<feed xmlns='http://www.w3.org/2005/Atom'>
<title>delta/cpython-git.git/Lib/difflib.py, branch alex-patch-1</title>
<subtitle>github.com: python/cpython.git
</subtitle>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/cpython-git.git/'/>
<entry>
<title>Revert "bpo-35603: Escape table header of make_table output that can cause potential XSS. (GH-11341)" (GH-11356)</title>
<updated>2019-01-02T12:49:25+00:00</updated>
<author>
<name>Serhiy Storchaka</name>
<email>storchaka@gmail.com</email>
</author>
<published>2019-01-02T12:49:25+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/cpython-git.git/commit/?id=830ddc74c495ac1a5c03172a31006074967571a3'/>
<id>830ddc74c495ac1a5c03172a31006074967571a3</id>
<content type='text'>
This reverts commit 78de01198b047347abc5e458851bb12c48429e24.</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This reverts commit 78de01198b047347abc5e458851bb12c48429e24.</pre>
</div>
</content>
</entry>
<entry>
<title>bpo-35603: Escape table header of make_table output that can cause potential XSS. (GH-11341)</title>
<updated>2018-12-29T08:53:14+00:00</updated>
<author>
<name>Xtreak</name>
<email>tir.karthi@gmail.com</email>
</author>
<published>2018-12-29T08:53:14+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/cpython-git.git/commit/?id=78de01198b047347abc5e458851bb12c48429e24'/>
<id>78de01198b047347abc5e458851bb12c48429e24</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>bpo-33224: PEP 479 fix for difflib.mdiff() (GH-6381)</title>
<updated>2018-04-05T18:19:57+00:00</updated>
<author>
<name>Raymond Hettinger</name>
<email>rhettinger@users.noreply.github.com</email>
</author>
<published>2018-04-05T18:19:57+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/cpython-git.git/commit/?id=01b731fc2b04744a11e32f93aba8bfb9ddb3dd29'/>
<id>01b731fc2b04744a11e32f93aba8bfb9ddb3dd29</id>
<content type='text'>

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>

</pre>
</div>
</content>
</entry>
<entry>
<title>bpo-32981: Fix catastrophic backtracking vulns (#5955)</title>
<updated>2018-03-04T05:33:32+00:00</updated>
<author>
<name>Jamie Davis</name>
<email>davisjam@vt.edu</email>
</author>
<published>2018-03-04T05:33:32+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/cpython-git.git/commit/?id=0e6c8ee2358a2e23117501826c008842acb835ac'/>
<id>0e6c8ee2358a2e23117501826c008842acb835ac</id>
<content type='text'>
* Prevent low-grade poplib REDOS (CVE-2018-1060)

The regex to test a mail server's timestamp is susceptible to
catastrophic backtracking on long evil responses from the server.

Happily, the maximum length of malicious inputs is 2K thanks
to a limit introduced in the fix for CVE-2013-1752.

A 2KB evil response from the mail server would result in small slowdowns
(milliseconds vs. microseconds) accumulated over many apop calls.
This is a potential DOS vector via accumulated slowdowns.

Replace it with a similar non-vulnerable regex.

The new regex is RFC compliant.
The old regex was non-compliant in edge cases.

* Prevent difflib REDOS (CVE-2018-1061)

The default regex for IS_LINE_JUNK is susceptible to
catastrophic backtracking.
This is a potential DOS vector.

Replace it with an equivalent non-vulnerable regex.

Also introduce unit and REDOS tests for difflib.

Co-authored-by: Tim Peters &lt;tim.peters@gmail.com&gt;
Co-authored-by: Christian Heimes &lt;christian@python.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
* Prevent low-grade poplib REDOS (CVE-2018-1060)

The regex to test a mail server's timestamp is susceptible to
catastrophic backtracking on long evil responses from the server.

Happily, the maximum length of malicious inputs is 2K thanks
to a limit introduced in the fix for CVE-2013-1752.

A 2KB evil response from the mail server would result in small slowdowns
(milliseconds vs. microseconds) accumulated over many apop calls.
This is a potential DOS vector via accumulated slowdowns.

Replace it with a similar non-vulnerable regex.

The new regex is RFC compliant.
The old regex was non-compliant in edge cases.

* Prevent difflib REDOS (CVE-2018-1061)

The default regex for IS_LINE_JUNK is susceptible to
catastrophic backtracking.
This is a potential DOS vector.

Replace it with an equivalent non-vulnerable regex.

Also introduce unit and REDOS tests for difflib.

Co-authored-by: Tim Peters &lt;tim.peters@gmail.com&gt;
Co-authored-by: Christian Heimes &lt;christian@python.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>bpo-29762: More use "raise from None". (#569)</title>
<updated>2017-04-05T06:37:24+00:00</updated>
<author>
<name>Serhiy Storchaka</name>
<email>storchaka@gmail.com</email>
</author>
<published>2017-04-05T06:37:24+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/cpython-git.git/commit/?id=5affd23e6f42125998724787025080a24839266e'/>
<id>5affd23e6f42125998724787025080a24839266e</id>
<content type='text'>
This hides unwanted implementation details from tracebacks.</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This hides unwanted implementation details from tracebacks.</pre>
</div>
</content>
</entry>
<entry>
<title>#27364: fix "incorrect" uses of escape character in the stdlib.</title>
<updated>2016-09-08T17:59:53+00:00</updated>
<author>
<name>R David Murray</name>
<email>rdmurray@bitdance.com</email>
</author>
<published>2016-09-08T17:59:53+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/cpython-git.git/commit/?id=44b548dda872c0d4f30afd6b44fd74b053a55ad8'/>
<id>44b548dda872c0d4f30afd6b44fd74b053a55ad8</id>
<content type='text'>
And most of the tools.

Patch by Emanual Barry, reviewed by me, Serhiy Storchaka, and
Martin Panter.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
And most of the tools.

Patch by Emanual Barry, reviewed by me, Serhiy Storchaka, and
Martin Panter.
</pre>
</div>
</content>
</entry>
<entry>
<title>Issue #25523: Merge "a" to "an" fixes from 3.4 into 3.5</title>
<updated>2015-11-02T04:04:57+00:00</updated>
<author>
<name>Martin Panter</name>
<email>vadmium+py@gmail.com</email>
</author>
<published>2015-11-02T04:04:57+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/cpython-git.git/commit/?id=2eb819f7a82c7eb61f2d253894d9973f0ec21df2'/>
<id>2eb819f7a82c7eb61f2d253894d9973f0ec21df2</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Issue #25523: Correct "a" article to "an" article</title>
<updated>2015-11-02T03:37:02+00:00</updated>
<author>
<name>Martin Panter</name>
<email>vadmium+py@gmail.com</email>
</author>
<published>2015-11-02T03:37:02+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/cpython-git.git/commit/?id=7462b64911f1e2df2de2285ddbf8b156b5cdc418'/>
<id>7462b64911f1e2df2de2285ddbf8b156b5cdc418</id>
<content type='text'>
This changes the main documentation, doc strings, source code comments, and a
couple error messages in the test suite. In some cases the word was removed
or edited some other way to fix the grammar.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This changes the main documentation, doc strings, source code comments, and a
couple error messages in the test suite. In some cases the word was removed
or edited some other way to fix the grammar.
</pre>
</div>
</content>
</entry>
<entry>
<title>Issue 24237: Raise PendingDeprecationWarning per PEP 479</title>
<updated>2015-05-22T15:16:47+00:00</updated>
<author>
<name>Yury Selivanov</name>
<email>yselivanov@sprymix.com</email>
</author>
<published>2015-05-22T15:16:47+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/cpython-git.git/commit/?id=683333955a05a31da5f0b2ca1b3bffb9962fb4b2'/>
<id>683333955a05a31da5f0b2ca1b3bffb9962fb4b2</id>
<content type='text'>
Raise PendingDeprecationWarning when generator raises StopIteration
and no __future__ import is used.  Fix offenders in the stdlib
and tests.

See also issue 22906.
Thanks to Nick Coghlan and Berker Peksag for reviews.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Raise PendingDeprecationWarning when generator raises StopIteration
and no __future__ import is used.  Fix offenders in the stdlib
and tests.

See also issue 22906.
Thanks to Nick Coghlan and Berker Peksag for reviews.
</pre>
</div>
</content>
</entry>
<entry>
<title>PEP 479: Change StopIteration handling inside generators.</title>
<updated>2015-05-09T15:44:30+00:00</updated>
<author>
<name>Yury Selivanov</name>
<email>yselivanov@sprymix.com</email>
</author>
<published>2015-05-09T15:44:30+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/cpython-git.git/commit/?id=8170e8c0d12cb9414f3a3d3ca81a447b4afc5f26'/>
<id>8170e8c0d12cb9414f3a3d3ca81a447b4afc5f26</id>
<content type='text'>
Closes issue #22906.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Closes issue #22906.
</pre>
</div>
</content>
</entry>
</feed>
