[issue34624] -W option and PYTHONWARNINGS env variable does not accept module regexes

[Kevin Locke]

Change by Kevin Locke :


--
nosy: +kevinoid
nosy_count: 10.0 -> 11.0
pull_requests: +29932
pull_request: https://github.com/python/cpython/pull/23172

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue34624] -W option and PYTHONWARNINGS env variable does not accept module regexes

[Thomas Gläßle]

Change by Thomas Gläßle :


--
stage: patch review -> resolved
status: open -> closed

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue34624] -W option and PYTHONWARNINGS env variable does not accept module regexes

[Thomas Gläßle]

Thomas Gläßle  added the comment:

Ok, it seems at least the incorrect documentation has been fixed in the mean 
time.

I'm going to close this as there seems to be no capacity to deal with this.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue34624] -W option and PYTHONWARNINGS env variable does not accept module regexes

[STINNER Victor]

STINNER Victor  added the comment:

One option is to keep the current behavior by default, but support a new 
"/regex/" format. The /regex/ format is commonly used in Perl and sed.

Example to ignore warnings containing "deprecated" string in their message:


   python3 -W "ignore:/deprecated/"
   PYTHONWARNINGS="ignore:/deprecated/"

whereas the following commands continue to match exactly the whole warning 
message "deprecated":

   python3 -W "ignore:deprecated"
   PYTHONWARNINGS="ignore:deprecated"

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue34624] -W option and PYTHONWARNINGS env variable does not accept module regexes

[STINNER Victor]

STINNER Victor  added the comment:

> Adding regular expression support to -W and PYTHONWARNINGS env var turns the 
> options into potential attack vectors.

Why would an attacker control these options?

If an attacker controls how Python is run, they are more efficient way to take 
control of Python and execute arbitrary code, than just trigger a denial of 
service, no

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue34624] -W option and PYTHONWARNINGS env variable does not accept module regexes

[STINNER Victor]

STINNER Victor  added the comment:

Oh, I didn't know this issue. I closed my issue bpo-43862 as a duplicate.

--
nosy: +vstinner

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue34624] -W option and PYTHONWARNINGS env variable does not accept module regexes

[Christian Heimes]

Christian Heimes  added the comment:

Adding regular expression support to -W and PYTHONWARNINGS env var turns the 
options into potential attack vectors. It can introduce REDOS vulnerability.

--
keywords: +security_issue
nosy: +christian.heimes
type:  -> enhancement
versions: +Python 3.11 -Python 3.10, Python 3.6, Python 3.7, Python 3.8, Python 
3.9

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue34624] -W option and PYTHONWARNINGS env variable does not accept module regexes

[Nikolaus Rath]

Change by Nikolaus Rath :


--
nosy:  -nikratio

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue34624] -W option and PYTHONWARNINGS env variable does not accept module regexes

[Yongjik Kim]

Yongjik Kim  added the comment:

Hi, sorry if I'm interrupting, but while we're at this, could we also not 
escape regex for "message" part?  (Or at least amend the documentation to 
clarify that the message part is literal string match?)

Currently, the docs on -W just say "The meaning of each of these fields is as 
described in The Warnings Filter" and then "The Warnings Filter" section says 
that the "message" field is a regex, but currently it's only true if you run 
warnings.filterwarnings() directly, and not if you use the -W option.

--
nosy: +Yongjik Kim

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue34624] -W option and PYTHONWARNINGS env variable does not accept module regexes

[Thomas Gläßle]

Thomas Gläßle  added the comment:

Hi, I have rebased this on master and fixed the minor conflict. Let me know if 
there is anything else I can do.

Best, Thomas

--
versions: +Python 3.10, Python 3.9

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue34624] -W option and PYTHONWARNINGS env variable does not accept module regexes

[Marco Paolini]

Marco Paolini  added the comment:

hello Thomas,

do you need any help fixing the conflicts in your PR?


even if Lib/warnings.py changed a little in the last 2 years, your PR is still 
good!

--
nosy: +mpaolini

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue34624] -W option and PYTHONWARNINGS env variable does not accept module regexes

[daniel hahler]

daniel hahler  added the comment:

Note that "module" might also be the filename (with ".py" removed).

I've just created issue37634 - might be worth including in your PR if it makes 
sense to only document this.

--
nosy: +blueyed

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue34624] -W option and PYTHONWARNINGS env variable does not accept module regexes

[Nick Coghlan]

Nick Coghlan  added the comment:

I think the only reason I didn't mention this discrepancy in my doc updates is 
because I wasn't aware there *was* a discrepancy.

The weird syntax was then just an incorrect amalgamation of "optional argument" 
notation with an improperly escaped regex suffix.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue34624] -W option and PYTHONWARNINGS env variable does not accept module regexes

[kernc]

Change by kernc :


--
nosy: +kernc

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue34624] -W option and PYTHONWARNINGS env variable does not accept module regexes

[Thomas Gläßle]

Thomas Gläßle  added the comment:

Hi, thanks for the consideration!

Is there any reason to introduce different behaviour than with filterwarnings 
here? This increases the number of things to remember - and except for the dot 
regex syntax doesn't interfere with module names, so there is no big drawback 
here either.

More importantly, my main use case for filterwarnings would be to select/ignore 
warnings based on module *or package* name. With the current interpretation as 
exact module name, you have to list all submodules in advance, which is quite 
inhibiting.

I have fixed the `[.*]` bogus example in the PR.

Best, Thomas

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue34624] -W option and PYTHONWARNINGS env variable does not accept module regexes

[Ned Batchelder]

Ned Batchelder  added the comment:

Another option is to make clear in the docs that the command line does not 
accept regular expressions, but only literal module names, and raise an error 
if a non-importable name (for example with asterisks in it) is specified.

And while we are here: the docs show "error:::mymodule[.*]" which doesn't even 
make sense as a regex!

--
nosy: +nedbat

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue34624] -W option and PYTHONWARNINGS env variable does not accept module regexes

[Nikolaus Rath]

Change by Nikolaus Rath :


--
nosy: +nikratio
title: -W option does not accept module regexes -> -W option and PYTHONWARNINGS 
env variable does not accept module regexes

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com