Commit graph

30984 commits

Author SHA1 Message Date
T. Wouters
19de092deb
[3.12] gh-135034: Normalize link targets in tarfile, add os.path.realpath(strict='allow_missing') (GH-135037) (GH-135066)
Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517.

(cherry picked from commit 3612d8f517)

Co-authored-by: Łukasz Langa <lukasz@langa.pl>
Signed-off-by: Łukasz Langa <lukasz@langa.pl>
Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
2025-06-03 16:00:21 +02:00
Miss Islington (bot)
f3272d8630
[3.12] gh-87799: Improve the textual representation of IPv4-mapped IPv6 addresses (GH-29345) (GH-135081)
Represent IPv4-mapped IPv6 address as xxxd.d.d.d,
where the 'x's are the hexadecimal values
of the six high-order 16-bit pieces of the address,
and the 'd's are the decimal values
of the four low-order 8-bit pieces of the address
(standard IPv4 representation).

(cherry picked from commit f22bf8e3cf)

Co-authored-by: opavliuk <40970635+opavlyuk@users.noreply.github.com>
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
Co-authored-by: Andrew Svetlov <andrew.svetlov@gmail.com>
2025-06-03 15:45:32 +02:00
Miss Islington (bot)
d4cf1fafaf
[3.12] gh-128840: Limit the number of parts in IPv6 address parsing (GH-128841) (#134612)
gh-128840: Limit the number of parts in IPv6 address parsing (GH-128841)

GH-128840: Limit the number of parts in IPv6 address parsing
Limit length of IP address string to 39

---------
(cherry picked from commit 47f1161d3a)

Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
2025-05-25 20:34:44 -07:00
Miss Islington (bot)
d02823e8c4
[3.12] gh-134062: Fix hash collisions in IPv4Network and IPv6Network (GH-134063) (#134478)
gh-134062: Fix hash collisions in IPv4Network and IPv6Network (GH-134063)
(cherry picked from commit f3fc0c16e0)


gh-134062: Fix hash collisions in IPv4Network and IPv6Network
gh-134062: Add hash collision regression test

Co-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com>
2025-05-25 20:34:22 -07:00
Serhiy Storchaka
4398b788ff
[3.12] gh-133767: Fix use-after-free in the unicode-escape decoder with an error handler (GH-129648) (GH-133944) (#134337)
If the error handler is used, a new bytes object is created to set as
the object attribute of UnicodeDecodeError, and that bytes object then
replaces the original data. A pointer to the decoded data will became invalid
after destroying that temporary bytes object. So we need other way to return
the first invalid escape from _PyUnicode_DecodeUnicodeEscapeInternal().

_PyBytes_DecodeEscape() does not have such issue, because it does not
use the error handlers registry, but it should be changed for compatibility
with _PyUnicode_DecodeUnicodeEscapeInternal().
(cherry picked from commit 9f69a58623)
(cherry picked from commit 6279eb8c07)
2025-05-25 20:33:22 -07:00
Victor Stinner
aeb3a6f61a
[3.12] gh-132553: Build the perf tool without buildid cache (GH-132663) (#132718)
gh-132553: Build the perf tool without buildid cache (GH-132663)

(cherry picked from commit e01e582902)

Co-authored-by: Pablo Galindo Salgado <Pablogsal@gmail.com>
2025-04-25 02:26:30 +01:00
Miss Islington (bot)
a05e9301ab
[3.12] gh-117779: Fix reading duplicated entries in zipfile by name (GH-129254) (GH-132264)
(cherry picked from commit 0f04f2456a)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
2025-04-08 11:13:09 +00:00
sobolevn
b41e008edb
[3.12] gh-101137: Add text/x-rst to mimetypes (GH-118593) (GH-118599) 2025-04-08 12:40:41 +02:00
sobolevn
492a554cfc
[3.12] gh-130775: Allow negative locations in ast (GH-130795) (#132260)
(cherry picked from commit bc5233b6a5)

Co-authored-by: sobolevn <mail@sobolevn.me>
Co-authored-by: Victor Stinner <vstinner@python.org>
2025-04-08 10:19:23 +00:00
Miss Islington (bot)
40f81e1060
[3.12] gh-130164: Fix inspect.Signature.bind() handling of positional-only args without defaults (GH-130192) (GH-132259)
Follow-up to 9c15202.
(cherry picked from commit dab456dcef)

Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2025-04-08 09:39:45 +00:00
Miss Islington (bot)
33834cb2b3
[3.12] gh-131852: Filter out POT-Creation-Date in msgfmt (GH-131880) (GH-132216)
(cherry picked from commit ad6a032ceb)

Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Co-authored-by: Tomas R. <tomas.roun8@gmail.com>
2025-04-07 11:52:22 +00:00
Bénédikt Tran
6dab90a403
[3.12] gh-131015: Add test for bytes formatting errors (#131881) (#132114)
* gh-131015: Add test for bytes formatting errors (#131881)

Co-authored-by: Ageev Maxim <maksim170901@gmail.com>
(cherry picked from commit 05557788f3)
2025-04-05 11:40:48 +02:00
Miss Islington (bot)
1d8cd48f26
[3.12] Fix typo in template_replace() test helper docstring (GH-132094) (#132096)
Fix typo in `template_replace()` test helper docstring (GH-132094)
(cherry picked from commit ac3a7bfecc)

Co-authored-by: Victorien <65306057+Viicos@users.noreply.github.com>
2025-04-04 20:04:01 +02:00
Tomasz Pytel
3d3e7b0ada
[3.12] gh-128632: fix segfault on nested __classdict__ type param (GH… (#132090)
(cherry picked from commit 891c61c1fa)

Co-authored-by: Tomasz Pytel <tompytel@gmail.com>
2025-04-04 15:48:57 +00:00
Miss Islington (bot)
05213afaa7
[3.12] gh-130655: Add a test for corrupt .mo files in gettext (GH-131911) (#132080)
gh-130655: Add a test for corrupt `.mo` files in `gettext` (GH-131911)
(cherry picked from commit a126cefc17)

Co-authored-by: Tomas R <tomas.roun8@gmail.com>
2025-04-04 16:49:48 +02:00
Miss Islington (bot)
232e1059ed
[3.12] gh-130655: Add a test for bad magic numbers in .mo files parsed by gettext (GH-131909) (#132078)
gh-130655: Add a test for bad magic numbers in `.mo` files parsed by `gettext` (GH-131909)
(cherry picked from commit 16a6270aa6)

Co-authored-by: Tomas R <tomas.roun8@gmail.com>
2025-04-04 16:49:36 +02:00
Miss Islington (bot)
65a01034e6
[3.12] gh-130655: Add tests for gettext.find() (GH-130691) (#132083)
gh-130655: Add tests for `gettext.find()` (GH-130691)

(cherry picked from commit 3118693a1a)

Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Co-authored-by: Tomas R. <tomas.roun8@gmail.com>
2025-04-04 16:39:22 +02:00
Tomas R.
da7ac18c9d
[3.12] gh-130197: pygettext: Test the --escape option (GH-131902) (GH-132033)
(cherry picked from commit 87d9983994)
2025-04-02 23:29:02 +03:00
Serhiy Storchaka
6f6b8b4ac9
[3.12] gh-89039: Call subclass constructors in datetime.*.replace (GH-114780) (GH-131239)
When replace() method is called on a subclass of datetime, date or time,
properly call derived constructor. Previously, only the base class's
constructor was called.

Also, make sure to pass non-zero fold values when creating subclasses in
various methods. Previously, fold was silently ignored.
(cherry picked from commit 46190d9ea8)

Co-authored-by: Eugene Toder <eltoder@users.noreply.github.com>
2025-04-02 20:35:16 +03:00
Miss Islington (bot)
e4fe4d9d53
[3.12] gh-131888: fix ResourceWarning in test_ftplib (GH-131889) (#132010)
gh-131888: fix ResourceWarning in test_ftplib (GH-131889)
(cherry picked from commit b0f77c4d25)

Co-authored-by: Thomas Grainger <tagrain@gmail.com>
2025-04-02 12:46:40 +00:00
Miss Islington (bot)
b3cf1f27e9
[3.12] gh-132002: Fix crash of ContextVar on unhashable str subtype (GH-132003) (#132008)
gh-132002: Fix crash of `ContextVar` on unhashable `str` subtype (GH-132003)
(cherry picked from commit ab2a3dda1d)

Co-authored-by: sobolevn <mail@sobolevn.me>
2025-04-02 12:05:30 +00:00
Miss Islington (bot)
756676fc18
[3.12] gh-131736: only apply security_level workaround in test_ssl for security levels greater than 1 (GH-131739) (#131966)
gh-131736: only apply `security_level` workaround in `test_ssl` for security levels greater than 1 (GH-131739)
(cherry picked from commit 3b3720f1a2)

Co-authored-by: Will Childs-Klein <willck93@gmail.com>
2025-04-01 08:16:34 +00:00
Miss Islington (bot)
5d4e891411
[3.12] gh-126033: fix UAF in xml.etree.ElementTree.Element.remove when concurrent mutations happen (GH-126124) (#131930)
gh-126033: fix UAF in `xml.etree.ElementTree.Element.remove` when concurrent mutations happen (GH-126124)
(cherry picked from commit bab1398a47)

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
2025-03-31 14:50:13 +02:00
Bénédikt Tran
f1689b61fe
[3.12] gh-126037: fix UAF in xml.etree.ElementTree.Element.find* when concurrent mutations happen (#127964) (#131932)
gh-126037: fix UAF in `xml.etree.ElementTree.Element.find*` when concurrent mutations happen (#127964)

We fix a use-after-free in the `find`, `findtext` and `findall` methods of `xml.etree.ElementTree.Element`
objects that can be triggered when the tag to find implements an `__eq__` method that mutates the
element being queried.

(cherry picked from commit c57623c221)
2025-03-31 14:47:22 +02:00
Miss Islington (bot)
85b6b0e2d2
[3.12] gh-131050: skip test_dh_params when TLS library lacks FFDHE ciphersuites (GH-131051) (#131875)
gh-131050: skip `test_dh_params` when TLS library lacks FFDHE ciphersuites (GH-131051)
(cherry picked from commit be2d2181e6)

Co-authored-by: Will Childs-Klein <willck93@gmail.com>
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
2025-03-29 10:51:11 +00:00
Steve Dower
dfb63723d2
gh-131423: Update to OpenSSL 3.0.16. (GH-131839)
The bin tag is 3.0.16.1 because we rebuilt without uplink support to fix gh-131804.
This PR also prevents making calls that are now unsafe without uplink, and updates
the tests to property interpret these failures as unsupported.
2025-03-28 15:29:20 +00:00
Miss Islington (bot)
7d447ac4e0
[3.12] gh-131807: fix ResourceWarning in test_ucn.py (GH-131808) (#131846)
gh-131807: fix ResourceWarning in test_ucn.py (GH-131808)
(cherry picked from commit adb67ed7e4)

Co-authored-by: Thomas Grainger <tagrain@gmail.com>
Co-authored-by: Victor Stinner <vstinner@python.org>
2025-03-28 15:12:59 +00:00
Miss Islington (bot)
d4ddc03e56
[3.12] gh-127949: fix resource warnings in test_tasks.py (GH-128172) (#131806)
* gh-127949: fix resource warnings in `test_tasks.py` (GH-128172)
(cherry picked from commit b66a4ad9fc)

Co-authored-by: Thomas Grainger <tagrain@gmail.com>
Co-authored-by: Kumar Aditya <kumaraditya@python.org>
2025-03-28 14:25:39 +00:00
Miss Islington (bot)
1826347d9d
[3.12] gh-131649: fix test_string_literals SyntaxWarning (GH-131650) (GH-131766) (#131772)
[3.13] gh-131649: fix test_string_literals SyntaxWarning (GH-131650) (GH-131766)

(cherry picked from commit 2d83891dfd)
(cherry picked from commit 5bcb476df1)

Co-authored-by: Brian Schubert <brianm.schubert@gmail.com>
Co-authored-by: Thomas Grainger <tagrain@gmail.com>
2025-03-26 16:47:55 +00:00
Miss Islington (bot)
e78280d0de
[3.12] gh-131677: Fix flaky test_lru_cache_threaded3 (gh-131679) (gh-131693)
The call to `with self.subTest(...)` was not thread-safe.
(cherry picked from commit a123245986)

Co-authored-by: Sam Gross <colesbury@gmail.com>
2025-03-24 20:59:03 +00:00
Miss Islington (bot)
76e911a040
[3.12] gh-131670: Fix crash in anext() when __anext__ is sync and raises (GH-131682) (#131687)
gh-131670: Fix crash in `anext()` when `__anext__` is sync and raises (GH-131682)
(cherry picked from commit 929afd1d6e)

Co-authored-by: sobolevn <mail@sobolevn.me>
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
2025-03-24 19:18:29 +00:00
Bénédikt Tran
8a9aee7126
[3.12] gh-131045: [Enum] fix flag containment checks when using values (GH-131053) (#131232)
* gh-131045: [Enum] fix flag containment checks when using values (GH-131053)

Check would fail if value would create a pseudo-member, but that member
had not yet been created.  We now attempt to create a pseudo-member for
a passed-in value first.

---------

Co-authored-by: Ethan Furman <ethan@stoneleaf.us>
Co-authored-by: Tomas R. <tomas.roun8@gmail.com>
2025-03-24 10:31:24 +01:00
Nybblista
7f2de07808
[3.12] gh-131357: Add a set of asserts to test.test_capi.test_bytearray (GH-131554) (#131629)
[3.12] gh-131357: Add a set of asserts to test.test_capi.test_bytearray (#131554)

add a set of asserts to test.test_capi.test_bytearray

1. Assert empty bytearray object for PyByteArray_Check.
2. Assert empty bytearray object for PyByteArray_CheckExact.
3. Assert 0-size bytearray object for PyByteArray_Size.
4. Assert empty bytearray object for PyByteArray_AsString.
5. Assert concatenation of the bytearray object with itself for PyByteArray_Concat.

(cherry picked from commit f3bf304c27)
2025-03-23 17:43:12 +00:00
Miss Islington (bot)
2d6a778f73
[3.12] gh-131492, gh-131461: handle exceptions in GzipFile constructor while owning resources (GH-131462) (#131519)
(cherry picked from commit ce79274e9f)

Co-authored-by: Thomas Grainger <tagrain@gmail.com>
Co-authored-by: Victor Stinner <vstinner@python.org>
2025-03-21 11:21:40 +01:00
Nybblista
30e38b9dc6
[3.12] gh-131441: Add a set of asserts to test.test_capi.test_list (#131442) (#131533)
gh-131441: Add a set of asserts to test.test_capi.test_list (#131442)

(cherry picked from commit 2433cc79d7)
2025-03-21 10:56:21 +03:00
Miss Islington (bot)
5dfb5e640e
[3.12] gh-121284: Fix email address header folding with parsed encoded-word (GH-122754) (#131404)
gh-121284: Fix email address header folding with parsed encoded-word (GH-122754)

Email generators using email.policy.default may convert an RFC 2047
encoded-word to unencoded form during header refolding. In a structured
header, this could allow 'specials' chars outside a quoted-string,
leading to invalid address headers and enabling spoofing. This change
ensures a parsed encoded-word that contains specials is kept as an
encoded-word while the header is refolded.

[Better fix from @bitdancer.]

---------
(cherry picked from commit 295b53df2a)

Co-authored-by: Mike Edmunds <medmunds@gmail.com>
Co-authored-by: R David Murray <rdmurray@bitdance.com>
Co-authored-by: Petr Viktorin <encukou@gmail.com>
2025-03-18 15:35:32 -04:00
Bénédikt Tran
865bd6de99
[3.12] gh-131277: allow EnvironmentVarGuard to unset more than one environment variable at once (GH-131280) (#131410)
(cherry picked from commit 3185e3115c)

---------

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
2025-03-18 13:46:24 +01:00
Miss Islington (bot)
18e4eb410a
[3.12] gh-130727: Retry test_wmi on TimeoutError (GH-130832) (#130840)
gh-130727: Retry test_wmi on TimeoutError (GH-130832)

Use sleeping_retry() in test_wmi to retry multiple times on
TimeoutError. Wait up to LONG_TIMEOUT seconds (5 minutes by default).
(cherry picked from commit f67ff9e820)

Co-authored-by: Victor Stinner <vstinner@python.org>
2025-03-17 15:57:28 +00:00
Miss Islington (bot)
6e7432f130
[3.12] gh-131339: test PyBytes_Size for a zero-size bytes object (GH-131340) (#131344)
gh-131339: test PyBytes_Size for a zero-size bytes object (GH-131340)
(cherry picked from commit 3ae67ba97e)

Co-authored-by: Nybblista <170842536+nybblista@users.noreply.github.com>
2025-03-17 12:20:32 +00:00
Wulian233
e364a4212e
[3.12] gh-131204: Fix difflib.HtmlDiff may not use monospaced font (GH-131221) (#131243)
(cherry picked from commit 7fd6160)
2025-03-14 12:23:39 +00:00
Miss Islington (bot)
9a612a850c
[3.12] gh-131234: Improve test_popen with more asserts (GH-131235) (#131241)
gh-131234: Improve `test_popen` with more asserts (GH-131235)
(cherry picked from commit fc07f863ee)

Co-authored-by: sobolevn <mail@sobolevn.me>
2025-03-14 11:54:56 +00:00
sobolevn
6658ada1ea
[3.12] gh-131219: Improve tests in test_lzma.py by adding more asserts (GH-131220) (#131237)
Co-authored-by: sobolevn <mail@sobolevn.me>
2025-03-14 11:54:37 +00:00
Serhiy Storchaka
a3f4889413
[3.12] gh-85012: Properly reset msgctxt when compiling messages with msgfmt (GH-130525) (GH-131206)
Add also human-readable snapshots for tests.
(cherry picked from commit 7ea6e88eb4)

Co-authored-by: Tomas R <tomas.roun8@gmail.com>
2025-03-13 19:09:42 +00:00
Miss Islington (bot)
969631aec9
[3.12] gh-93096: Load doctests in test_itertools (GH-131133) (#131137)
gh-93096: Load doctests in `test_itertools` (GH-131133)
(cherry picked from commit 15a8412b5e)

Co-authored-by: donBarbos <donbarbos@proton.me>
2025-03-12 08:00:17 +00:00
Miss Islington (bot)
afffd97cd9
[3.12] gh-130957: Use sleeping_retry in test_free_reference (GH-130958) (#131092)
The weak reference may not be immediately dead.
(cherry picked from commit 1908115871)

Co-authored-by: Sam Gross <colesbury@gmail.com>
2025-03-11 10:13:41 -04:00
Miss Islington (bot)
8f26a79b33
gh-130959: Reject whitespace in fractions, in pure Python fromisoformat() (GH-130962) (GH-131076) (#131086)
Fix the pure Python implementation of `fromisoformat()` to reject any
non-digit characters, including whitespace, in the fractional part
of time specification.  This makes the behavior consistent with the C
implementation, and prevents incorrect parsing of these fractions
(e.g. `.400 ` would be misinterpreted as `.04`).

(cherry picked from commit 33494b4d0d)
(cherry picked from commit 27fd328cf6)

Co-authored-by: Victor Stinner <vstinner@python.org>
Co-authored-by: Michał Górny <mgorny@gentoo.org>
2025-03-11 12:00:06 +00:00
Miss Islington (bot)
bfad0b56d9
[3.12] gh-93096: Fix loading doctests in test_pickle (GH-131069) (GH-131081)
(cherry picked from commit 3bb20d13a8)

Co-authored-by: donBarbos <donbarbos@proton.me>
2025-03-11 10:42:47 +00:00
Kyle Cutler
33605da91c
[3.12] gh-130809: Fix PyFrame_LocalsToFast copying the wrong value (#130816)
* gh-130809: Fix `PyFrame_LocalsToFast` copying the wrong value

* Skip hidden locals

* test, blurb

* Update Misc/NEWS.d/next/Core_and_Builtins/2025-03-04-12-52-21.gh-issue-130809.fSXq60.rst

Co-authored-by: Tian Gao <gaogaotiantian@hotmail.com>

* Update test

* PR feedback

* formatting

* comment

---------

Co-authored-by: Tian Gao <gaogaotiantian@hotmail.com>
2025-03-10 20:27:07 -04:00
Miss Islington (bot)
fcf1f57d91
[3.12] gh-125331: Allow the parser to activate future imports on the fly (GH-125482) (#131063)
gh-125331: Allow the parser to activate future imports on the fly (GH-125482)
(cherry picked from commit 3bd3e09588)

Co-authored-by: Pablo Galindo Salgado <Pablogsal@gmail.com>
2025-03-10 22:13:59 +00:00
Miss Islington (bot)
22ac71dc8e
gh-131020: py.exe launcher does not correctly detect a BOM when searching for the shebang (GH-131021)
(cherry picked from commit 36ef3bfe39)

Co-authored-by: Chris Eibl <138194463+chris-eibl@users.noreply.github.com>
2025-03-10 20:12:40 +00:00