gh-160097: Reject links replacing the destination in `tarfile.tar_filter` (GH-160098)
(cherry picked from commit e7e0b3523a)
Co-authored-by: Stan Ulbrych <stan@python.org>
gh-160300: Reject cookies with a negative version in http.cookiejar (GH-160301)
DefaultCookiePolicy only applied its domain checks to cookies with
version 0 or a positive version.
ANT-2026-TA36I7V7
(cherry picked from commit d59d96853b)
Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
Make knownfiles empty on Windows so that only the registry is used by default. Files passed to init() or assigned to knownfiles explicitly are still read.
(cherry picked from commit 04a29bf8f9)
* [3.12] gh-157579: Fix race condition in the cleanup of `tempfile.TemporaryDirectory` (GH-157580) (GH-158430)
* gh-157579: Fix race condition in the cleanup of `tempfile.TemporaryDirectory` (GH-157580)
(cherry picked from commit 5c20517a4f)
* Add root user checks to test.support
This partially backports commit 86b8617747
(GH-146195); making existing tests use the helper is omitted.
---------
(cherry picked from commit 58ed0259ca)
Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Co-authored-by: Stan Ulbrych <stan@python.org>
Co-authored-by: Petr Viktorin <encukou@gmail.com>
* gh-134993: Add os.lstat() to os.supports_dir_fd (#135188)
---------
Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Co-authored-by: Stan Ulbrych <stan@python.org>
Co-authored-by: Victor Stinner <vstinner@python.org>
gh-87720 Fix additional header refolding-quoting edge case (GH-134271)
In this case, the higher level syntactic unit fit on the remainder of
the line in un-encoded format, and that higher level unit was
not a ptext or vtext, so the encoding check failed. To fix this, we
look inside the current unit to see if has anything that was
originally encoded.
(cherry picked from commit 5a22a62b96)
Co-authored-by: R. David Murray <rdmurray@bitdance.com>
gh-159914: Ignore gdb stderr in test_gdb.test_pretty_print (GH-159916)
test_strings() gets gdb.host_charset(), but fails if gdb writes
anything to stderr. For example, it fails if gdb logs the warning:
"/usr/bin/gdb: warning: Couldn't determine a path for the index
cache directory."
Even if stdout contains the expected encoding ("UTF-8").
Change test_gdb to only fail if stdout is empty, ignore stderr
otherwise to ignore gdb warnings.
(cherry picked from commit 88d922ad98)
(cherry picked from commit d9b6c229f2)
Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Co-authored-by: Victor Stinner <vstinner@python.org>
The ssl module now rejects TLS certificate chains that contain any of a set of
compromised eMudhra intermediate CA keys. This is an extraordinary measure and
a last line of defense: removing trust is primarily the job of the platform root
store, and the built-in denylist only blocks connections while that update has
not yet reached the OS, a container image, or a bundled trust store in various
Python packages. Entries are added to the denylist only under a very high
threshold.
The denylist matches on the public key (the SHA-256 digest of the RFC-5280
SubjectPublicKeyInfo), so it also covers the cross-signed certificates that
reuse one of the distrusted keys.
(cherry picked from commit 7dd8b4736a)
Co-authored-by: Christian Heimes <christian@python.org>
[3.14] Add Sphinx markup for CVEs in Changelog entries (GH-159415) (GH-159913)
(cherry picked from commit aa5b0ed2b4)
(cherry picked from commit 44a2c1a5d9)
Co-authored-by: Stan Ulbrych <stan@python.org>
* gh-156002: Bound zipfile decompression for bzip2/LZMA/Zstandard (GH-156003) (GH-156362)
Patch by @tonghuaroot.
zipfile.ZipExtFile._read1() bounds the output of each decompress() call
for DEFLATE members by passing a max_length to zlib, but for bzip2, LZMA,
and Zstandard members it called decompress() with no bound. A whole
compressed chunk was therefore expanded into a single allocation before
the data[:self._left] clip ran, so a consumer that deliberately reads in
small chunks to limit memory (for example zf.open(name).read(8192)) was
silently unprotected for non-DEFLATE members. A small, spec-conformant
archive member declaring a large uncompressed size could drive multi-GB
peak memory.
_read1() now passes a per-call bound to the non-DEFLATE decompress()
(mirroring the DEFLATE branch) and drains the decompressor's internal
buffer across calls by checking needs_input before reading more
compressed input. zipfile's LZMADecompressor wrapper forwards max_length
and exposes needs_input so the bound also holds for LZMA members.
(cherry picked from commit f897dbf2f3)
(cherry picked from commit 1b424c0178)
* gh-156002: Keep reading through monkey-patched zipfile decompressors (GH-157180) (GH-157557)
(cherry picked from commit f507e6946a)
Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: tonghuaroot <tonghuaroot@gmail.com>
Co-authored-by: rasmusfaber <rfaber@gmail.com>
* gh-157265: tarfile: Honor None result of filter for link fallbacks (GH-157266)
(cherry picked from commit fb2f0bbc3b)
Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Stan Ulbrych <stan@python.org>
* gh-157265: Adjust test for Windows (GH-157334)
Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Stan Ulbrych <stan@python.org>
* gh-157579: Fix race condition in the cleanup of `tempfile.TemporaryDirectory` (GH-157580)
(cherry picked from commit 5c20517a4f)
* Add root user checks to test.support
This partially backports commit 86b8617747
(GH-146195); making existing tests use the helper is omitted.
* gh-134993: Add os.lstat() to os.supports_dir_fd (#135188)
Co-authored-by: Stan Ulbrych <stan@python.org>
Co-authored-by: Victor Stinner <vstinner@python.org>
Co-authored-by: Petr Viktorin <encukou@gmail.com>
Match also '[SSL: HTTP_REQUEST] http request (_ssl.c:1143)'.
(cherry picked from commit 540b3d0a7f)
Co-authored-by: Russell Keith-Magee <russell@keith-magee.com>
* [3.12] gh-157190: Fix tarfile `data`/`tar` filter bypass via hard link to a symlink (GH-157191) (GH-157192)
(cherry picked from commit 480ea4aab8)
The backport to 3.13 and below includes a NEWS entry.
(cherry picked from commit b8f23e3070)
Co-authored-by: Stan Ulbrych <stan@python.org>
Co-authored-by: Russell Keith-Magee <russell@keith-magee.com>
* gh-158446: Reject float format precision near INT_MAX (GH-158474)
Formatting a float or complex with a precision within about 1000 of
INT_MAX could crash or produce incorrect output.
PyOS_double_to_string() now raises ValueError("precision too big") for
such precisions, as the format string parsers already do for
precisions above INT_MAX.
The limit applies regardless of presentation type or value, so a few
calls that previously succeeded (inf, nan, or 'g' with such a
precision) now raise as well.
(cherry picked from commit b7b4f3ecf2)
Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
* gh-158446: Fix the new test_format test on 3.12
test_format.py does not import import_module on this branch. Import
INT_MAX from _testcapi directly, as the neighboring test does.
---------
Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Due to a bug, some Unicode codepoint attributes were considered
for characters not yet defined in Unicode 3.2.0 or attributes
which changed in later Unicode versions. RFC 3454 (StringPrep)
requires using Unicode 3.2.0 strictly.
(cherry picked from commit 7e109d0)
The cherry-pick needed reworking as GH-144815 wasn't backported to 3.14
and below, so unassigned characters don't have bidi values.
(cherry picked from commit 1e54caa)
Also, add Unicode_3_2_0_FunctionsTest as in the later versions,
to make the new test work.
Co-authored-by: Seth Larson seth@python.org
Co-authored-by: Stan Ulbrych 89152624+stanfromireland@users.noreply.github.com
Co-authored-by: Petr Viktorin encukou@gmail.com
gh-155999: `tarfile`: handle a member that leaves the destination but comes back (GH-156000)
(cherry picked from commit 97688346ad)
Co-authored-by: Stan Ulbrych <stan@python.org>
gh-155694: Scope HTTPPasswordMgr credentials by URL scheme (GH-155696)
Credentials stored for an https:// URI were also matched against the
corresponding http:// URI, since `reduce_uri()` discards the scheme.
`HTTPPasswordMgr` and `HTTPPasswordMgrWithPriorAuth` now compare the scheme
too; URIs registered without a scheme still match any scheme.
(cherry picked from commit a7bb524fef)
Co-authored-by: Łukasz <lukaszlapinski7@gmail.com>
[3.13] gh-149231: tomllib: Limit the number of parts in a key (GH-149233) (GH-149815)
(cherry picked from commit bc7c102f34)
(cherry picked from commit 724a5e5e3b)
Co-authored-by: Stan Ulbrych <stan@python.org>
Use negative lookahead in option regex to prevent backtracking, and to avoid changing logic outside the regexes (since people could use the regex directly).
(cherry picked from commit 7e0a0be409)
(cherry picked from commit a5969e8f0f)
Co-authored-by: Joshua Swanson <22283299+joshuaswanson@users.noreply.github.com>
gh-149776: Skip UDP Lite tests if it's not supported (#149777)
Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if
it's not supported.
(cherry picked from commit 3cfc249e11)
Thomas Wouters