Mailman 3 March 2021 - docs

[issue36384] ipaddress Should not reject IPv4 addresses with leading zeroes as ambiguously octal
by Christian Heimes 30 Mar '21

30 Mar '21

Christian Heimes <lists(a)cheimes.de> added the comment: Serhiy was right, this is a security issue. The patch should not have landed in 3.8. At a bare minimum the patch should have been postponed until documentation was updated. Since 3.8 the ipaddresss does not behave as documented. A similar security issue in NPM was published two days ago, CVE-2021-28918. I proposed to not only revert the change, but also tighten the check for leading zeros so it behaves like glibc's inet_pton(). It refuses any IPv4 string with a leading zero. >>> socket.inet_pton(socket.AF_INET, "01.1.1.1") Traceback (most recent call last): File "<stdin>", line 1, in <module> OSError: illegal IP address string passed to inet_pton >>> socket.inet_pton(socket.AF_INET, "1.1.1.01") Traceback (most recent call last): File "<stdin>", line 1, in <module> OSError: illegal IP address string passed to inet_pton ---------- components: +Library (Lib) keywords: +3.8regression, 3.9regression -3.2regression nosy: +christian.heimes priority: normal -> critical type: behavior -> security versions: +Python 3.10, Python 3.9 _______________________________________ Python tracker <report(a)bugs.python.org> <https://bugs.python.org/issue36384> _______________________________________

1 0

[issue19124] os.execv executes in background on Windows
by Eryk Sun 30 Mar '21

30 Mar '21

Eryk Sun <eryksun(a)gmail.com> added the comment: Steve, what do you think about os.exec*()? Should it be emulated better or deprecated? We can't hide the reality that it's a new process with a different process ID and parent process ID -- against what POSIX requires. But emulating exec() is probably good enough for most cases, especially if code expects to work in Windows. > I like the idea, but we shouldn't invert the dependencies like that. > nt/os is a lower-level library, and should provide its own > implementation (that perhaps subprocess could then use). The precedent I had in mind is os.popen(), which uses subprocess. There wouldn't be much need to implement system() and spawnv[e] if ucrt used PROC_THREAD_ATTRIBUTE_HANDLE_LIST in the common spawn code (exec\spawnv.cpp). Any chance that's in development or planned? If Python implements its own system() and spawnv[e]() functions, support for inheritable file descriptors [1] would probably have to be dropped. That's not a great loss, IMO, but I'm sure someone will be unhappy about it. The problem is that the flags for an open fd (e.g. FDEV, FPIPE, FAPPEND, FTEXT, FNOINHERIT), which the CRT copies to the STARTUPINFO.lpReserved2 buffer, are not public data. In particular, the FAPPEND flag for an O_APPEND open can't be determined or inferred. --- [1] Making an fd inheritable currently requires two steps in Windows Python: fd2 = os.dup(fd); os.set_inheritable(fd2, True). os.dup(fd) creates a duplicate fd that's not flagged FNOINHERIT, but the underlying OS handle isn't inheritable. os.set_inheritable(fd, True) makes the OS handle inheritable, but it can't remove the FNOINHERIT fd flag. ---------- _______________________________________ Python tracker <report(a)bugs.python.org> <https://bugs.python.org/issue19124> _______________________________________

1 0

[issue19124] os.execv executes in background on Windows
by Steve Dower 29 Mar '21

29 Mar '21

Steve Dower <steve.dower(a)python.org> added the comment: > nt.spawnv[e](), nt.waitpid(), and nt.system() could also be implemented with subprocess. I like the idea, but we shouldn't invert the dependencies like that. nt/os is a lower-level library, and should provide its own implementation (that perhaps subprocess could then use). ---------- _______________________________________ Python tracker <report(a)bugs.python.org> <https://bugs.python.org/issue19124> _______________________________________

1 0

[issue43658] implementations of the deprecated load_module import loader API, as prescribed by the documentation, are not thread safe
by kale-smoothie 29 Mar '21

29 Mar '21

New submission from kale-smoothie <suraj-patel-95(a)outlook.com>: Unless I've misread or misunderstood, the documentation at https://docs.python.org/3/reference/import.html#loaders for the deprecated `load_module` method doesn't indicate any requirements or caveats for thread safe importing. As it stands, I think it is not thread-safe, since the module is not protected against concurrent imports by the internal implementation marker `__spec__._initializing = True`. Additionally, the deprecated function decorator, `importlib.util.module_for_loader` seems to implement the marker incorrectly (sets `__initializing__` directly on the module). I think this behaviour should either be documented as a major caveat, or internal details exposed to allow thread-safe implementations, or the old API removed entirely. ---------- assignee: docs@python components: Documentation files: thread_unsafe_import.py messages: 389713 nosy: docs@python, kale-smoothie priority: normal severity: normal status: open title: implementations of the deprecated load_module import loader API, as prescribed by the documentation, are not thread safe type: behavior versions: Python 3.10, Python 3.6, Python 3.7, Python 3.8, Python 3.9 Added file: https://bugs.python.org/file49916/thread_unsafe_import.py _______________________________________ Python tracker <report(a)bugs.python.org> <https://bugs.python.org/issue43658> _______________________________________

1 0

[issue43648] Remove redundant datefmt option in logging file config
by Harry 29 Mar '21

29 Mar '21

New submission from Harry <harry.lees(a)gmail.com>: In the logging.conf section of the docs, there is a redundant datefmt option https://docs.python.org/3.10/howto/logging.html#configuring-logging ---------- assignee: docs@python components: Documentation messages: 389637 nosy: Harry-Lees, docs@python priority: normal severity: normal status: open title: Remove redundant datefmt option in logging file config versions: Python 3.10 _______________________________________ Python tracker <report(a)bugs.python.org> <https://bugs.python.org/issue43648> _______________________________________

3 3

[issue43653] Typo in the random.shuffle docs
by Matteo Bertucci 29 Mar '21

29 Mar '21

New submission from Matteo Bertucci <matteobertucci2004(a)gmail.com>: Hello! The current documentation for random.shuffle reads: > The optional argument random is a 0-argument function returning a random float in [0.0, 1.0); by default, this is the function random(). I believe the range here should use matching symbols, unless I am missing something. ---------- assignee: docs@python components: Documentation messages: 389669 nosy: Akarys, docs@python priority: normal severity: normal status: open title: Typo in the random.shuffle docs type: enhancement _______________________________________ Python tracker <report(a)bugs.python.org> <https://bugs.python.org/issue43653> _______________________________________

2 3

[issue43094] sqlite3.create_function takes parameter named narg, not num_params
by Nicholas Chammas 28 Mar '21

28 Mar '21

New submission from Nicholas Chammas <nicholas.chammas(a)gmail.com>: The doc for sqlite3.create_function shows the signature as follows: https://docs.python.org/3.9/library/sqlite3.html#sqlite3.Connection.create_… ``` create_function(name, num_params, func, *, deterministic=False) ``` But it appears that the parameter name is `narg`, not `num_params`. Trying `num_params` yields: ``` TypeError: function missing required argument 'narg' (pos 2) ``` ---------- assignee: docs@python components: Documentation messages: 386100 nosy: docs@python, nchammas priority: normal severity: normal status: open title: sqlite3.create_function takes parameter named narg, not num_params versions: Python 3.9 _______________________________________ Python tracker <report(a)bugs.python.org> <https://bugs.python.org/issue43094> _______________________________________

3 12

[issue35026] Winreg's documentation lacks mentioning required permission at some points
by George Fischhof 28 Mar '21

28 Mar '21

New submission from George Fischhof <george(a)fischhof.hu>: Winreg's documentation lacks mentioning required permission at some points Hi there, on page https://docs.python.org/3/library/winreg.html it is not mentioned in the description of the following functions: winreg.DeleteKey winreg.DeleteKeyEx winreg.DeleteValue that they require KEY_SET_VALUE when the registry key is opened. It is mentioned for example at: winreg.SetValue with the following text: The key identified by the key parameter must have been opened with KEY_SET_VALUE access. BR, George ---------- assignee: docs@python components: Documentation messages: 328034 nosy: docs@python, georgefischhof priority: normal severity: normal status: open title: Winreg's documentation lacks mentioning required permission at some points type: enhancement versions: Python 3.7 _______________________________________ Python tracker <report(a)bugs.python.org> <https://bugs.python.org/issue35026> _______________________________________

4 4

[issue22790] some class attributes missing from dir(Class)
by Siddharth Chabra 27 Mar '21

27 Mar '21

Change by Siddharth Chabra <siddharthchabra(a)gmail.com>: ---------- nosy: +siddharthchabra versions: -Python 3.10, Python 3.8, Python 3.9 _______________________________________ Python tracker <report(a)bugs.python.org> <https://bugs.python.org/issue22790> _______________________________________

1 0

[issue37339] Document that os.path.ismount() returns true for nested btrfs subvolumes
by Eryk Sun 27 Mar '21

27 Mar '21

Change by Eryk Sun <eryksun(a)gmail.com>: ---------- assignee: -> docs@python components: +Documentation nosy: +docs@python title: os.path.ismount returns true on nested btrfs subvolumes -> Document that os.path.ismount() returns true for nested btrfs subvolumes type: behavior -> enhancement versions: +Python 3.10 -Python 3.7 _______________________________________ Python tracker <report(a)bugs.python.org> <https://bugs.python.org/issue37339> _______________________________________

1 0