Mailman 3 August 2015 - docs

[issue24778] mailcap.findmatch: document shell command Injection danger in filename parameter
by Bernd Dietzel 05 Aug '15

05 Aug '15

Bernd Dietzel added the comment: What i do is the last doc is like this : 1) Replace the filename with a random name 2) Run mailcap.findmatch() with the random name 3) If exists, replace the quote characters ' before and behind the random name with nothing. 4) Now the random name has no quoting from mailcap itself 5) So now we can use our own quote() savely ---------- _______________________________________ Python tracker <report(a)bugs.python.org> <http://bugs.python.org/issue24778> _______________________________________

1 0

[issue24778] mailcap.findmatch: document shell command Injection danger in filename parameter
by R. David Murray 05 Aug '15

05 Aug '15

R. David Murray added the comment: I have no idea what your code samples are trying to accomplish, I'm afraid, but that's not the kind of documentation I'm advocating anyway. ---------- title: mailcap.findmatch() ........ Shell Command Injection in filename -> mailcap.findmatch: document shell command Injection danger in filename parameter _______________________________________ Python tracker <report(a)bugs.python.org> <http://bugs.python.org/issue24778> _______________________________________

1 0

[issue24778] mailcap.findmatch() ........ Shell Command Injection in filename
by Bernd Dietzel 05 Aug '15

05 Aug '15

Bernd Dietzel added the comment: # for the docs ... quoting of the filename when you call mailcap.findmatch() f=";xterm;#.txt" # Shell Command Demo ... xterm will run if quote() fails import mailcap import random try: from shlex import quote except ImportError: from pipes import quote d=mailcap.getcaps() PY=''.join(random.choice('PYTHON') for i in range(100)) cmd,MIMEtype=mailcap.findmatch(d, 'text/plain', filename=PY) while "'"+PY+"'" in cmd: cmd=cmd.replace("'"+PY+"'",quote(f)) while PY in cmd: cmd=cmd.replace(PY,quote(f)) print(cmd) # less ';xterm;#.txt' ---------- _______________________________________ Python tracker <report(a)bugs.python.org> <http://bugs.python.org/issue24778> _______________________________________

1 0

[issue24129] Incorrect (misleading) statement in the execution model documentation
by levkivskyi 05 Aug '15

05 Aug '15

New submission from levkivskyi: The documentation on execution model https://docs.python.org/3/reference/executionmodel.html contains the statement """ A class definition is an executable statement that may use and define names. These references follow the normal rules for name resolution. The namespace of the class definition becomes the attribute dictionary of the class. Names defined at the class scope are not visible in methods. """ However, the following code (taken from http://lackingrhoticity.blogspot.ch/2008/08/4-python-variable-binding-oddit…): x = "xtop" y = "ytop" def func(): x = "xlocal" y = "ylocal" class C: print(x) print(y) y = 1 func() prints xlocal ytop In case of "normal rules for name resolution" it should rise UnboundLocalError. I suggest replacing the mentioned statement with the following: """ A class definition is an executable statement that may use and define names. Free variables follow the normal rules for name resolution, bound variables are looked up in the global namespace. The namespace of the class definition becomes the attribute dictionary of the class. Names defined at the class scope are not visible in methods. """ or a similar one. ---------- assignee: docs@python components: Documentation messages: 242619 nosy: docs@python, levkivskyi priority: normal severity: normal status: open title: Incorrect (misleading) statement in the execution model documentation type: behavior versions: Python 3.4, Python 3.5 _______________________________________ Python tracker <report(a)bugs.python.org> <http://bugs.python.org/issue24129> _______________________________________

9 22

[issue24789] ctypes doc string
by eryksun 04 Aug '15

04 Aug '15

eryksun added the comment: That's a vestige of the 2.x docs. For 3.x it should be "create_string_buffer(aBytes, anInteger)". ---------- assignee: -> docs@python components: +Documentation nosy: +docs@python, eryksun versions: +Python 3.5, Python 3.6 _______________________________________ Python tracker <report(a)bugs.python.org> <http://bugs.python.org/issue24789> _______________________________________

1 0

[issue20769] Reload() description is unclear
by Roy Smith 04 Aug '15

04 Aug '15

New submission from Roy Smith: http://docs.python.org/2/library/functions.html#reload says: It is legal though generally not very useful to reload built-in or dynamically loaded modules, except for sys, __main__ and __builtin__. It is unclear what the "except for ..." part is referring to. Is it not legal to reload those modules? Or is it not very useful to reload them? ---------- assignee: docs@python components: Documentation messages: 212187 nosy: docs@python, roysmith priority: normal severity: normal status: open title: Reload() description is unclear versions: Python 2.7 _______________________________________ Python tracker <report(a)bugs.python.org> <http://bugs.python.org/issue20769> _______________________________________

7 13

[issue24778] mailcap.findmatch() ........ Shell Command Injection in filename
by Bernd Dietzel 04 Aug '15

04 Aug '15

Bernd Dietzel added the comment: Yes changing the docs is a good idea. I was thinking about a patch : import os ####### patch import random try: from shlex import quote except ImportError: from pipes import quote ####### ....... and so on .... # Part 3: using the database. def findmatch(caps, MIMEtype, key='view', filename="/dev/null", plist=[]): """Find a match for a mailcap entry. Return a tuple containing the command line, and the mailcap entry used; (None, None) if no match is found. This may invoke the 'test' command of several matching entries before deciding which entry to use. """ entries = lookup(caps, MIMEtype, key) # XXX This code should somehow check for the needsterminal flag. for e in entries: if 'test' in e: test = subst(e['test'], filename, plist) if test and os.system(test) != 0: continue ####### patch ps=''.join(random.choice('python') for i in range(100)) x=e[key] while '%s' in x: x=x.replace('%s',ps) command=subst(x, MIMEtype, filename, plist) while "'"+ps+"'" in command: command=command.replace("'"+ps+"'",quote(filename)) while ps in command: command=command.replace(ps,quote(filename)) ###### command = subst(e[key], MIMEtype, filename, plist) return command, e return None, None ---------- _______________________________________ Python tracker <report(a)bugs.python.org> <http://bugs.python.org/issue24778> _______________________________________

1 0

[issue24778] mailcap.findmatch() ........ Shell Command Injection in filename
by R. David Murray 03 Aug '15

03 Aug '15

R. David Murray added the comment: Hmm. I see. The problem is that our desire to quote conflicts with mailcap's attempts to quote. I now agree with you that run-mailcap's approach is correct, but creating a temporary alias is out of scope for findmatch. That would need to be done by findmatch's caller. I think we should add a documentation note about the problem and the solution. I don't see any reliable way to detect the problem and raise an error for the same reason that quoting doesn't work. (The aliasing can tolerate false positives; but, for backward compatibility reasons, an error detection function here cannot.) It would be possible to add a helper for the aliasing to 3.6, but if someone wants to propose that they should open an new issue for the enhancement. I'm ---------- assignee: -> docs@python components: +Documentation nosy: +docs@python _______________________________________ Python tracker <report(a)bugs.python.org> <http://bugs.python.org/issue24778> _______________________________________

1 0

[issue23725] update tempfile docs to say that TemporaryFile is secure
by R. David Murray 03 Aug '15

03 Aug '15

R. David Murray added the comment: Heh. This was really bugging me. I remembered it clearly, but I couldn't find an issue. Thought maybe it was a comment in the code, but nope. Google led me to this line in the docs: "It is no longer necessary to use the global tempdir variable." Checking when that was last changed, it turns out it was by me in issue 10354, which is the issue containing the discussion that I was remembering, but that was about template. Nevertheless, I think the sentence in the docs itself could be considered a documentation deprecation. Since you are arguing that it shouldn't be considered deprecated, I think we should get some more participants in the discussion. I'm +.5 on explicitly documenting it as deprecated. I'm adding a couple folks from issue 10354 who might have an opinion. Note that if we do keep it in the main section, that sentence should still be deleted, since it looks like "it is no longer necessary" has been true now for longer than it *was* necessary. ---------- nosy: +eric.smith, gregory.p.smith, rhettinger _______________________________________ Python tracker <report(a)bugs.python.org> <http://bugs.python.org/issue23725> _______________________________________

1 0

[issue24021] document urllib.urlretrieve
by Berker Peksag 03 Aug '15

03 Aug '15

New submission from Berker Peksag: urllib.urlretrieve is already documented at https://docs.python.org/2.7/library/urllib.html#urllib.urlretrieve Can you please give us more information about your problem with the urllib.urlretrieve documentation? ---------- nosy: +berker.peksag _______________________________________ Python tracker <report(a)bugs.python.org> <http://bugs.python.org/issue24021> _______________________________________

7 7