Mailman 3 March 2021 - Python-Dev

Tottime column for cprofile output does not add up
by Jonathan Frawley March 10, 2021

March 10, 2021

Hi, I am using cprofile and PStats to try and figure out where bottlenecks are in a program. When I sum up all of the times in the "tottime" column, it only comes to 57% of the total runtime. Is this due to rounding of times or some other issue? Thanks, Jonathan

2 1

New name for the development branch [was Steering Council update for February]
by Mark Shannon March 10, 2021

March 10, 2021

Hi, Why choose "main" as a replacement for "master"? It's the development branch, shouldn't we call it "development" or "dev"? We give release branches meaningful names, so why give the development branch the not-so-meaningful name "main". From a user's perspective the "main" branch is whatever their version of Python is built from. Cheers, Mark.

4 3

Requesting Review for GH-24118 (Fix for bpo-27820)
by Pandu Poluan March 9, 2021

March 9, 2021

Hi all, I have submitted a PR, GH-24118 ( https://github.com/python/cpython/pull/24118), on January 5. It's a relatively simple patch that fixes smtplib.SMTP logic for AUTH LOGIN, alongside a fix for the test for that class. The PR has passed all checks, and I have also signed the CLA. I've pinged the relevant bpo more than a week ago, but the PR's status is still "awaiting review". I'd appreciate it if someone can spare some time to do a review on this simple patch. Rgds. -- FdS Pandu E … [View More]

2 1

Need help to fix known Python security vulnerabilities
by Victor Stinner March 9, 2021

March 9, 2021

Hi, The Python bug tracker currently has 78 open issues of the type Security. If you are looking for something to do to help the Python project, please go through the list (search for open issues with Type=security at bugs.python.org), discuss the different solutions how to address these vulnerabilities, and maybe even propose a fix. Here are some examples. == tarfile == For example, the tarfile module has a known directory traversal vulnerability (unsafe by default), whereas the GNU tar … [View More]command is fixed: the -P/--absolute-names option must be used explicitly to get the unsafe behavior. I suggest to make the Python tarfile module safe by default, and add an option to allow absolute paths. Issue reported 7 years ago: https://bugs.python.org/issue21109 == webbrowser == Another example, on Windows, the webbrowser seems be has a shell command injection vulnerability, reported 2 years ago: https://bugs.python.org/issue36021 == XML == Python XML parsers have at least two known vulnerabilities: "billion laughs" and "quadratic blowup" which are documented: https://docs.python.org/dev/library/xml.html#xml-vulnerabilities The third party defusedxml module address these vulnerabilities: https://pypi.org/project/defusedxml/ But Python remains unsafe by default, issue reported 8 years ago: https://bugs.python.org/issue17239 == tempfile == The tempfile library does not check the prefix argument, which can be exploited to create files outside tmpdir by using directory traversal. Issue reported 3 years ago: https://bugs.python.org/issue35278 The same issue was found and treated as a vulnerability in PHP (CVE-2006-1494) and Ruby (CVE-2018-6914). == Issues involving URLs == There are multiple issues involving URLs: "ReDoS in urllib.request" https://bugs.python.org/issue43075 "http.server: Open Redirection if the URL path starts with //" https://bugs.python.org/issue43223 "urlparse of urllib returns wrong hostname" https://bugs.python.org/issue36338 "[CVE-2015-2104] Urlparse insufficient validation leads to open redirect" https://bugs.python.org/issue23505 "urlparse library detecting wrong hostname leads to open redirect vulnerability" https://bugs.python.org/issue35748 "http.server can be abused to redirect to (almost) arbitrary URL" https://bugs.python.org/issue32084 "urllib may leak sensitive HTTP headers to a third-party web site" https://bugs.python.org/issue33661 "Unnecessary URL scheme exists to allow 'URL: reading file in urllib" https://bugs.python.org/issue37820 "A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! " https://bugs.python.org/issue32085 Happy hacking! Victor -- Night gathers, and now my watch begins. It shall not end until my death. [View Less]

2 1

CFLAGS_NODIST and -qalias=noansi
by Michael Felt March 8, 2021

March 8, 2021

Dear all, After several months of absence - my first manual build surprised me by the addition of the -qalias=noansi. Before I open an issue - maybe it is not that important - I am trying to find what brought it in. It looks to be a change in behavior in configure(.ac) - starting with Python3.9. Historical builds - and make.out: py38-3.8.7/.buildaix/make.out:0 py39-3.9.0/.buildaix/make.out:239 py39-3.9.1.0/.buildaix/make.out:254 py39-3.9.1/.buildaix/make.out:148 py3a-3.10/.buildaix/make.… [View More]

2 1

Summary of Python tracker Issues
by Python tracker March 5, 2021

March 5, 2021

ACTIVITY SUMMARY (2021-02-26 - 2021-03-05) Python tracker at https://bugs.python.org/ To view or respond to any of the issues listed below, click on the issue. Do NOT respond to this message. Issues counts and deltas: open 7444 (+14) closed 47702 (+66) total 55146 (+80) Open issues with patches: 2959 Issues opened (53) ================== #43331: [Doc][urllib.request] Explicit the fact that header keys are s https://bugs.python.org/issue43331 opened by axel3rd #43332: http/… [View More]

1 0

Integer concatenation to byte string
by Memz March 5, 2021

March 5, 2021

Currently, the only way to concatenate an integer to a bytes object is by converting the integer to bytes with a function call before concatenating. And there is no way to make a mutable bytes object without a function call. And bytearray function calls are 9-10x slower than b-strings. I propose an array-type string like the, or for the bytearray. It would work as a mutable b-string, as foo = a"\x00\x01\x02abcÿ" # a-string, a mutable bytes object. foo[0] = 123 … [View More]

2 1

Seeking review: Reinstate ability to run python.org locally with local PEPs repo
by David Foster March 4, 2021

March 4, 2021

The PEPs repo [1] has a README [2] with instructions for configuring a local installation of the python.org website such that you can develop PEPs locally and see how they will appear on python.org locally. However the README's instructions reference a python.org configuration setting (PEP_REPO_PATH) that appears to no longer exist. So I reimplemented support for the PEP_REPO_PATH setting for local python.org installations and have a pull request out for review at [3] which has been seeking a … [View More]

1 0

Suggestion About Python Syntax
by Anthony Farino March 3, 2021

March 3, 2021

I love the Python scripting language, but there’s something that would make it much better. Almost every other programming language uses curly braces to enclose blocks of code and semicolons after the lines of code. That means that: 1. You can have as much white space as you want. 2. You don’t need to worry about indentation, and you can indent whenever you want. I hope that you consider these issues and fix them in Python 4 (if you ever make it). Sincerely, Anthony, age 10. … [View More]

4 3

Requesting Review of Pull Request
by Nathan Beals March 3, 2021

March 3, 2021

Good Afternoon Python Devs, I'm requesting that someone review the pull request linked to this issue: https://bugs.python.org/issue42994 (github PR: https://github.com/python/cpython/pull/24287). I'm following the contributing guidelines instructions to email this address if the PR hasn't been addressed in a month (+1 week after pinging it again). Thankfully this PR is tiny, at 9 lines total (and even then, it's just 9 new entries to a dictionary). Thank you for your time, Nathan Beals

2 1