bpo-43285: Make ftplib not trust the PASV response.
The IPv4 address value returned from the server in response to the PASV command
should not be trusted. This prevents a malicious FTP server from using the
response to probe IPv4 address and port combinations on the client network.
Instead of using the returned address, we use the IP address we're
already connected to. This is the strategy other ftp clients adopted,
and matches the only strategy available for the modern IPv6 EPSV command
where the server response must return a port number and nothing else.
For the rare user who _wants_ this ugly behavior, set a `trust_server_pasv_ipv4_address`
attribute on your `ftplib.FTP` instance to True.
(cherry picked from commit 0ab152c6b5)
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Answer "Why is there no goto?" in the Design and History FAQ.
(cherry picked from commit 5e29021a5e)
Co-authored-by: Terry Jan Reedy <tjreedy@udel.edu>
* [3.9] bpo-43439: Wrapt the tuple in the audit events for the gc module (GH-24836).
(cherry picked from commit 9c376bc1c4)
Co-authored-by: Pablo Galindo <Pablogsal@gmail.com>
* Update gcmodule.c
* Update gcmodule.c
* Update gcmodule.c
* Update link to Django's Context class.
* Update link to get-pip.py.
(cherry picked from commit d0a445490e)
Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
* Fix auth_login logic (bpo-27820)
* Also fix a longstanding bug in the SimSMTPChannel.found_terminator() method that causes inability to test
SMTP AUTH with initial_response_ok=False.
(cherry picked from commit 7591d9455e)
Co-authored-by: Pandu E POLUAN <pepoluan@gmail.com>
Check to make sure stdout and stderr are not empty before selecting an item from them in Windows subprocess._communicate.
Co-authored-by: Gregory P. Smith <greg@krypto.org>
(cherry picked from commit b4fc44bb2d)
Co-authored-by: Chris Griffith <chris@cdgriffith.com>
Fix a race condition of test_stress_modifying_handlers() of
test_signal: only raise signals while we are in the
catch_unraisable_exception() context manager.
Moreover, don't check if we received at least one
signal if at least one signal got ignored.
(cherry picked from commit 1fa17e8cc6)
Co-authored-by: Victor Stinner <vstinner@python.org>
Co-authored-by: Victor Stinner <vstinner@python.org>
We now buffer the CONNECT request + tunnel HTTP headers into a single
send call. This prevents the OS from generating multiple network
packets for connection setup when not necessary, improving efficiency.
(cherry picked from commit c25910a135)
Co-authored-by: Gregory P. Smith <greg@krypto.org>
We can receive signals (at the C level, in `trip_signal()` in signalmodule.c) while `signal.signal` is being called to modify the corresponding handler. Later when `PyErr_CheckSignals()` is called to handle the given signal, the handler may be a non-callable object and would raise a cryptic asynchronous exception.
(cherry picked from commit 68245b7a10)
Co-authored-by: Antoine Pitrou <antoine@python.org>
Previous wording implied that only the result of call N and N+1 could be
meaningfully compared, whereas comparing call N and N+M is fine.
(cherry picked from commit ff5f05934d)
Co-authored-by: Alex Willmer <alex@moreati.org.uk>
This reverts commit aca67da4fe.
(cherry picked from commit b5711c940f)
Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>
Automerge-Triggered-By: GH:jaraco
There is an extra `s` in the singular word `method`.
Reported in docs mailing list by Steven Nguyen.
Automerge-Triggered-By: GH:Mariatta
(cherry picked from commit f193874056)
Co-authored-by: Mariatta Wijaya <Mariatta@users.noreply.github.com>
Exit code is now 1 instead of 0. A message is printed to stderr instead of stdout. This is
the proper behaviour for a tool that can be used in scripts.
(cherry picked from commit cc3df6368d)
Co-authored-by: Ruben Vorderman <r.h.p.vorderman@lumc.nl>
The note about the GIL was buried pretty deep in the threading documentation,
and this made it hard for first time users to discover why their attempts
at using threading to parallelizing their application did not work.
In this commit, the note is moved to the top of the module documention for
visibility.
(cherry picked from commit 32181be608)
Co-authored-by: Guanzhong Chen <quantum2048@gmail.com>
Printing to IDLE's Shell is often slower than printing to a system
terminal, but it can be made faster by pre-formatting a single
string before printing.
(cherry picked from commit 2827e8a177)
Co-authored-by: Terry Jan Reedy <tjreedy@udel.edu>
Unittest discovery support namespace package as start
directory. But it doesn't find namespace package in
the start directory automatically.
Otherwise, unittest discovery search into unexpected
directories like `vendor/` or `node_modules/`.
(cherry picked from commit 5a4aa4c03e)
Co-authored-by: Inada Naoki <songofacandy@gmail.com>
When very large data remains in TextIOWrapper, flush() may fail forever.
So prevent that data larger than chunk_size is remained in TextIOWrapper internal
buffer.
Co-Authored-By: Eryk Sun
(cherry picked from commit 01806d5)
In the Running User Code section, gather together paragraphs about two
processes and the sys.stdstream replacements, preparing to add another.
(cherry picked from commit 4cf7bb8e22)
Co-authored-by: Terry Jan Reedy <tjreedy@udel.edu>
Previously, the doc at least strongly implied that it had to be an iterator.
(cherry picked from commit 2f9ef514fb)
Co-authored-by: Terry Jan Reedy <tjreedy@udel.edu>
