[issue46337] urllib.parse: Allow more flexibility in schemes and URL resolution behavior

Senthil Kumaran added the comment: Hi all, I was looking at it. Introducing an enum at the last parameter is going to add cost of understanding the behavior to this function. I am doing further reading on the previous discussions and PR(s) now

[issue46337] urllib.parse: Allow more flexibility in schemes and URL resolution behavior

Senthil Kumaran added the comment: I will review this in a day. I had been following the conversation, but couldn't look deeper into the code. Thank you for engaging and contributions. -- ___ Python tracker <https://bugs.python.org/issue46

[issue42782] shutil.move creates a new directory even on failure

Senthil Kumaran added the comment: New changeset e808c9d5c78e5a7a9d804eced013a02c0c7df1a5 by Jelle Zijlstra in branch '3.9': [3.9] bpo-42782: fix broken shutil test (GH-31971) https://github.com/python/cpython/commit/e808c9d5c78e5a7a9d804eced013a02c0c7df1a5

[issue46756] Incorrect authorization check in urllib.request

Senthil Kumaran added the comment: Pablo, we are good. The PRs were merged in open branches a while ago, and this was tracking security releases backports. -- ___ Python tracker <https://bugs.python.org/issue46

[issue16247] Report failing url in URLError?

Senthil Kumaran added the comment: It is going to take a few weeks for me to get to my alerts, I will address this as soon as I get to it . Thanks for the triage, Irit. On Mon, Dec 13, 2021, 12:31 AM Irit Katriel wrote: > > Change by Irit Katriel : > > > --

[issue45795] urllib http client vulnerable to DOS attack

Senthil Kumaran added the comment: Hi Muhammad, I haven't gotten to this. urllib doesn't maintain a client state during multiple request / response. The code is available here https://github.com/python/cpython/tree/main/Lib/urllib

[issue45795] urllib http client vulnerable to DOS attack

Senthil Kumaran added the comment: > Timeout value should not be reset after client receives a data(bytes), > because it can easily be abused to achieve DOS. Interesting. I looked the server example. Does clients like curl have something like th

[issue28533] Remove asyncore, asynchat and smtpd modules

Senthil Kumaran added the comment: +1 to these modules removal. One concern I have is when users follow internet examples and look out for these modules or examples. What is the best way to show them the modern usage? - Should Python docs show some example snippet of the most common usage

[issue40321] urllib.request does not support HTTP response status code 308

Senthil Kumaran added the comment: New changeset c379bc5ec9012cf66424ef3d80612cf13ec51006 by Jochem Schulenklopper in branch 'main': bpo-40321: Support HTTP response status code 308 in urllib.request (#19588) https://github.com/python/cpython/commit/c379bc5ec9012cf66424ef3d80612cf13ec51006

[issue45067] Failed to build _curses on CentOS 7

Change by Senthil Kumaran : -- resolution: -> fixed stage: patch review -> resolved status: open -> closed versions: -Python 3.9 ___ Python tracker <https://bugs.python.or

[issue45067] Failed to build _curses on CentOS 7

Senthil Kumaran added the comment: New changeset 794430700defb913512f871b701a888aa730de81 by Senthil Kumaran in branch 'main': bpo-45067 - Verify the version of ncurses for extended color support feature usage. (GH-28260) https://github.com/python/cpython/commit

[issue45067] Failed to build _curses on CentOS 7

Senthil Kumaran added the comment: I have created a pull request - https://github.com/python/cpython/pull/28260 Please review this. -- assignee: -> orsenthil versions: +Python 3.10, Python 3.9 ___ Python tracker <https://bugs.pyth

[issue45067] Failed to build _curses on CentOS 7

Change by Senthil Kumaran : -- keywords: +patch pull_requests: +26680 stage: -> patch review pull_request: https://github.com/python/cpython/pull/28260 ___ Python tracker <https://bugs.python.org/issu

[issue45067] Failed to build _curses on CentOS 7

Senthil Kumaran added the comment: A change like this will be required since these funcs were introduced only recently and nurses shipped with centos was older. % git diff diff --git a/Modules/_cursesmodule.c b/Modules/_cursesmodule.c index 61aaf85522..6fb6c490e6 100644 --- a/Modules

[issue45067] Failed to build _curses on CentOS 7

Senthil Kumaran added the comment: Here is the output of make with relevant lines. CC='gcc -pthread' LDSHARED='gcc -pthread -shared' OPT='-DNDEBUG -g -fwrapv -O3 -Wall' _TCLTK_INCLUDES='' _TCLTK_LIBS='' ./python -E ./setup.py build running build running build_ext building

[issue45067] Failed to build _curses on CentOS 7

New submission from Senthil Kumaran : I verified that ncurses-devel is installed. ./configure is able to verify ncurses checking curses.h usability... yes checking curses.h presence... yes checking for curses.h... yes checking ncurses.h usability... yes checking ncurses.h presence... yes

[issue44830] Broken Mozilla devguide link in "Dealing with Bugs" doc section

Senthil Kumaran added the comment: @Jack, if you review this backport - https://github.com/python/cpython/pull/27666 , I can merge this PR. -- ___ Python tracker <https://bugs.python.org/issue44

[issue44830] Broken Mozilla devguide link in "Dealing with Bugs" doc section

Senthil Kumaran added the comment: New changeset 6a6bcf16370beff2e0d1a034661654d5c335b5ee by Miss Islington (bot) in branch '3.9': bpo-44830 - Remove the broken Broken Mozilla devguide link. (GH-27664) (GH-27665) https://github.com/python/cpython/commit

[issue44830] Broken Mozilla devguide link in "Dealing with Bugs" doc section

Change by Senthil Kumaran : -- pull_requests: +26155 pull_request: https://github.com/python/cpython/pull/27666 ___ Python tracker <https://bugs.python.org/issue44

[issue44830] Broken Mozilla devguide link in "Dealing with Bugs" doc section

Senthil Kumaran added the comment: New changeset ebecffdb6d5fffa4249f9a813f1fc1915926feb5 by Senthil Kumaran in branch 'main': bpo-44830 - Remove the broken Broken Mozilla devguide link. (GH-27664) https://github.com/python/cpython/commit/ebecffdb6d5fffa4249f9a813f1fc1915926feb5

[issue44830] Broken Mozilla devguide link in "Dealing with Bugs" doc section

Change by Senthil Kumaran : -- keywords: +patch nosy: +orsenthil nosy_count: 3.0 -> 4.0 pull_requests: +26153 stage: -> patch review pull_request: https://github.com/python/cpython/pull/27664 ___ Python tracker <https://bugs.python.org/i

[issue29555] Update Python Software Foundation Copyright Year

Senthil Kumaran added the comment: Yes, closing this. -- resolution: -> not a bug stage: -> resolved status: open -> closed ___ Python tracker <https://bugs.python.or

[issue44359] test_ftplib fails as "env changes" if a socket operation times out in a thread: TimeoutError is not catched

Change by Senthil Kumaran : -- nosy: +orsenthil ___ Python tracker <https://bugs.python.org/issue44359> ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue44360] test_compile killed by SIGKILL on AMD64 Ubuntu 3.x (Linux OOM Killer)

Senthil Kumaran added the comment: > Maybe you should give more memory to your worker, or you should spawn less > jobs in parallel It was related to high number of jobs in that particular agent and result in OOM Kill from the Linux kernel - https://pastebin.com/559H4ksa The machi

[issue44360] test_compile killed by SIGKILL on AMD64 Ubuntu 3.x

Senthil Kumaran added the comment: Yes, this was related to the Linux OOM Killer. The agent went down shortly after this. Either multiple parallel jobs might have led to OOM or something else. I will see if logs provide more information

[issue44348] test_exceptions.ExceptionTests.test_recursion_in_except_handler stack overflow on Windows debug builds

Change by Senthil Kumaran : -- nosy: +orsenthil ___ Python tracker <https://bugs.python.org/issue44348> ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue43105] [Windows] Can't import extension modules resolved via relative paths in sys.path

Senthil Kumaran added the comment: There is a report about this change might have caused behaviour change for '.' in sys.path between 3.10.0a7 and 3.10.0b1 https://mail.python.org/archives/list/python-...@python.org/thread/DE3MDGB2JGOJ3X4NWEGJS26BK6PJUPKW/ -- nosy: +orsenthil

[issue43882] [security] urllib.parse should sanitize urls containing ASCII newline and tabs.

Senthil Kumaran added the comment: New changeset 0593ae84af9e0e8332644e7ed13d7fd8306c4e1a by Senthil Kumaran in branch '3.9': [3.9] bpo-43882 - Mention urllib.parse changes in Whats new section. (GH-26276) https://github.com/python/cpython/commit/0593ae84af9e0e8332644e7ed13d7fd8306c4e1a

[issue43882] [security] urllib.parse should sanitize urls containing ASCII newline and tabs.

Senthil Kumaran added the comment: New changeset f14015adf52014c2345522fe32d43f15f001c986 by Senthil Kumaran in branch '3.10': [3.10] bpo-43882 - Mention urllib.parse changes in Whats new section. (GH-26275) https://github.com/python/cpython/commit/f14015adf52014c2345522fe32d43f15f001c986

[issue43882] [security] urllib.parse should sanitize urls containing ASCII newline and tabs.

Change by Senthil Kumaran : -- pull_requests: +24883 pull_request: https://github.com/python/cpython/pull/26277 ___ Python tracker <https://bugs.python.org/issue43

[issue43882] [security] urllib.parse should sanitize urls containing ASCII newline and tabs.

Change by Senthil Kumaran : -- pull_requests: +24882 pull_request: https://github.com/python/cpython/pull/26276 ___ Python tracker <https://bugs.python.org/issue43

[issue43882] [security] urllib.parse should sanitize urls containing ASCII newline and tabs.

Change by Senthil Kumaran : -- pull_requests: +24881 stage: commit review -> patch review pull_request: https://github.com/python/cpython/pull/26275 ___ Python tracker <https://bugs.python.org/issu

[issue43882] [security] urllib.parse should sanitize urls containing ASCII newline and tabs.

Change by Senthil Kumaran : -- pull_requests: +24872 pull_request: https://github.com/python/cpython/pull/26268 ___ Python tracker <https://bugs.python.org/issue43

[issue43882] [security] urllib.parse should sanitize urls containing ASCII newline and tabs.

Change by Senthil Kumaran : -- pull_requests: +24871 stage: resolved -> patch review pull_request: https://github.com/python/cpython/pull/26267 ___ Python tracker <https://bugs.python.org/issu

[issue43504] Site linked in docs, effbot.org, down

Senthil Kumaran added the comment: Julien, we could remove them from docs.python.org instead of pointing to archive.org. Users will be able to find more recent examples in the internet. -- nosy: +orsenthil ___ Python tracker <ht

[issue44089] csv.Error can't be subclassed

Senthil Kumaran added the comment: This was also merged in 3.11 https://github.com/python/cpython/commit/2b458c1dba4058c808fde25226bb2d91c5a909ca -- ___ Python tracker <https://bugs.python.org/issue44

[issue44089] csv.Error can't be subclassed

Change by Senthil Kumaran : -- assignee: -> orsenthil resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker <https://bugs.python

[issue44089] csv.Error can't be subclassed

Senthil Kumaran added the comment: New changeset 3e44e9af9ea4c5e82912a01f256d4abcae96f32b by Miss Islington (bot) in branch '3.10': bpo-44089: Allow subclassing of ``csv.Error`` (GH-26008) (GH-26066) https://github.com/python/cpython/commit/3e44e9af9ea4c5e82912a01f256d4abcae96f32b

[issue23750] doc: Clarify difference between os.system/subprocess.call in section "Replacing os.system()"

Senthil Kumaran added the comment: New changeset 390bfe044531a813722919933116ed37fe321861 by Miss Islington (bot) in branch '3.9': bpo-23750: Document os-system, subprocess. Patch by Martin Panter. (GH-26016) (GH-26041) https://github.com/python/cpython/commit

[issue23750] doc: Clarify difference between os.system/subprocess.call in section "Replacing os.system()"

Change by Senthil Kumaran : -- stage: patch review -> resolved status: open -> closed ___ Python tracker <https://bugs.python.org/issue23750> ___ ___ Pyth

[issue23750] doc: Clarify difference between os.system/subprocess.call in section "Replacing os.system()"

Senthil Kumaran added the comment: New changeset 6fc6f4366d02412e3424d2a6da43a28d8f479d7b by Miss Islington (bot) in branch '3.10': bpo-23750: Document os-system, subprocess. Patch by Martin Panter. (GH-26016) (GH-26040) https://github.com/python/cpython/commit

[issue23750] doc: Clarify difference between os.system/subprocess.call in section "Replacing os.system()"

Senthil Kumaran added the comment: Does anyone know what the return value 768 signify here? -- nosy: +orsenthil ___ Python tracker <https://bugs.python.org/issue23

[issue16866] libainstall doesn't create $(BINDIR) directory

Senthil Kumaran added the comment: In 3.10 - https://github.com/python/cpython/commit/a2c72d52dddefbfbaa0745b0af54330fad03b29e 3.9 - https://github.com/python/cpython/commit/a25c46bd7dd47a2f95b32d17ee2f66de214892c6 -- resolution: -> fixed stage: patch review -> resolved

[issue16866] libainstall doesn't create $(BINDIR) directory

Senthil Kumaran added the comment: Fixed in 3.11 here - https://github.com/python/cpython/commit/80d250d68cf3bb511fd862169c681b28028499c2 -- ___ Python tracker <https://bugs.python.org/issue16

[issue16866] libainstall doesn't create $(BINDIR) directory

Change by Senthil Kumaran : -- pull_requests: +24632 stage: needs patch -> patch review pull_request: https://github.com/python/cpython/pull/25980 ___ Python tracker <https://bugs.python.org/issu

[issue16866] libainstall doesn't create $(BINDIR) directory

Senthil Kumaran added the comment: Looks like the BINDIR dependency was added here - https://github.com/python/cpython/commit/49fd7fa4431da299196d74087df4a04f99f9c46f#diff-1f0a8db227d22005511b0d90f5339b97db345917b863954b3b3ccb9ec308767cR833 but we didn't add the directory creation dependency

[issue43882] [security] urllib.parse should sanitize urls containing ASCII newline and tabs.

Senthil Kumaran added the comment: Ned wrote: > Senthil, I am not sure which previous message you are referring to but. I meant, the messages from other developers who raised that change broke certain test cases. Ned, but I got little concerned, if we planned to revert the cha

[issue43882] [security] urllib.parse should sanitize urls containing ASCII newline and tabs.

Senthil Kumaran added the comment: Hello All, I think, the current striping of ASCII newline and tab is a _reasonable_ solution given it was a security issue. It also follows the guidelines of "WHATWG" (Specifically Point 3) > 2. If input contains any ASCII tab or newlin

[issue16866] libainstall doesn't create $(BINDIR) directory

Senthil Kumaran added the comment: issue25696 was related, and it fixed bininstall issue. -- ___ Python tracker <https://bugs.python.org/issue16866> ___ ___

[issue16866] libainstall doesn't create $(BINDIR) directory

Senthil Kumaran added the comment: This is still a problem behaviour as of May 2021. ./configure --prefix=/home/senthil/foobar make libainstall failed with /usr/bin/install: cannot create regular file '/home/senthil/foobar/bin/python3.11-config': No such file or directory make

[issue9725] urllib.request.FancyURLopener won't connect to pages requiring username and password

Senthil Kumaran added the comment: urllib.request.FancyURLopener has been deprecated since 3.3 https://docs.python.org/3/library/urllib.request.html#urllib.request.FancyURLopener This bug wont be fixed. The other higher level methods (urlopen) could used for basic authentication

[issue30164] Testing FTP support in urllib shouldn't use Debian FTP server

Change by Senthil Kumaran : -- pull_requests: +24624 pull_request: https://github.com/python/cpython/pull/25968 ___ Python tracker <https://bugs.python.org/issue30

[issue30164] Testing FTP support in urllib shouldn't use Debian FTP server

Senthil Kumaran added the comment: This has been fixed here - https://github.com/python/cpython/pull/2755/files Python docs demonstrate the usage of ftplib using ftp.debian.org. I think, it is perfectly reasonable and welcome thing to do so. https://docs.python.org/3/library/ftplib.html

[issue12441] _GLOBAL_DEFAULT_TIMEOUT remains as an object() in HTTPConnection and the connection hangs

Senthil Kumaran added the comment: The _GLOBAL_DEFAULT_TIMEOUT usage is an established pattern with socket module. https://github.com/python/cpython/blob/main/Lib/socket.py#L805 This is not a bug and we don't have a good reproducible step mentioned in the report. -- resolution

[issue11466] getpass.getpass doesn't close tty file

Senthil Kumaran added the comment: This was fixed in https://github.com/python/cpython/commit/16dbbae2981c96c7c9b1ae81e1708d54b08c10ac Since Python 3.4 And tests do not raise any ResourceWarning now. ``` $ ../../python -Vs Python 3.11.0a0 $ ../../python -m unittest test_getpass.py -v

[issue43972] Simple HTTP Request Handler in http.server does not set a content-length and does not close connections on 301s

Change by Senthil Kumaran : -- resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker <https://bugs.python.or

[issue43972] Simple HTTP Request Handler in http.server does not set a content-length and does not close connections on 301s

Change by Senthil Kumaran : -- versions: +Python 3.10, Python 3.9 ___ Python tracker <https://bugs.python.org/issue43972> ___ ___ Python-bugs-list mailin

[issue43972] Simple HTTP Request Handler in http.server does not set a content-length and does not close connections on 301s

Senthil Kumaran added the comment: Hi Stephen, Thanks for the response and the details. I was able to verify the bug! I don't know exactly what I was doing previously, but I agree with you that this is a bug and will be fixed with your patch. :) Thanks, Senthil

[issue43972] Simple HTTP Request Handler in http.server does not set a content-length and does not close connections on 301s

Senthil Kumaran added the comment: I am also hesitant to fix something that is not broken. So, please share the broken behavior that could be verified, and this will give us greater confidence to commit this patch. -- ___ Python tracker <ht

[issue43972] Simple HTTP Request Handler in http.server does not set a content-length and does not close connections on 301s

Senthil Kumaran added the comment: Hi Stephen, With the example, I couldn't reproduce the problem with curl 7.65.3 That said, I do recognize that this change is a positive improvement, but I cannot see this a bug-fix (and for client misbehavior, which I couldn't verify). To take a call, I

[issue43882] [security] urllib.parse should sanitize urls containing ASCII newline and tabs.

Senthil Kumaran added the comment: New changeset 24f1d1a8a2c4aa58a606b4b6d5fa4305a3b91705 by Miss Islington (bot) in branch '3.10': bpo-43882 Remove the newline, and tab early. From query and fragments. (GH-25936) https://github.com/python/cpython/commit

[issue43882] [security] urllib.parse should sanitize urls containing ASCII newline and tabs.

Change by Senthil Kumaran : -- pull_requests: +24589 pull_request: https://github.com/python/cpython/pull/25921 ___ Python tracker <https://bugs.python.org/issue43

[issue43882] [security] urllib.parse should sanitize urls containing ASCII newline and tabs.

Senthil Kumaran added the comment: New changeset 8a595744e696a0fb92dccc5d4e45da41571270a1 by Senthil Kumaran in branch '3.9': [3.9] bpo-43882 Remove the newline, and tab early. From query and fragments. (#25853) https://github.com/python/cpython/commit

[issue43882] [security] urllib.parse should sanitize urls containing ASCII newline and tabs.

Senthil Kumaran added the comment: Based on Greg's review comment, I have pushed the fix for 3.9, and 3.8 - [3.9] https://github.com/python/cpython/pull/25853 - [3.8] https://github.com/python/cpython/pull/25726 There is no need to hold off releases for these alone. If we get it merged

[issue43882] [security] urllib.parse should sanitize urls containing ASCII newline and tabs.

Change by Senthil Kumaran : -- pull_requests: +24537 pull_request: https://github.com/python/cpython/pull/25853 ___ Python tracker <https://bugs.python.org/issue43

[issue43972] Simple HTTP Request Handler in http.server does not set a content-length and does not close connections on 301s

Senthil Kumaran added the comment: Hi Stephen, Could you give a brief demo of using curl to see the problematic behavior. I have testing with a version python and saw that without content length, the curl was behaving properly. ``` $mkdir foo $#add index.html to directory foo $python -m

[issue43972] Simple HTTP Request Handler in http.server does not set a content-length and does not close connections on 301s

Change by Senthil Kumaran : -- assignee: -> orsenthil nosy: +orsenthil ___ Python tracker <https://bugs.python.org/issue43972> ___ ___ Python-bugs-list mai

[issue43882] [security] urllib.parse should sanitize urls containing ASCII newline and tabs.

Senthil Kumaran added the comment: New changeset 491fde0161d5e527eeff8586dd3972d7d3a631a7 by Miss Islington (bot) in branch '3.9': [3.9] bpo-43882 - urllib.parse should sanitize urls containing ASCII newline and tabs. (GH-25595) (GH-25725) https://github.com/python/cpython/commit

[issue43882] [security] urllib.parse should sanitize urls containing ASCII newline and tabs.

Senthil Kumaran added the comment: New changeset 76cd81d60310d65d01f9d7b48a8985d8ab89c8b4 by Senthil Kumaran in branch 'master': bpo-43882 - urllib.parse should sanitize urls containing ASCII newline and tabs. (GH-25595) https://github.com/python/cpython/commit

[issue43795] Implement PEP 652 -- Maintaining the Stable ABI

Change by Senthil Kumaran : -- nosy: +orsenthil nosy_count: 3.0 -> 4.0 pull_requests: +24407 pull_request: https://github.com/python/cpython/pull/25716 ___ Python tracker <https://bugs.python.org/issu

[issue43774] [Doc] Document configure options in the Python documentation

Change by Senthil Kumaran : -- nosy: +orsenthil nosy_count: 5.0 -> 6.0 pull_requests: +24406 pull_request: https://github.com/python/cpython/pull/25716 ___ Python tracker <https://bugs.python.org/issu

[issue8077] cgi handling of POSTed files is broken in Windows

Change by Senthil Kumaran : -- pull_requests: +24343 stage: test needed -> patch review pull_request: https://github.com/python/cpython/pull/25652 ___ Python tracker <https://bugs.python.org/iss

[issue8077] cgi handling of POSTed files is broken in Windows

Change by Senthil Kumaran : -- title: cgi handling of POSTed files is broken -> cgi handling of POSTed files is broken in Windows versions: +Python 3.10 -Python 3.2, Python 3.3 ___ Python tracker <https://bugs.python.org/iss

[issue27820] Possible bug in smtplib when initial_response_ok=False

Senthil Kumaran added the comment: Please open a new issue. It has better chances of being fixed quickly. On Mon, Apr 26, 2021 at 10:02 PM junpengruan wrote: > > junpengruan <632077...@qq.com> added the comment: > > Hi > I think there is another bug when initial_re

[issue12966] cookielib.LWPCookieJar breaks on cookie values with a newline

Senthil Kumaran added the comment: This bug was reported in 2.5 and we don't have a test case attached in this report. Given many changes and age of the bug, I am closing this. A specific report against the latest code will help us to fix this bug. -- stage: -> resolved sta

[issue3609] does parse_header really belong in CGI module?

Change by Senthil Kumaran : -- stage: needs patch -> resolved status: languishing -> closed ___ Python tracker <https://bugs.python.org/issue3609> ___ ___

[issue23498] Expose http.cookiejar.split_header_words()

Change by Senthil Kumaran : -- assignee: -> orsenthil ___ Python tracker <https://bugs.python.org/issue23498> ___ ___ Python-bugs-list mailing list Unsubscrib

[issue3609] does parse_header really belong in CGI module?

Senthil Kumaran added the comment: Closing this age old bug in favor of fixing it as part of issue23498. -- resolution: -> wont fix ___ Python tracker <https://bugs.python.org/iss

[issue43534] turtle.textinput window is not transient

Senthil Kumaran added the comment: New changeset b47f05157bd05c5825c26389af5be3064a2c1313 by Miss Islington (bot) in branch '3.9': bpo-43534: Fix the turtle module working with multiple root windows GH-25593 https://github.com/python/cpython/commit/b47f05157bd05c5825c26389af5be3064a2c1313

[issue43534] turtle.textinput window is not transient

Senthil Kumaran added the comment: New changeset 9ca20fdc4c27e31832adbd6d393a87e7d8953e3c by Miss Islington (bot) in branch '3.8': bpo-43534: Fix the turtle module working with multiple root windows GH-25594 https://github.com/python/cpython/commit/9ca20fdc4c27e31832adbd6d393a87e7d8953e3c

[issue43882] [security] urllib.parse should sanitize urls containing ASCII newline and tabs.

Senthil Kumaran added the comment: I have added a PR to remove ascii newlines and tabs from URL input. It is as per the WHATWG spec. However, I still like to research more and find out if this isn't introducing behavior that will break existing systems. It should also be aligned

[issue43882] [security] urllib.parse should sanitize urls containing ASCII newline and tabs.

Change by Senthil Kumaran : -- keywords: +patch pull_requests: +24315 stage: needs patch -> patch review pull_request: https://github.com/python/cpython/pull/25595 ___ Python tracker <https://bugs.python.org/issu

[issue43883] Making urlparse WHATWG conformant

New submission from Senthil Kumaran : Mike Lissner reported that a set test suites that exercise extreme conditions with URLs, but in conformance with url.spec.whatwg.org was maintained here: https://github.com/web-platform-tests/wpt/tree/77da471a234e03e65a22ee6df8ceff7aaba391f8/url

[issue43882] urllib.parse should sanitize urls containing ASCII newline and tabs.

New submission from Senthil Kumaran : A security issue was reported by Mike Lissner wherein an attacker was able to use `\r\n` in the url path, the urlparse method didn't sanitize and allowed those characters be present in the request. > In [9]: from urllib.parse import urlsplit >

[issue43871] urllib.parse.urlparse doesn't check port

Change by Senthil Kumaran : -- assignee: -> orsenthil versions: +Python 3.10 ___ Python tracker <https://bugs.python.org/issue43871> ___ ___ Python-bugs-lis

[issue43871] urllib.parse.urlparse doesn't check port

Senthil Kumaran added the comment: Treating this as bug in itself might be a better idea than waiting for a ipv6 scope introduction, which had few caveats. > Would it be an improvement if _checknetloc[2] validates the value of port > properly? Yes, we could check if it is

[issue42967] [CVE-2021-23336] urllib.parse.parse_qsl(): Web cache poisoning - `; ` as a query args separator

Senthil Kumaran added the comment: New changeset d5b80eb11b4812b4a579ce129ba4a10c5f5d27f6 by Miss Islington (bot) in branch '3.8': bpo-42967: coerce bytes separator to string in urllib.parse_qs(l) (GH-24818) (#25345) https://github.com/python/cpython/commit

[issue42967] [CVE-2021-23336] urllib.parse.parse_qsl(): Web cache poisoning - `; ` as a query args separator

Senthil Kumaran added the comment: New changeset b38601d49675d90e1ee6faa47f7adaeca992d02d by Ken Jin in branch 'master': bpo-42967: coerce bytes separator to string in urllib.parse_qs(l) (#24818) https://github.com/python/cpython/commit/b38601d49675d90e1ee6faa47f7adaeca992d02d

[issue43479] Remove a duplicate comment and assignment in http.client

Change by Senthil Kumaran : -- stage: -> resolved ___ Python tracker <https://bugs.python.org/issue43479> ___ ___ Python-bugs-list mailing list Unsubscrib

[issue43479] Remove a duplicate comment and assignment in http.client

Change by Senthil Kumaran : -- stage: resolved -> ___ Python tracker <https://bugs.python.org/issue43479> ___ ___ Python-bugs-list mailing list Unsubscrib

[issue43479] Remove a duplicate comment and assignment in http.client

Change by Senthil Kumaran : -- resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker <https://bugs.python.or

[issue43479] Remove a duplicate comment and assignment in http.client

Change by Senthil Kumaran : -- assignee: -> orsenthil nosy: +orsenthil versions: -Python 3.6, Python 3.7 ___ Python tracker <https://bugs.python.org/issu

[issue27820] Possible bug in smtplib when initial_response_ok=False

Change by Senthil Kumaran : -- resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker <https://bugs.python.or

[issue27820] Possible bug in smtplib when initial_response_ok=False

Senthil Kumaran added the comment: New changeset 8cadc2c9cacfa1710cb5ca28a70f7782cacf09aa by Senthil Kumaran in branch '3.8': [3.8] bpo-27820: Fix AUTH LOGIN logic in smtplib.SMTP (GH-24118) (#24833) https://github.com/python/cpython/commit/8cadc2c9cacfa1710cb5ca28a70f7782cacf09aa

[issue42967] [CVE-2021-23336] urllib.parse.parse_qsl(): Web cache poisoning - `; ` as a query args separator

Senthil Kumaran added the comment: Petr, On > the `separator` argument now allows multi-character strings, so you can parse > 'a=1b=2' with separator=''. Was this intentional? No, this was not intentional. The separator arg was just coice, for compatibility, if some wanted

[issue27820] Possible bug in smtplib when initial_response_ok=False

Senthil Kumaran added the comment: New changeset 32717b982d3347e30ae53eb434e2a32e0d03d51e by Miss Islington (bot) in branch '3.9': bpo-27820: Fix AUTH LOGIN logic in smtplib.SMTP (GH-24118) (#24832) https://github.com/python/cpython/commit/32717b982d3347e30ae53eb434e2a32e0d03d51e

[issue27820] Possible bug in smtplib when initial_response_ok=False

Change by Senthil Kumaran : -- pull_requests: +23599 pull_request: https://github.com/python/cpython/pull/24833 ___ Python tracker <https://bugs.python.org/issue27

[issue27820] Possible bug in smtplib when initial_response_ok=False

Senthil Kumaran added the comment: New changeset 7591d9455eb37525c832da3d65e1a7b3e6dbf613 by Pandu E POLUAN in branch 'master': bpo-27820: Fix AUTH LOGIN logic in smtplib.SMTP (GH-24118) https://github.com/python/cpython/commit/7591d9455eb37525c832da3d65e1a7b3e6dbf613

[issue42967] [CVE-2021-23336] urllib.parse.parse_qsl(): Web cache poisoning - `; ` as a query args separator

Senthil Kumaran added the comment: Petr, thank you. Let's treat it as a new issue linked to this. -- ___ Python tracker <https://bugs.python.org/issue42

[issue27820] Possible bug in smtplib when initial_response_ok=False

Senthil Kumaran added the comment: Hello Pandu, Thank you for this patch and the explanation. Does client blocking on repeated challenge from the server (using of while loop) look okay here? The conversation here indicates to me that it is fine. Is there any recommendation

  1   2   3   4   5   6   7   8   9   10   >