Mailman 3 February 2005 - Python-checkins

[Python-checkins] python/dist/src/Lib SimpleXMLRPCServer.py, 1.7.8.1, 1.7.8.2
by gvanrossum＠users.sourceforge.net Feb. 3, 2005

Feb. 3, 2005

Update of /cvsroot/python/python/dist/src/Lib In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv14953/Lib Modified Files: Tag: release23-maint SimpleXMLRPCServer.py Log Message: Security fix PSF-2005-001 for SimpleXMLRPCServer.py. Index: SimpleXMLRPCServer.py =================================================================== RCS file: /cvsroot/python/python/dist/src/Lib/SimpleXMLRPCServer.py,v retrieving revision 1.7.8.1 retrieving revision 1.7.8.2 diff -u -d -r1.7.8.1 -r1.7.8.2 --- SimpleXMLRPCServer.py 3 Oct 2004 23:23:00 -0000 1.7.8.1 +++ SimpleXMLRPCServer.py 3 Feb 2005 14:59:43 -0000 1.7.8.2 @@ -107,14 +107,22 @@ import types import os -def resolve_dotted_attribute(obj, attr): +def resolve_dotted_attribute(obj, attr, allow_dotted_names=True): """resolve_dotted_attribute(a, 'b.c.d') => a.b.c.d Resolves a dotted attribute name to an object. Raises an AttributeError if any attribute in the chain starts with a '_'. + + If the optional allow_dotted_names argument is false, dots are not + supported and this function operates similar to getattr(obj, attr). """ - for i in attr.split('.'): + if allow_dotted_names: + attrs = attr.split('.') + else: + attrs = [attr] + + for i in attrs: if i.startswith('_'): raise AttributeError( 'attempt to access private attribute "%s"' % i @@ -156,7 +164,7 @@ self.funcs = {} self.instance = None - def register_instance(self, instance): + def register_instance(self, instance, allow_dotted_names=False): """Registers an instance to respond to XML-RPC requests. Only one instance can be installed at a time. @@ -174,9 +182,23 @@ If a registered function matches a XML-RPC request, then it will be called instead of the registered instance. + + If the optional allow_dotted_names argument is true and the + instance does not have a _dispatch method, method names + containing dots are supported and resolved, as long as none of + the name segments start with an '_'. + + *** SECURITY WARNING: *** + + Enabling the allow_dotted_names options allows intruders + to access your module's global variables and may allow + intruders to execute arbitrary code on your machine. Only + use this option on a secure, closed network. + """ self.instance = instance + self.allow_dotted_names = allow_dotted_names def register_function(self, function, name = None): """Registers a function to respond to XML-RPC requests. @@ -295,7 +317,8 @@ try: method = resolve_dotted_attribute( self.instance, - method_name + method_name, + self.allow_dotted_names ) except AttributeError: pass @@ -374,7 +397,8 @@ try: func = resolve_dotted_attribute( self.instance, - method + method, + self.allow_dotted_names ) except AttributeError: pass

1 0

python/dist/src/Doc/lib libsimplexmlrpc.tex, 1.5.14.1, 1.5.14.2
by gvanrossum＠users.sourceforge.net Feb. 3, 2005

Feb. 3, 2005

Update of /cvsroot/python/python/dist/src/Doc/lib In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv14953/Doc/lib Modified Files: Tag: release23-maint libsimplexmlrpc.tex Log Message: Security fix PSF-2005-001 for SimpleXMLRPCServer.py. Index: libsimplexmlrpc.tex =================================================================== RCS file: /cvsroot/python/python/dist/src/Doc/lib/libsimplexmlrpc.tex,v retrieving revision 1.5.14.1 retrieving revision 1.5.14.2 diff -u -d -r1.5.14.1 -r1.5.14.2 --- libsimplexmlrpc.tex 8 Oct 2004 18:35:46 -0000 1.5.14.1 +++ libsimplexmlrpc.tex 3 Feb 2005 14:59:43 -0000 1.5.14.2 @@ -55,19 +55,34 @@ period character. \end{methoddesc} -\begin{methoddesc}[SimpleXMLRPCServer]{register_instance}{instance} +\begin{methoddesc}[SimpleXMLRPCServer]{register_instance}{instance\optional{, + allow_dotted_names}} Register an object which is used to expose method names which have not been registered using \method{register_function()}. If \var{instance} contains a \method{_dispatch()} method, it is called with the requested method name and the parameters from the request; the return value is returned to the client as the result. If \var{instance} does not have a \method{_dispatch()} method, it is - searched for an attribute matching the name of the requested method; + searched for an attribute matching the name of the requested method. + + If the optional \var{allow_dotted_names} argument is true and the + instance does not have a \method{_dispatch()} method, then if the requested method name contains periods, each component of the method name is searched for individually, with the effect that a simple hierarchical search is performed. The value found from this search is then called with the parameters from the request, and the return value is passed back to the client. + + \begin{notice}[warning] + Enabling the \var{allow_dotted_names} option allows intruders to access + your module's global variables and may allow intruders to execute + arbitrary code on your machine. Only use this option on a secure, + closed network. + \end{notice} + + \versionchanged[\var{allow_dotted_names} was added to plug a security hole; + prior versions are insecure]{2.3.5, 2.4.1} + \end{methoddesc} \begin{methoddesc}{register_introspection_functions}{}

1 0

python/dist/src/Lib SimpleXMLRPCServer.py, 1.2, 1.2.10.1
by gvanrossum＠users.sourceforge.net Feb. 3, 2005

Feb. 3, 2005

Update of /cvsroot/python/python/dist/src/Lib In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv14681/Lib Modified Files: Tag: release22-maint SimpleXMLRPCServer.py Log Message: Security fix PSF-2005-001 for SimpleXMLRPCServer.py. Index: SimpleXMLRPCServer.py =================================================================== RCS file: /cvsroot/python/python/dist/src/Lib/SimpleXMLRPCServer.py,v retrieving revision 1.2 retrieving revision 1.2.10.1 diff -u -d -r1.2 -r1.2.10.1 --- SimpleXMLRPCServer.py 29 Sep 2001 04:54:33 -0000 1.2 +++ SimpleXMLRPCServer.py 3 Feb 2005 14:58:26 -0000 1.2.10.1 @@ -161,7 +161,8 @@ try: func = _resolve_dotted_attribute( self.server.instance, - method + method, + self.allow_dotted_names ) except AttributeError: pass @@ -178,11 +179,20 @@ BaseHTTPServer.BaseHTTPRequestHandler.log_request(self, code, size) -def _resolve_dotted_attribute(obj, attr): +def _resolve_dotted_attribute(obj, attr, allow_dotted_names=True): """Resolves a dotted attribute name to an object. Raises an AttributeError if any attribute in the chain starts with a '_'. + + If the optional allow_dotted_names argument is false, dots are not + supported and this function operates similar to getattr(obj, attr). """ - for i in attr.split('.'): + + if allow_dotted_names: + attrs = attr.split('.') + else: + attrs = [attr] + + for i in attrs: if i.startswith('_'): raise AttributeError( 'attempt to access private attribute "%s"' % i @@ -206,7 +216,7 @@ self.instance = None SocketServer.TCPServer.__init__(self, addr, requestHandler) - def register_instance(self, instance): + def register_instance(self, instance, allow_dotted_names=False): """Registers an instance to respond to XML-RPC requests. Only one instance can be installed at a time. @@ -225,9 +235,23 @@ If a registered function matches a XML-RPC request, then it will be called instead of the registered instance. + + If the optional allow_dotted_names argument is true and the + instance does not have a _dispatch method, method names + containing dots are supported and resolved, as long as none of + the name segments start with an '_'. + + *** SECURITY WARNING: *** + + Enabling the allow_dotted_names options allows intruders + to access your module's global variables and may allow + intruders to execute arbitrary code on your machine. Only + use this option on a secure, closed network. + """ self.instance = instance + self.allow_dotted_names = allow_dotted_names def register_function(self, function, name = None): """Registers a function to respond to XML-RPC requests.

1 0

python/dist/src/Misc NEWS, 1.337.2.4.2.94, 1.337.2.4.2.95
by gvanrossum＠users.sourceforge.net Feb. 3, 2005

Feb. 3, 2005

Update of /cvsroot/python/python/dist/src/Misc In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv14681/Misc Modified Files: Tag: release22-maint NEWS Log Message: Security fix PSF-2005-001 for SimpleXMLRPCServer.py. Index: NEWS =================================================================== RCS file: /cvsroot/python/python/dist/src/Misc/NEWS,v retrieving revision 1.337.2.4.2.94 retrieving revision 1.337.2.4.2.95 diff -u -d -r1.337.2.4.2.94 -r1.337.2.4.2.95 --- NEWS 17 Sep 2003 03:32:41 -0000 1.337.2.4.2.94 +++ NEWS 3 Feb 2005 14:58:41 -0000 1.337.2.4.2.95 @@ -2,6 +2,10 @@ Release date: XX-XXX-XXXX =========================== +- Applied a security fix to SimpleXMLRPCserver (PSF-2005-001). This + disables recursive traversal through instance attributes, which can + be exploited in various ways. + - Fixed a bug in the cache of length-one Unicode strings that could lead to a seg fault. The specific problem occurred when an earlier, non-fatal error left an uninitialized Unicode object in the

1 0

python/nondist/peps pep-0314.txt,1.17,1.18
by akuchling＠users.sourceforge.net Feb. 3, 2005

Feb. 3, 2005

Update of /cvsroot/python/python/nondist/peps In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv16960 Modified Files: pep-0314.txt Log Message: Restrict package names to importable ones Index: pep-0314.txt =================================================================== RCS file: /cvsroot/python/python/nondist/peps/pep-0314.txt,v retrieving revision 1.17 retrieving revision 1.18 diff -u -d -r1.17 -r1.18 --- pep-0314.txt 3 Feb 2005 02:30:53 -0000 1.17 +++ pep-0314.txt 3 Feb 2005 12:30:44 -0000 1.18 @@ -207,10 +207,9 @@ Each entry contains a string describing some other module or package required by this package. - The format of a requirement string is simple: a module or - package name, optionally followed by a version declaration within - parentheses. Leading and trailing whitespace are ignored, and - whitespace within the string is normalized to a single space. + The format of a requirement string is identical to that of a + module or package name usable with the 'import' statement, + optionally followed by a version declaration within parentheses. A version declaration is a series of conditional operators and version numbers, separated by commas. Conditional operators

1 0

instonilne.com
by vincent Feb. 3, 2005

Feb. 3, 2005

1 0

python/nondist/peps pep-0314.txt,1.16,1.17
by akuchling＠users.sourceforge.net Feb. 3, 2005

Feb. 3, 2005

Update of /cvsroot/python/python/nondist/peps In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv11619 Modified Files: pep-0314.txt Log Message: Add Richard as author; minor corrections Index: pep-0314.txt =================================================================== RCS file: /cvsroot/python/python/nondist/peps/pep-0314.txt,v retrieving revision 1.16 retrieving revision 1.17 diff -u -d -r1.16 -r1.17 --- pep-0314.txt 3 Feb 2005 02:27:01 -0000 1.16 +++ pep-0314.txt 3 Feb 2005 02:30:53 -0000 1.17 @@ -2,7 +2,7 @@ Title: Metadata for Python Software Packages v1.1 Version: $Revision$ Last-Modified: $Date$ -Author: A.M. Kuchling <amk(a)amk.ca> +Author: A.M. Kuchling <amk(a)amk.ca>, Richard Jones Status: Draft Type: Standards Track Content-type: text/plain @@ -207,7 +207,7 @@ Each entry contains a string describing some other module or package required by this package. - The format of a requirement string is simple: an module or + The format of a requirement string is simple: a module or package name, optionally followed by a version declaration within parentheses. Leading and trailing whitespace are ignored, and whitespace within the string is normalized to a single space. @@ -276,7 +276,11 @@ * Added the Classifiers field from PEP 301. - * Added fields: Download-URL, Requires, Provides, Obsoletes, Conflicts. + * The License and Platform files should now only be used if the + platform or license can't be handled by an appropriate Classifier + value. + + * Added fields: Download-URL, Requires, Provides, Obsoletes. Open issues @@ -286,7 +290,7 @@ Acknowledgements - Richard Jones suggested using reST for the Description field. + None. References

1 0

python/nondist/peps pep-0314.txt,1.15,1.16
by akuchling＠users.sourceforge.net Feb. 3, 2005

Feb. 3, 2005

Update of /cvsroot/python/python/nondist/peps In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv10708 Modified Files: pep-0314.txt Log Message: Add Richard Jones's edits Index: pep-0314.txt =================================================================== RCS file: /cvsroot/python/python/nondist/peps/pep-0314.txt,v retrieving revision 1.15 retrieving revision 1.16 diff -u -d -r1.15 -r1.16 --- pep-0314.txt 14 May 2003 17:12:55 -0000 1.15 +++ pep-0314.txt 3 Feb 2005 02:27:01 -0000 1.16 @@ -81,15 +81,13 @@ Platform (multiple use) A comma-separated list of platform specifications, summarizing - the operating systems supported by the package. The major - supported platforms are listed below, but this list is - necessarily incomplete. - - POSIX, MacOS, Windows, BeOS, PalmOS. + the operating systems supported by the package which are not + listed in the "Operating System" Trove classifiers. See + "Classifier" below. Example: - Platform: POSIX, Windows + Platform: ObscureUnix, RareDOS Supported-Platform (multiple use) @@ -183,53 +181,15 @@ License - A string selected from a short list of choices, specifying the - license covering the package. Some licenses result in the - software being freely redistributable, so packagers and - resellers can automatically know that they're free to - redistribute the software. Other licenses will require - a careful reading by a human to determine how the software can be - repackaged and resold. - - The choices are: - - Artistic, BSD, DFSG, GNU GPL, GNU LGPL, "MIT", - Mozilla PL, "public domain", Python, Qt PL, Zope PL, unknown, - nocommercial, nosell, nosource, shareware, other - - Definitions of some of the licenses are: - - DFSG The license conforms to the Debian Free Software - Guidelines, but does not use one of the other - DFSG conforming licenses listed here. - More information is available at: - http://www.debian.org/social_contract#guidelines - - Python Python 1.6 or higher license. Version 1.5.2 and - earlier are under the MIT license. - - public domain Software is public domain, not copyrighted. - unknown Status is not known - nocommercial Free private use but commercial use not permitted - nosell Free use but distribution for profit by arrangement - nosource Freely distributable but no source code - shareware Payment is requested if software is used - other General category for other non-DFSG licenses - - Some of these licenses can be interpreted to mean the software is - freely redistributable. The list of redistributable licenses is: - - Artistic, BSD, DFSG, GNU GPL, GNU LGPL, "MIT", - Mozilla PL, "public domain", Python, Qt PL, Zope PL, - nosource, shareware - - Note that being redistributable does not mean a package - qualifies as free software, 'nosource' and 'shareware' being - examples. + Text indicating the license covering the package where the license + is not a selection from the "License" Trove classifiers. See + "Classifier" below. Example: - License: MIT + License: This software may only be obtained by sending the + author a postcard, and then the user promises not + to redistribute it. Classifier (multiple use) @@ -244,14 +204,13 @@ Requires (multiple use) - Each entry contains a string describing some other component or - module required by this package. + Each entry contains a string describing some other module or + package required by this package. - The format of a requirement string is simple: an arbitrary - sequence of characters, optionally followed by a version - declaration within parentheses. Leading and trailing whitespace - are ignored, and whitespace within the string is normalized to a - single space. + The format of a requirement string is simple: an module or + package name, optionally followed by a version declaration within + parentheses. Leading and trailing whitespace are ignored, and + whitespace within the string is normalized to a single space. A version declaration is a series of conditional operators and version numbers, separated by commas. Conditional operators @@ -266,7 +225,7 @@ the string ">1.0, !=1.3.4, <2.0" is a legal version declaration. All of the following are possible requirement strings: "rfc822", - "zlib (>=1.1.4)", "XML parser". + "zlib (>=1.1.4)", "zope". There's no canonical list of what strings should be used; the Python community is left to choose its own standards. @@ -277,11 +236,11 @@ Requires: sys Requires: zlib Requires: pyexpat (>1.0) - Requires: DB-API 2.0 module + Requires: psycopg Provides (multiple use) - Each entry contains a string describing a component or + Each entry contains a string describing a package or module that will be provided by this package once it is installed. These strings should match the ones used in Requirements fields. Version declarations cannot be supplied; @@ -296,7 +255,7 @@ Obsoletes (multiple use) - Each entry contains a string describing a component or module + Each entry contains a string describing a package or module that this package renders obsolete, meaning that the two packages should not be installed at the same time. Version declarations can be supplied. @@ -310,20 +269,6 @@ Obsoletes: Gorgon - Conflicts (multiple use) - - Each entry contains a string describing a component or module - that conflicts with this package, meaning that the two packages - should not be installed at the same time. Version declarations - can be supplied. - - Conflict resolution probably isn't very important for Python - programs, because few extensions will cause problems for other - extensions, unless they happen to be using the same package - name. This field name is being defined here for future use. - - Conflicts: Gorgon - Summary of Differences From PEP 241 @@ -336,8 +281,7 @@ Open issues - With the addition of the 'Classifiers' field, should the Platform - and License fields be removed? + None. Acknowledgements

1 0

python/dist/src/Lib/idlelib IdleHistory.py, 1.4, 1.5 NEWS.txt, 1.55, 1.56 config-main.def, 1.21, 1.22
by kbk＠users.sourceforge.net Feb. 3, 2005

Feb. 3, 2005

Update of /cvsroot/python/python/dist/src/Lib/idlelib In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv32060 Modified Files: IdleHistory.py NEWS.txt config-main.def Log Message: Add config-main.def option to make the 'history' feature non-cyclic. Default remains cyclic. Python Patch 914546 Noam Raphael. M IdleHistory.py M NEWS.txt M config-main.def Index: IdleHistory.py =================================================================== RCS file: /cvsroot/python/python/dist/src/Lib/idlelib/IdleHistory.py,v retrieving revision 1.4 retrieving revision 1.5 diff -u -d -r1.4 -r1.5 --- IdleHistory.py 16 Sep 2002 22:09:19 -0000 1.4 +++ IdleHistory.py 3 Feb 2005 01:37:13 -0000 1.5 @@ -1,3 +1,5 @@ +from configHandler import idleConf + class History: def __init__(self, text, output_sep = "\n"): @@ -6,6 +8,7 @@ self.history_prefix = None self.history_pointer = None self.output_sep = output_sep + self.cyclic = idleConf.GetOption("main", "History", "cyclic", 1, "bool") text.bind("<<history-previous>>", self.history_prev) text.bind("<<history-next>>", self.history_next) @@ -40,7 +43,11 @@ if reverse: pointer = nhist else: - pointer = -1 + if self.cyclic: + pointer = -1 + else: + self.text.bell() + return nprefix = len(prefix) while 1: if reverse: @@ -49,10 +56,13 @@ pointer = pointer + 1 if pointer < 0 or pointer >= nhist: self.text.bell() - if self._get_source("iomark", "end-1c") != prefix: - self.text.delete("iomark", "end-1c") - self._put_source("iomark", prefix) - pointer = prefix = None + if not self.cyclic and pointer < 0: + return + else: + if self._get_source("iomark", "end-1c") != prefix: + self.text.delete("iomark", "end-1c") + self._put_source("iomark", prefix) + pointer = prefix = None break item = self.history[pointer] if item[:nprefix] == prefix and len(item) > nprefix: Index: NEWS.txt =================================================================== RCS file: /cvsroot/python/python/dist/src/Lib/idlelib/NEWS.txt,v retrieving revision 1.55 retrieving revision 1.56 diff -u -d -r1.55 -r1.56 --- NEWS.txt 31 Jan 2005 03:34:26 -0000 1.55 +++ NEWS.txt 3 Feb 2005 01:37:13 -0000 1.56 @@ -3,6 +3,9 @@ *Release date: XX-XXX-2005* +- Add config-main option to make the 'history' feature non-cyclic. + Default remains cyclic. Python Patch 914546 Noam Raphael. + - Removed ability to configure tabs indent from Options dialog. This 'feature' has never worked and no one has complained. It is still possible to set a default tabs (v. spaces) indent 'manually' via config-main.def (or to turn on Index: config-main.def =================================================================== RCS file: /cvsroot/python/python/dist/src/Lib/idlelib/config-main.def,v retrieving revision 1.21 retrieving revision 1.22 diff -u -d -r1.21 -r1.22 --- config-main.def 4 Jun 2004 06:31:08 -0000 1.21 +++ config-main.def 3 Feb 2005 01:37:14 -0000 1.22 @@ -18,8 +18,8 @@ # ~/.idlerc/config-highlight.cfg the user highlighting config file # ~/.idlerc/config-keys.cfg the user keybinding config file # -# On Windows2000 and Windows XP the .idlerc directory is at -# Documents and Settings\<username>\.idlerc +# On Windows2000 and Windows XP the .idlerc directory is at +# Documents and Settings\<username>\.idlerc # # On Windows98 it is at c:\.idlerc # @@ -73,4 +73,7 @@ default= 1 name= IDLE Classic Windows +[History] +cyclic=1 + [HelpFiles]

1 0

python/dist/src/Lib/bsddb db.py,1.3,1.4
by holdenweb＠users.sourceforge.net Feb. 2, 2005

Feb. 2, 2005

Update of /cvsroot/python/python/dist/src/Lib/bsddb In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv3242 Modified Files: db.py Log Message: Simplify string comparison using startswith() Index: db.py =================================================================== RCS file: /cvsroot/python/python/dist/src/Lib/bsddb/db.py,v retrieving revision 1.3 retrieving revision 1.4 diff -u -d -r1.3 -r1.4 --- db.py 21 Sep 2003 00:08:14 -0000 1.3 +++ db.py 2 Feb 2005 18:47:18 -0000 1.4 @@ -37,7 +37,7 @@ # case we ever want to augment the stuff in _db in any way. For now # it just simply imports everything from _db. -if __name__[:len('bsddb3.')] == 'bsddb3.': +if __name__.startswith('bsddb3.'): # import _pybsddb binary as it should be the more recent version from # a standalone pybsddb addon package than the version included with # python as bsddb._bsddb.

1 0