[issue4701] range objects becomes hashable after attribute access

2008-12-29 Thread Nick Coghlan
Nick Coghlan added the comment: Forward port to 3.x: 3.1: r68058 3.0: r68060 -- resolution: -> fixed status: open -> closed ___ Python tracker ___ _

[issue4750] tarfile keeps excessive dir structure in compressed files

2008-12-29 Thread anatoly techtonik
anatoly techtonik added the comment: I attach for Python 2.5 as well. People will use gzip module for a long time to build packages and patch will help them to get correct archives. Added file: http://bugs.python.org/file12490/python25.issue4750.diff ___ Pyt

[issue4777] nntplib - python 2.5

2008-12-29 Thread Chris Morrow
New submission from Chris Morrow : nntplib.py on python2.5 is not IPv6 ready. The below patch at least makes connections on both ipv4 and ipv6 to servers. This was taken out of bug: http://bugs.python.org/issue1664 if that helps... platform: Linux hostnamehere 2.6.26.6-79.fc9.i686 #1 SMP Fri

[issue1664] nntplib is not IPv6-capable

2008-12-29 Thread Chris Morrow
Chris Morrow added the comment: a possible fix for 2.5 is: morr...@tweezer:/tmp$ diff -U3 nntplib.py.orig nntplib.py --- nntplib.py.orig 2008-12-30 01:06:14.0 -0500 +++ nntplib.py 2008-12-30 01:07:33.0 -0500 @@ -109,8 +109,19 @@ """ self.host = host

[issue1664] nntplib is not IPv6-capable

2008-12-29 Thread Chris Morrow
Chris Morrow added the comment: oy, and I'm not reading emails properly. I'll try the fix you propose for 2.5. ___ Python tracker ___ ___ Pyth

[issue1664] nntplib is not IPv6-capable

2008-12-29 Thread Chris Morrow
Chris Morrow added the comment: oh crap :( I saw the 2.6 AFTER I posted the message :( sorry. grr, have to find a fix for 2.5 I suppose now. Thanks. ___ Python tracker ___ _

[issue1664] nntplib is not IPv6-capable

2008-12-29 Thread Derek Morr
Derek Morr added the comment: Yes. The patch is against 2.6. It uses the socket.create_connection() helper function, which was added in 2.6. See http://svn.python.org/view? rev=54546&view=rev for the commit message. If you really want to apply it to 2.5, it's trivial to adapt the patch. Just

[issue1664] nntplib is not IPv6-capable

2008-12-29 Thread Chris Morrow
Chris Morrow added the comment: This patch doesn't appear to work for python2.5.1 -> Python 2.5.1 (r251:54863, Jun 15 2008, 18:24:51) [GCC 4.3.0 20080428 (Red Hat 4.3.0-8)] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> from nntplib import NNTP >>> conn =

[issue4643] cgitb.html fails if getattr call raises exception

2008-12-29 Thread Gabriel Genellina
Gabriel Genellina added the comment: I believe a patch against the trunk would be enough, but should include a test case. ___ Python tracker ___ _

[issue4776] distutils documentation

2008-12-29 Thread steve21
New submission from steve21 : 'data_files' and 'package_dir' are arguments for distutils.core.setup that some packages use in their setup.py. However, the manual entry for distutils.core. setup, at http://docs.python.org/dev/3.0/distutils/apiref.html#module-distutils.core does not document these

[issue4096] Lib/lib2to3/*.pickle are shipped / modified in the build

2008-12-29 Thread Benjamin Peterson
Benjamin Peterson added the comment: Shall we close this as "works for me"? The files aren't included in Subversion and are built when 2to3 is used, so I don't see the problem. -- nosy: +benjamin.peterson ___ Python tracker

[issue4760] cmp gone---What's new in 3.1

2008-12-29 Thread Guilherme Polo
Guilherme Polo added the comment: Uhm ? The builtin cmp wasn't removed. -- nosy: +gpolo ___ Python tracker ___ ___ Python-bugs-list ma

[issue3833] python-2.6b3.msi and python-2.6b3.amd64.msi can't both be installed on one machine

2008-12-29 Thread Guilherme Polo
Guilherme Polo added the comment: Jimmy Retzlaff (msg73003): I'm seeing the same symptoms that are described in issue 1543 with the 2.6b3 MSIs. Namely, when you run one of the MSIs (either 32-bit or 64-bit) then the other will refuse to install. This is on XP Pro x64 SP2. python-3.0b3.msi and

[issue3833] python-2.6b3.msi and python-2.6b3.amd64.msi can't both be installed on one machine

2008-12-29 Thread Guilherme Polo
Changes by Guilherme Polo : ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python

[issue3883] Bottom buttons of IDLE Preferences Pane on Mac not wide enough for their text.

2008-12-29 Thread Kevin Walzer
Kevin Walzer added the comment: The attached patch to configDialog.py fixes this problem--all that was needed was to remove the internal padding in the buttons. -- keywords: +patch nosy: +wordtech type: -> behavior Added file: http://bugs.python.org/file12488/configDialog.patch _

[issue4775] Incorrect documentation - UTC time

2008-12-29 Thread David Morley
New submission from David Morley : There is a systemic error in the Python documentation on time (such as ). The term UTC is used incorrectly in the documentation where the term UT1 should be used. The difference is that UTC includes leap seconds, wher

[issue4701] range objects becomes hashable after attribute access

2008-12-29 Thread Nick Coghlan
Nick Coghlan added the comment: Fixed using a lazy call to PyType_Ready in PyObject_Hash: 2.7: r68051 2.6: r68052 Forward-port to Py3k still to come. ___ Python tracker ___

[issue4774] threding, bsddb and double free or corruption (fasttop)

2008-12-29 Thread Jesús Cea Avión
Jesús Cea Avión added the comment: Alain, you are seeing a resource exhaustion problem. Somewhere memory is leaking. That is, the programs are leaking memory. bsddb was vastly improved in python 2.6. In particular, memory leaks and resource tree deallocations. Can you consider use that version?

[issue3023] Problem with invalidly-encoded command-line arguments (Unix)

2008-12-29 Thread dedded
Changes by dedded : -- nosy: +dedded ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mail

[issue4774] threding, bsddb and double free or corruption (fasttop)

2008-12-29 Thread Benjamin Peterson
Changes by Benjamin Peterson : -- assignee: -> jcea nosy: +jcea ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue4774] threding, bsddb and double free or corruption (fasttop)

2008-12-29 Thread Alain Spineux
New submission from Alain Spineux : This is a test script, to help me to understand why I have unexpected result in application. But I got a more unexpected result, and probably wrong error message about the read-only cursor. The full script is at the end. I got this only one ! I restart the scr

[issue4750] tarfile keeps excessive dir structure in compressed files

2008-12-29 Thread anatoly techtonik
anatoly techtonik added the comment: I attach patch for Python 2.6 gzip I clarified the meaning of self.name to be the basename corresponding to FNAME field in GZIP file header. There is a trace of deprecated gzip.filename API - I haven't found any references to it in documentation, so I remove

[issue4646] distutils chokes on empty options arg in the setup function

2008-12-29 Thread Tarek Ziadé
Tarek Ziadé added the comment: applied with a test in r68033, thanks for the patch ! -- status: open -> closed ___ Python tracker ___

[issue4773] HTTPMessage not documented and has inconsistent API across 2.6/3.0

2008-12-29 Thread David M. Beazley
David M. Beazley added the comment: Verified that 2to3 does not fix this. ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue4755] Common path prefix

2008-12-29 Thread Jeff Hall
Changes by Jeff Hall : -- nosy: +laxrulz777 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.o

[issue4646] distutils chokes on empty options arg in the setup function

2008-12-29 Thread Tarek Ziadé
Changes by Tarek Ziadé : -- assignee: -> tarek nosy: +tarek priority: -> low resolution: -> accepted ___ Python tracker ___ ___ Pyth

[issue4400] pypirc default is not at the right format

2008-12-29 Thread Benjamin Peterson
Changes by Benjamin Peterson : -- status: open -> closed ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: http://

[issue4400] pypirc default is not at the right format

2008-12-29 Thread Benjamin Peterson
Benjamin Peterson added the comment: On Mon, Dec 29, 2008 at 3:51 PM, Martin v. Löwis wrote: > > Martin v. Löwis added the comment: > > Assigning to Benjamin, since he merged the change to 3k. > > For the record, the revisions are these: r67926, r67944, r67948 And now r68031. ___

[issue4400] pypirc default is not at the right format

2008-12-29 Thread Martin v. Löwis
Martin v. Löwis added the comment: Assigning to Benjamin, since he merged the change to 3k. For the record, the revisions are these: r67926, r67944, r67948 -- assignee: tarek -> benjamin.peterson nosy: +benjamin.peterson, loewis priority: -> release blocker __

[issue4673] Distutils should provide an uninstall command

2008-12-29 Thread Tarek Ziadé
Tarek Ziadé added the comment: This would require a detailed description on how such a feature would work. -- nosy: +tarek ___ Python tracker ___

[issue4400] pypirc default is not at the right format

2008-12-29 Thread Tarek Ziadé
Tarek Ziadé added the comment: I am not sure what is the best way to merge it from 3k branch to release30-maint since the original change was done with an automatic merge from trunk to 3k branch with several other changes, then a slight fix so the 2.x code works under 3.x. Should I do a manual

[issue4773] HTTPMessage not documented and has inconsistent API across 2.6/3.0

2008-12-29 Thread David M. Beazley
New submission from David M. Beazley : A file-like object u returned by the urlopen() function in both Python 2.6/3.0 has a method info() that returns a 'HTTPMessage' object. For example: ::: Python 2.6 >>> from urllib2 import urlopen >>> u = urlopen("http://www.python.org";) >>> u.info() >>

[issue4400] pypirc default is not at the right format

2008-12-29 Thread Tarek Ziadé
Tarek Ziadé added the comment: Yes, I was waiting to merge it to release30-maint then close it. I'll do it then close it. ___ Python tracker ___ _

[issue4771] Bad examples in hashlib documentation

2008-12-29 Thread Benjamin Peterson
Benjamin Peterson added the comment: Fixed in r68027. -- resolution: -> fixed status: open -> closed ___ Python tracker ___ ___ Pytho

[issue4772] undesired switch fall-through in socketmodule.c

2008-12-29 Thread dontbugme
New submission from dontbugme : makesockaddr() in socketmodule.c will fall through from AF_BLUETOOTH to AF_PACKET if none of Bluetooth protocols match. That's not a very appropriate thing to do. -- messages: 78483 nosy: dontbugme severity: normal status: open title: undesired switch fall

[issue4771] Bad examples in hashlib documentation

2008-12-29 Thread David M. Beazley
David M. Beazley added the comment: The digest() method of hashes does produce bytes (correct). The hexdigest() method produces a string, but it is also shown as producing bytes in the examples. ___ Python tracker _

[issue4771] Bad examples in hashlib documentation

2008-12-29 Thread Benjamin Peterson
Benjamin Peterson added the comment: Shouldn't hash algorithms give bytes results anyway? -- components: +Library (Lib) -Documentation nosy: +benjamin.peterson priority: -> release blocker ___ Python tracker _

[issue4771] Bad examples in hashlib documentation

2008-12-29 Thread David M. Beazley
New submission from David M. Beazley : The hashlib documentation has incorrect examples showing the use of the hexdigest() method: >>> hashlib.sha224(b"Nobody inspects the spammish repetition").hexdigest() b'a4337bc45a8fc544c03f52dc550cd6e1e87021bc896588bd79e901e2' >>> and this one >>> h = h

[issue4008] IDLE: checksyntax() doesn't support Unicode?

2008-12-29 Thread Martin v. Löwis
Martin v. Löwis added the comment: Here is a new patch that fixes this issue, and the duplicate issues (#4410, and #4623). It doesn't try to eliminate code duplication, but fixes coding_spec by decoding always to Latin-1 first until the coding is known. It fixes check_syntax by opening the sour

[issue4410] IDLE string problem in Run/Run Module

2008-12-29 Thread Martin v. Löwis
Martin v. Löwis added the comment: This is a duplicate of issue 4008 -- nosy: +loewis resolution: -> duplicate status: open -> closed superseder: -> IDLE: checksyntax() doesn't support Unicode? ___ Python tracker

[issue4623] IDLE shutdown if I run an edited file contains chinese

2008-12-29 Thread Martin v. Löwis
Martin v. Löwis added the comment: This is a duplicate of issue 4008. -- nosy: +loewis resolution: -> duplicate status: open -> closed superseder: -> IDLE: checksyntax() doesn't support Unicode? ___ Python tracker

[issue4049] IDLE does not open too

2008-12-29 Thread Martin v. Löwis
Martin v. Löwis added the comment: Since there was no feedback from the OP, I'm closing this as "works for me". -- resolution: -> works for me status: open -> closed ___ Python tracker

[issue4770] binascii module, crazy error messages, unexpected behavior

2008-12-29 Thread David M. Beazley
David M. Beazley added the comment: Given the low-level nature of this module, I can understand the motivation to make it all bytes. However, I'm going to respectfully disagree with that and claim that making binascii all bytes really goes against the whole spirit of what Python 3.0 has trie

[issue4323] Wrong encoding in files saved from IDLE (3.0rc2 on Windows)

2008-12-29 Thread Martin v. Löwis
Martin v. Löwis added the comment: Thanks for the review. Committed (with the proposed change) as r68022 and r68023. -- resolution: -> fixed status: open -> closed ___ Python tracker __

[issue4770] binascii module, crazy error messages, unexpected behavior

2008-12-29 Thread Amaury Forgeot d'Arc
Amaury Forgeot d'Arc added the comment: Item 1 was most probably fixed recently with r67929. Concerning item 2, I think it was decided that binascii is a bytes-only module. I suggest to close this issue as "out of date". -- nosy: +amaury.forgeotdarc ___

[issue1040026] os.times() is bogus

2008-12-29 Thread Martin v. Löwis
Martin v. Löwis added the comment: Malte, thanks again for the patch; committed into the various branches as r68018, r68019, r68020, r68021. As annunciated, I reject the test; I don't think there is a reasonable way to test for this bug. -- status: open -> closed _

[issue4400] pypirc default is not at the right format

2008-12-29 Thread Amaury Forgeot d'Arc
Amaury Forgeot d'Arc added the comment: The patch was applied in trunk, release26-maint and py3k. Can this issue be closed, or do you plan to merge it into release30-maint? -- nosy: +amaury.forgeotdarc ___ Python tracker

[issue4770] binascii module, crazy error messages, unexpected behavior

2008-12-29 Thread David M. Beazley
New submission from David M. Beazley : See Issue 4869 for a related bug. Most of the functions in binascii are meant to go from binary data to textual representations (hex digits, base64, binhex, etc.). There are numerous problems: 1. Misleading error messages. For example: >>> binascii.b

[issue4764] open('existing_dir') -> IOError instance's attr filename is None

2008-12-29 Thread Benjamin Peterson
Benjamin Peterson added the comment: Fixed in r68014 and r68016. -- nosy: +benjamin.peterson resolution: -> fixed status: open -> closed ___ Python tracker ___ _

[issue4769] b64decode should accept strings or bytes

2008-12-29 Thread David M. Beazley
David M. Beazley added the comment: Note: This problem applies to all of the other decoders/encoders in the base64 too (b16, b32, etc.) ___ Python tracker ___ ___

[issue1034053] unittest.py patch: add skipped test functionality

2008-12-29 Thread Benjamin Peterson
Benjamin Peterson added the comment: I think this is a good improvement, and I hope it can make it into 2.7/3.1. Several comments on patch: - I don't like the name "SkipException" SkipTest is better IMO. - TestResult.addSkipped should be changed to TestResult.addSkip. - I'm not sure why Test

[issue4769] b64decode should accept strings or bytes

2008-12-29 Thread David M. Beazley
New submission from David M. Beazley : The whole point of base64 encoding is to safely encode binary data into text characters. Thus, the base64.b64decode() function should equally accept text strings or binary strings as input. For example, there is a reasonable expectation that something li

[issue4768] email.generator.Generator object bytes/str crash - b64encode() bug?

2008-12-29 Thread Benjamin Peterson
Changes by Benjamin Peterson : -- assignee: -> barry nosy: +barry ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe

[issue4580] slicing of memoryviews when itemsize != 1 is wrong

2008-12-29 Thread Antoine Pitrou
Antoine Pitrou added the comment: Nick, sorry for waving at you again, but do you have time for a review? Otherwise, is it ok if I commit the patch as is? (it solves the problems and there's no API or feature change anyway) ___ Python tracker

[issue4768] email.generator.Generator object bytes/str crash - b64encode() bug?

2008-12-29 Thread David M. Beazley
New submission from David M. Beazley : The email.generator.Generator class does not work correctly message objects created with binary data (MIMEImage, MIMEAudio, MIMEApplication, etc.). For example: >>> from email.mime.image import MIMEImage >>> data = open("IMG.jpg","rb").read() >>> m = MIM

[issue3432] Mac, 2.6 framework install error

2008-12-29 Thread Alan Brooks
Alan Brooks added the comment: I also get this exact same problem. Mac OS 10.5.6 on an Intel MacBook trying to install the release version of 2.6.1. I found it was failing to build _Res, but worked around by *not* using --enable-universalsdk. -- nosy: +lanny _

[issue3767] tkColorChooser may fail if no color is selected

2008-12-29 Thread Martin v. Löwis
Martin v. Löwis added the comment: Committed into various branches as r68010, r68011, r68012, and r68013 -- status: open -> closed ___ Python tracker ___

[issue3248] ScrolledText can't be placed in a PanedWindow

2008-12-29 Thread Guilherme Polo
Guilherme Polo added the comment: On Mon, Dec 29, 2008 at 2:02 PM, Martin v. Löwis wrote: > > Martin v. Löwis added the comment: > > Notice that the example function doesn't actually work; it gives > > _tkinter.TclError: wrong # args: should be ".148002724.148002500 insert > index chars ?tagLi

[issue3248] ScrolledText can't be placed in a PanedWindow

2008-12-29 Thread Martin v. Löwis
Changes by Martin v. Löwis : -- resolution: -> accepted status: open -> closed ___ Python tracker ___ ___ Python-bugs-list mailing lis

[issue3248] ScrolledText can't be placed in a PanedWindow

2008-12-29 Thread Martin v. Löwis
Martin v. Löwis added the comment: Thanks again for the patch. Merged into recent branches as r68006, r68007, r68008, and r68009 ___ Python tracker ___ ___

[issue3248] ScrolledText can't be placed in a PanedWindow

2008-12-29 Thread Martin v. Löwis
Martin v. Löwis added the comment: Notice that the example function doesn't actually work; it gives _tkinter.TclError: wrong # args: should be ".148002724.148002500 insert index chars ?tagList chars tagList ...?" ___ Python tracker

[issue4767] email.mime incorrectly documented (or implemented)

2008-12-29 Thread David M. Beazley
New submission from David M. Beazley : The documentation describes classes such as email.mime.MIMEText() email.mime.MIMEMultipart() email.mime.MIMEApplication() etc... However, it's confusing because none of these classes are actually found in email.mime. Suggest either using the full proper

[issue4643] cgitb.html fails if getattr call raises exception

2008-12-29 Thread Allan Crooks
Allan Crooks added the comment: In the interests of getting this fixed (and not letting it die), should I submit a proper patch? I suppose I would have to do one for each version of Python that is affected (which is all of them, really). ___ Python tracker <

[issue4766] email documentation needs to be precise about strings/bytes

2008-12-29 Thread Georg Brandl
Changes by Georg Brandl : -- assignee: georg.brandl -> barry nosy: +barry ___ Python tracker ___ ___ Python-bugs-list mailing list Unsu

[issue4766] email documentation needs to be precise about strings/bytes

2008-12-29 Thread David M. Beazley
New submission from David M. Beazley : Documentation for the email package needs to be more clear about the usage of strings and bytes. In particular: 1. All operations that parse email messages such as message_from_file() or message_from_string() operate on *text*, not binary data. So,

[issue4746] Misguiding wording 3.0 c-api reference

2008-12-29 Thread Georg Brandl
Georg Brandl added the comment: I don't see a reason to keep this open any longer. -- resolution: -> works for me status: open -> closed ___ Python tracker ___ _

[issue4746] Misguiding wording 3.0 c-api reference

2008-12-29 Thread Martin v. Löwis
Martin v. Löwis added the comment: > Whenever the documentation says "you must not" it really says "don't do > that or your application *will* crash, burn and die"... Of course I can > allocate storage for the string, copy it's content and then free or - > nothing will happen. How would it cause

[issue4746] Misguiding wording 3.0 c-api reference

2008-12-29 Thread Antoine Pitrou
Antoine Pitrou added the comment: For me, when I read "You must not provide storage for the string itself", it obviously means I mustn't do so *before calling the PyArg_ParseTuple function*. It is also obvious that I am allowed to copy the returned contents wherever I want, and it should be obvi

[issue4746] Misguiding wording 3.0 c-api reference

2008-12-29 Thread ebfe
ebfe added the comment: Whenever the documentation says "you must not" it really says "don't do that or your application *will* crash, burn and die"... Of course I can allocate storage for the string, copy it's content and then free or - nothing will happen. How would it cause a crash - it's my

[issue4489] shutil.rmtree is vulnerable to a symlink attack

2008-12-29 Thread Antoine Pitrou
Antoine Pitrou added the comment: FWIW, I've opened a separate bug entry for the creation of the openat(), etc. wrappers: #4761. Those functions seem to exist on recent Linux distros (even Debian stable). ___ Python tracker

[issue4732] Object allocation stress leads to segfault on RHEL

2008-12-29 Thread Antoine Pitrou
Antoine Pitrou added the comment: I think you should report the bug to Redhat and see what they have to say about it. It may be a bug in the libc of that particular version. In any case I think it is highly inlikely to be a bug in Python itself. ___ Python tr

[issue4750] tarfile keeps excessive dir structure in compressed files

2008-12-29 Thread anatoly techtonik
anatoly techtonik added the comment: For MSYS gzip added a bugreport here: https://sourceforge.net/tracker2/index.php?func=detail&aid=2474481&group_id=2435&atid=102435 ___ Python tracker

[issue4489] shutil.rmtree is vulnerable to a symlink attack

2008-12-29 Thread Antoine Pitrou
Antoine Pitrou added the comment: > Antoine, what if we add another function, rmtree_safe() that uses > chdir() and document that it is protected from the race condition but > may have the side effect of changing the current dir in threaded > environment? I don't have any strong opinion on it,

[issue4489] shutil.rmtree is vulnerable to a symlink attack

2008-12-29 Thread Mart Sõmermaa
Mart Sõmermaa added the comment: Replying to previous comment: > There's no way to do the "check inode then remove" sequence atomically. Right, although the attack window would be tiny, this is not a real solution. ___ Python tracker

[issue4489] shutil.rmtree is vulnerable to a symlink attack

2008-12-29 Thread Mart Sõmermaa
Mart Sõmermaa added the comment: Antoine, what if we add another function, rmtree_safe() that uses chdir() and document that it is protected from the race condition but may have the side effect of changing the current dir in threaded environment? ___ Python t

[issue4489] shutil.rmtree is vulnerable to a symlink attack

2008-12-29 Thread Mart Sõmermaa
Mart Sõmermaa added the comment: Fixed a minor bug in test script and added Perl test as well. Perl with File-Path-2.07 passes the test. Added file: http://bugs.python.org/file12485/test_issue4489.sh ___ Python tracker __

[issue4489] shutil.rmtree is vulnerable to a symlink attack

2008-12-29 Thread Mart Sõmermaa
Changes by Mart Sõmermaa : Removed file: http://bugs.python.org/file12483/test_issue4489.sh ___ Python tracker ___ ___ Python-bugs-list mailing

[issue4489] shutil.rmtree is vulnerable to a symlink attack

2008-12-29 Thread Antoine Pitrou
Antoine Pitrou added the comment: > A blunt, ineffective solution would be to walk the tree before removing > it and recording path : inode pairs in a dict on first pass and then > checking that the inodes have not changed during removal on second pass. There's no way to do the "check inode the

[issue3644] ``make htmlview`` for docs fails on OS X

2008-12-29 Thread Georg Brandl
Changes by Georg Brandl : -- resolution: -> works for me status: open -> closed ___ Python tracker ___ ___ Python-bugs-list mailing li

[issue3671] What's New in 2.6 - corrections

2008-12-29 Thread Georg Brandl
Changes by Georg Brandl : -- resolution: -> fixed status: open -> closed ___ Python tracker ___ ___ Python-bugs-list mailing list Unsu

[issue4489] shutil.rmtree is vulnerable to a symlink attack

2008-12-29 Thread Mart Sõmermaa
Mart Sõmermaa added the comment: A blunt, ineffective solution would be to walk the tree before removing it and recording path : inode pairs in a dict on first pass and then checking that the inodes have not changed during removal on second pass. If no clever bulletproof fix emerges, perhaps th

[issue4489] shutil.rmtree is vulnerable to a symlink attack

2008-12-29 Thread Mart Sõmermaa
Mart Sõmermaa added the comment: Aha, got it -- while removing /a/b/c/d, there's no easy way to detect that b or c has become a symlink. I.e. given directory tree a `-- b |-- c `-- d 1. os.rmdir('/a/b/c') succeeds 2. execution is suspended 3. '/a/b' is made a symlink to a path that c

[issue4489] shutil.rmtree is vulnerable to a symlink attack

2008-12-29 Thread Mart Sõmermaa
Mart Sõmermaa added the comment: And here's the diff so you can review what I was up to. Note that this does not yet fix the problem (although the logic looks about right), I have to examine the problem more thoroughly. -- keywords: +patch Added file: http://bugs.python.org/file12484/i

[issue4489] shutil.rmtree is vulnerable to a symlink attack

2008-12-29 Thread Mart Sõmermaa
Changes by Mart Sõmermaa : Added file: http://bugs.python.org/file12483/test_issue4489.sh ___ Python tracker ___ ___ Python-bugs-list mailing l

[issue4489] shutil.rmtree is vulnerable to a symlink attack

2008-12-29 Thread Mart Sõmermaa
Mart Sõmermaa added the comment: Ah, right you are. Attaching an initial alpha-quality patched shutil.py and a script to test the attack. Run the script by sourcing it with . test_issue4489.sh, not by executing (job control won't work in this case). Added file: http://bugs.python.org/file12482