug? ---------- assignee: docs@python components: Documentation messages: 107509 nosy: docs@python, isandler priority: normal severity: normal status: open title: … [View More]

3 5

hmac.digest() return value
by Perseids Oct. 17, 2010

Oct. 17, 2010

Hi, I am new to Python 3, but I believe I have found a little error in the documentation. The return value of hmac.digest() is a bytes object, and not a string. See http://docs.python.org/py3k/library/hmac.html . Regards Perseids

2 1

[issue8855] Shelve documentation lacks security warning
by Longpoke Oct. 17, 2010

Oct. 17, 2010

New submission from Longpoke <longpoke(a)gmail.com>: Loading a shelve can cause arbitrary code to be executed [1] and other black magic (because it's backed by Pickle). Shouldn't there be a big fat warning at the top of the shelve documentation page? Unless you're like me and assume anything to do with serialization in any language is insecure until proved otherwise, you aren't going to intuitively think there is anything wrong with "unshelving" untrusted data (unless you already know … [View More]

3 3

[issue8811] fixing sqlite3 docs for py3k
by Shashwat Anand Oct. 17, 2010

Oct. 17, 2010

New submission from Shashwat Anand <anand.shashwat(a)gmail.com>: The docs of sqlite3 for python 3.0 and 3.1 seems to be written for python 2.6 and hence wrong at many places. like, >>> for member in r: print member However the docs for sqlite3 in py3k trunk seems fine. The sqlite3 doc in py3k trunk should be used in these places. http://docs.python.org/release/3.0.1/library/sqlite3.html http://docs.python.org/release/3.1/library/sqlite3.html ---------- assignee: docs@… [View More]

3 6

[issue8686] "This isn't defined beyond that" phrase is not friendly to non-native English speakers.
by INADA Naoki Oct. 17, 2010

Oct. 17, 2010

New submission from INADA Naoki <songofacandy(a)gmail.com>: http://docs.python.org/library/difflib.html#difflib.SequenceMatcher.quick_r… > This isn’t defined beyond that it is an upper bound on ratio(), and is faster to compute. "beyond" is a bit confusing because it also means "over" and this sentence refers upper bound. I think "This isn't defined in detail more than..." is easier. ---------- assignee: docs@python components: Documentation messages: 105498 nosy: docs@python, … [View More]

7 8

[issue8556] Confusing string formatting examples
by Jeff McNeil Oct. 17, 2010

Oct. 17, 2010

New submission from Jeff McNeil <jeff(a)jmcneil.net>: I was going through the string formatting examples this evening and noticed this: print '%(language)s has %(#)03d quote types.' % \ {'language': "Python", "#": 2} The example uses a '#' as a map key. This is somewhat misleading as if we had simply left the parenthesis off, the '#' would have been interpreted as an alternate conversion flag. Should be updated to use a more verbose (and less confusing) dictionary key. -----… [View More]

4 5

[issue9093] Tools/README is out of date
by Alexander Belopolsky Oct. 14, 2010

Oct. 14, 2010

New submission from Alexander Belopolsky <belopolsky(a)users.sourceforge.net>: Here is the list of subdirectories in Tools. Here is the diff between directory listing and readme ('-' means no readme entry, '+' - no tool): -buildbot -ccbench +audiopy +compiler faqwiz -framer freeze gdb i18n -iobench -msi -pybench pynche scripts -ssl unicode versioncheck +webchecker world ---------- assignee: docs@python components: Documentation messages: 108797 nosy: belopolsky, docs@python … [View More]

3 5

[issue9061] cgi.escape Can Lead To XSS Vulnerabilities
by Craig Younkins Aug. 24, 2010

Aug. 24, 2010

New submission from Craig Younkins <cyounkins(a)gmail.com>: The method in question: http://docs.python.org/library/cgi.html#cgi.escape http://svn.python.org/view/python/tags/r265/Lib/cgi.py?view=markup # at the bottom http://code.python.org/hg/trunk/file/3be6ff1eebac/Lib/cgi.py#l1031 "Convert the characters '&', '<' and '>' in string s to HTML-safe sequences. Use this if you need to display text that might contain such characters in HTML. If the optional flag quote is true, … [View More]the quotation mark character ('"') is also translated; this helps for inclusion in an HTML attribute value, as in <A HREF="...">. If the value to be quoted might include single- or double-quote characters, or both, consider using the quoteattr() function in the xml.sax.saxutils module instead." cgi.escape never escapes single quote characters, which can easily lead to a Cross-Site Scripting (XSS) vulnerability. This seems to be known by many, but a quick search reveals many are using cgi.escape for HTML attribute escaping. The intended use of this method is unclear to me. Up to and including Mako 0.3.3, this method was the HTML escaping method. Used in this manner, single-quoted attributes with user-supplied data are easily susceptible to cross-site scripting vulnerabilities. While the documentation says "if the value to be quoted might include single- or double-quote characters... [use the] xml.sax.saxutils module instead," it also implies that this method will make input safe for HTML. Because this method escapes 4 of the 5 key XML characters, it is reasonable to expect some will use it for HTML escaping. I suggest rewording the documentation for the method making it more clear what it should and should not be used for. I would like to see the method changed to properly escape single-quotes, but if it is not changed, the documentation should explicitly say this method does not make input safe for inclusion in HTML. This is definitely affecting the security of some Python web applications. I already mentioned Mako, but I've found this type of bug in other frameworks and engines because the creators either called cgi.escape directly or modeled their own after it. Craig Younkins ---------- assignee: docs@python components: Documentation, Library (Lib) messages: 108457 nosy: Craig.Younkins, docs@python priority: normal severity: normal status: open title: cgi.escape Can Lead To XSS Vulnerabilities versions: Python 2.5, Python 2.6, Python 2.7, Python 3.1, Python 3.2, Python 3.3 _______________________________________ Python tracker <report(a)bugs.python.org> <http://bugs.python.org/issue9061> _______________________________________ [View Less]

7 12