delta/cpython-git.git/Lib, branch v3.8.5 github.com: python/cpython.git Python 3.8.5 2020-07-20T13:01:32+00:00 Łukasz Langa lukasz@langa.pl 2020-07-20T13:01:32+00:00 580fbb018fd0844806119614d752b41fc69660f9 Contains security fixes for CVE-2019-20907, CVE-2020-15801, and BPO-39603. 
Contains security fixes for CVE-2019-20907, CVE-2020-15801, and BPO-39603.
bpo-37703: improve asyncio.gather documentation regarding cancellation (GH-15312) 2020-07-20T09:00:51+00:00 Miss Islington (bot) 31488909+miss-islington@users.noreply.github.com 2020-07-20T09:00:51+00:00 58f59a962180123a6d29ece512d198b365726b33 These changes updates the doc to comprehensively mention the behaviour of gather.cancel() Automerge-Triggered-By: @asvetlov (cherry picked from commit d42528a3a2c7d79fd2e6c9f2a02f3ce12d44c8cc) Co-authored-by: Vinay Sharma <vinay04sharma@icloud.com> 
These changes updates the doc to comprehensively mention the behaviour of gather.cancel()

Automerge-Triggered-By: @asvetlov
(cherry picked from commit d42528a3a2c7d79fd2e6c9f2a02f3ce12d44c8cc)

Co-authored-by: Vinay Sharma <vinay04sharma@icloud.com>
 bpo-41295: Reimplement the Carlo Verre "hackcheck" (GH-21528) 2020-07-18T21:37:43+00:00 Miss Islington (bot) 31488909+miss-islington@users.noreply.github.com 2020-07-18T21:37:43+00:00 38d930f2ccbff6f93c4c54a7a6a1759266136504 Walk down the MRO backwards to find the type that originally defined the final `tp_setattro`, then make sure we are not jumping over intermediate C-level bases with the Python-level call. Automerge-Triggered-By: @gvanrossum (cherry picked from commit c53b310e5926266ce267c44a168165cacd786d6e) Co-authored-by: scoder <stefan_ml@behnel.de> 
Walk down the MRO backwards to find the type that originally defined the final `tp_setattro`, then make sure we are not jumping over intermediate C-level bases with the Python-level call.

Automerge-Triggered-By: @gvanrossum
(cherry picked from commit c53b310e5926266ce267c44a168165cacd786d6e)

Co-authored-by: scoder <stefan_ml@behnel.de>
 bpo-39603: Prevent header injection in http methods (GH-18485) 2020-07-18T20:39:12+00:00 Miss Islington (bot) 31488909+miss-islington@users.noreply.github.com 2020-07-18T20:39:12+00:00 668d321476d974c4f51476b33aaca870272523bf reject control chars in http method in http.client.putrequest to prevent http header injection (cherry picked from commit 8ca8a2e8fb068863c1138f07e3098478ef8be12e) Co-authored-by: AMIR <31338382+amiremohamadi@users.noreply.github.com> 
reject control chars in http method in http.client.putrequest to prevent http header injection
(cherry picked from commit 8ca8a2e8fb068863c1138f07e3098478ef8be12e)

Co-authored-by: AMIR <31338382+amiremohamadi@users.noreply.github.com>
 [3.8] bpo-41300: IDLE - save files with non-ascii chars (GH-21512) 2020-07-16T22:47:52+00:00 Miss Islington (bot) 31488909+miss-islington@users.noreply.github.com 2020-07-16T22:47:52+00:00 ffeb9202540c07d384f82ff3ab86c37c1433283a Fix regression released in 3.9.0b4 and 3.8.4. (cherry picked from commit 38d3864efe914fda64553e2ec75c9ec15574483f) Co-authored-by: Terry Jan Reedy <tjreedy@udel.edu> 
Fix regression released in 3.9.0b4 and 3.8.4.
(cherry picked from commit 38d3864efe914fda64553e2ec75c9ec15574483f)

Co-authored-by: Terry Jan Reedy <tjreedy@udel.edu>
bpo-41304: Ensure python3x._pth is loaded on Windows (GH-21495) 2020-07-15T22:15:37+00:00 Miss Islington (bot) 31488909+miss-islington@users.noreply.github.com 2020-07-15T22:15:37+00:00 3b6a8d2455c6897085f4277737b0f9b9a3847c24 (cherry picked from commit 936a66094591dc0e67d4a60c170148bb700ec016) Co-authored-by: Steve Dower <steve.dower@python.org> 
(cherry picked from commit 936a66094591dc0e67d4a60c170148bb700ec016)

Co-authored-by: Steve Dower <steve.dower@python.org>
 [3.8] bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (GH-21483) 2020-07-15T12:30:53+00:00 Miss Islington (bot) 31488909+miss-islington@users.noreply.github.com 2020-07-15T12:30:53+00:00 c55479556db015f48fc8bbca17f64d3e65598559 Avoid infinite loop when reading specially crafted TAR files using the tarfile module (CVE-2019-20907). (cherry picked from commit 5a8d121a1f3ef5ad7c105ee378cc79a3eac0c7d4) Co-authored-by: Rishi <rishi_devan@mail.com> Automerge-Triggered-By: @encukou 
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121a1f3ef5ad7c105ee378cc79a3eac0c7d4)


Co-authored-by: Rishi <rishi_devan@mail.com>

Automerge-Triggered-By: @encukou
 Merge tag 'v3.8.4' into 3.8 2020-07-13T20:49:45+00:00 Łukasz Langa lukasz@langa.pl 2020-07-13T20:49:45+00:00 0277b914cacfb270e902536ca54c9e5395c76368 Python 3.8.4 
Python 3.8.4
bpo-41288: Fix a crash in unpickling invalid NEWOBJ_EX. (GH-21458) 2020-07-13T13:05:44+00:00 Miss Islington (bot) 31488909+miss-islington@users.noreply.github.com 2020-07-13T13:05:44+00:00 f56c75ed53dcad4d59dff4377ae463d6b96acd3e Automerge-Triggered-By: @tiran (cherry picked from commit 4f309abf55f0e6f8950ac13d6ec83c22b8d47bf8) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> 
Automerge-Triggered-By: @tiran
(cherry picked from commit 4f309abf55f0e6f8950ac13d6ec83c22b8d47bf8)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
 Python 3.8.4 2020-07-13T12:11:53+00:00 Łukasz Langa lukasz@langa.pl 2020-07-13T12:11:53+00:00 dfa645a65ec0788d98851130a217e029d1cc4e9b