3.7 Implement dunder iter method on mock_open bpo-32933 by TonyFlury · Pull Request #5975

3.7 Implement dunder iter method on mock_open bpo-32933 by TonyFlury · Pull Request #5975 · python/cpython

and others added 30 commits

January 30, 2018 19:02

…addr and to_addrs (#5451)

Do not pass the name field in the 'from' address in the SMTP envelope.

When using customized decode error handlers, it is possible for builtin decoders
to write out-of-bounds and then crash.

Mention only ImportError caused by importing sitecustomize.py/usercustomize.py
themselves will be silently ignored.

…H-5464)

The f-string example for using datetime format specifier does not match the given output.
Changed the format from %b to %B so it matches the output of "January".

In the tutorial about the Generator expression, there is an example with
a dict comprehension and not with a generator expression, just removed
the code.

…selection. (GH-3651)

It was deprecated in 3.6.

* bpo-32711: Fix warnings for Python/ast_unparse.c

Clarify that the level argument is used to determine whether to
perform absolute or relative imports: 0 is absolute, while a positive number
is the number of parent directories to search relative to the current module.



This reverts commit 72a0d21.

The reverted commit had a few issues so it was unanimously decided
to undo it. See the bpo issue for details.

…H-5265)

Modify RE examples in documentation to use raw strings to prevent DeprecationWarning.
Add text to REGEX HOWTO to highlight the deprecation.  Approved by Serhiy Storchaka.

Previously the module name was used, which broke relative imports when pdb was run against a plain module or submodule.

Fix typos found by codespell in docs, docstrings, and comments.

…i-language doc (GH-5482)

Changed the definition of width and precision from "integer" to "digit+" in format mini-language doc.

…-5862)

The new code also runs faster.

* Prevent low-grade poplib REDOS (CVE-2018-1060)

The regex to test a mail server's timestamp is susceptible to
catastrophic backtracking on long evil responses from the server.

Happily, the maximum length of malicious inputs is 2K thanks
to a limit introduced in the fix for CVE-2013-1752.

A 2KB evil response from the mail server would result in small slowdowns
(milliseconds vs. microseconds) accumulated over many apop calls.
This is a potential DOS vector via accumulated slowdowns.

Replace it with a similar non-vulnerable regex.

The new regex is RFC compliant.
The old regex was non-compliant in edge cases.

* Prevent difflib REDOS (CVE-2018-1061)

The default regex for IS_LINE_JUNK is susceptible to
catastrophic backtracking.
This is a potential DOS vector.

Replace it with an equivalent non-vulnerable regex.

Also introduce unit and REDOS tests for difflib.

Co-authored-by: Tim Peters <tim.peters@gmail.com>
Co-authored-by: Christian Heimes <christian@python.org>