bpo-38243: Escape the server_title of DocXMLRPCServer when rendering #16373

corona10 · 2019-09-25T04:23:40Z

Escape the server_title of DocXMLRPCServer when rendering,
The title will only be escaped when the server_title should be rendered.

https://bugs.python.org/issue38243

Lib/xmlrpc/server.py

corona10 · 2019-09-26T14:04:09Z

@tirkarthi I've updated the PR, thank you for the feedback.

Lib/test/test_docxmlrpc.py

corona10 · 2019-09-27T08:56:39Z

@tirkarthi I've reflected your comment. Thanks for the review.

Lib/test/test_docxmlrpc.py

Misc/NEWS.d/next/Security/2019-09-25-13-21-09.bpo-38243.1pfz24.rst

corona10 · 2019-09-27T14:38:51Z

@vstinner Updated!

miss-islington · 2019-09-27T19:59:40Z

Thanks @corona10 for the PR, and @vstinner for merging it 🌮🎉.. I'm working now to backport this PR to: 3.6, 3.7, 3.8.
🐍🍒⛏🤖

bedevere-bot · 2019-09-27T20:00:16Z

GH-16439 is a backport of this pull request to the 3.8 branch.

bedevere-bot · 2019-09-27T20:00:26Z

GH-16440 is a backport of this pull request to the 3.7 branch.

miss-islington · 2019-09-27T20:00:34Z

Sorry, @corona10 and @vstinner, I could not cleanly backport this to 3.6 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker e8650a4f8c7fb76f570d4ca9c1fbe44e91c8dfaa 3.6

Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering the document page as HTML. (cherry picked from commit e8650a4) Co-authored-by: Dong-hee Na <donghee.na92@gmail.com>

bedevere-bot · 2019-09-27T20:03:21Z

GH-16441 is a backport of this pull request to the 3.6 branch.

vstinner · 2019-09-27T20:04:43Z

@corona10: I backported manually your change to 3.6. I just had to fix a simple conflict on imports.

Would you mind to try to backport the change to Python 2.7 which also has the bug?

Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering the document page as HTML. (cherry picked from commit e8650a4) Co-authored-by: Dong-hee Na <donghee.na92@gmail.com>

bedevere-bot · 2019-09-27T21:19:43Z

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot PPC64LE Fedora 3.7 has failed when building commit 39a0c75.

What do you need to do:

Don't panic.
Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
Go to the page of the buildbot that failed (https://buildbot.python.org/all/#builders/120/builds/1323) and take a look at the build logs.
Check if the failure is related to this commit (39a0c75) or if it is a false positive.
If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/all/#builders/120/builds/1323

Failed tests:

test_readline
test_os
test_asyncio

Failed subtests:

test_read_pty_output - test.test_asyncio.test_events.EPollEventLoopTests
test_bidirectional_pty - test.test_asyncio.test_events.SelectEventLoopTests
test_write_pty - test.test_asyncio.test_events.SelectEventLoopTests
test_bidirectional_pty - test.test_asyncio.test_events.PollEventLoopTests
test_auto_history_disabled - test.test_readline.TestReadline
test_write_pty - test.test_asyncio.test_events.PollEventLoopTests
test_history_size - test.test_readline.TestReadline
test_read_pty_output - test.test_asyncio.test_events.PollEventLoopTests
test_openpty - test.test_os.FDInheritanceTests
test_bidirectional_pty - test.test_asyncio.test_events.EPollEventLoopTests
test_nonascii - test.test_readline.TestReadline
test_write_pty - test.test_asyncio.test_events.EPollEventLoopTests
test_auto_history_enabled - test.test_readline.TestReadline
test_read_pty_output - test.test_asyncio.test_events.SelectEventLoopTests

Summary of the results of the build (if available):

== Tests result: FAILURE then FAILURE ==

400 tests OK.

10 slowest tests:

test_concurrent_futures: 2 min 35 sec
test_tokenize: 2 min 25 sec
test_multiprocessing_spawn: 2 min 23 sec
test_tools: 2 min 4 sec
test_lib2to3: 1 min 44 sec
test_multiprocessing_forkserver: 1 min 24 sec
test_multiprocessing_fork: 1 min 12 sec
test_io: 1 min 586 ms
test_asyncio: 59 sec 419 ms
test_subprocess: 39 sec 224 ms

3 tests failed:
test_asyncio test_os test_readline

13 tests skipped:
test_devpoll test_ioctl test_kqueue test_msilib test_ossaudiodev
test_startfile test_tix test_tk test_ttk_guionly test_winconsoleio
test_winreg test_winsound test_zipfile64

3 re-run tests:
test_asyncio test_os test_readline

Total duration: 20 min 20 sec

Click to see traceback logs

Traceback (most recent call last):
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/support/__init__.py", line 623, in wrapper
    return func(*args, **kw)
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_asyncio/test_events.py", line 1645, in test_bidirectional_pty
    master, read_slave = os.openpty()
FileNotFoundError: [Errno 2] No such file or directory


Traceback (most recent call last):
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_readline.py", line 149, in test_auto_history_enabled
    output = run_pty(self.auto_history_script.format(True))
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_readline.py", line 285, in run_pty
    [master, slave] = pty.openpty()
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/pty.py", line 29, in openpty
    master_fd, slave_name = _open_terminal()
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/pty.py", line 59, in _open_terminal
    raise OSError('out of pty devices')
OSError: out of pty devices


Traceback (most recent call last):
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_os.py", line 3273, in test_openpty
    master_fd, slave_fd = os.openpty()
FileNotFoundError: [Errno 2] No such file or directory


Traceback (most recent call last):
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_readline.py", line 274, in test_history_size
    run_pty(script, input=b"last input\r", env=env)
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_readline.py", line 285, in run_pty
    [master, slave] = pty.openpty()
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/pty.py", line 29, in openpty
    master_fd, slave_name = _open_terminal()
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/pty.py", line 59, in _open_terminal
    raise OSError('out of pty devices')
OSError: out of pty devices


Traceback (most recent call last):
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_readline.py", line 226, in test_nonascii
    output = run_pty(script, input)
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_readline.py", line 285, in run_pty
    [master, slave] = pty.openpty()
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/pty.py", line 29, in openpty
    master_fd, slave_name = _open_terminal()
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/pty.py", line 59, in _open_terminal
    raise OSError('out of pty devices')
OSError: out of pty devices


Traceback (most recent call last):
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_asyncio/test_events.py", line 1503, in test_read_pty_output
    master, slave = os.openpty()
FileNotFoundError: [Errno 2] No such file or directory


Traceback (most recent call last):
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_readline.py", line 153, in test_auto_history_disabled
    output = run_pty(self.auto_history_script.format(False))
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_readline.py", line 285, in run_pty
    [master, slave] = pty.openpty()
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/pty.py", line 29, in openpty
    master_fd, slave_name = _open_terminal()
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/pty.py", line 59, in _open_terminal
    raise OSError('out of pty devices')
OSError: out of pty devices


Traceback (most recent call last):
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/support/__init__.py", line 623, in wrapper
    return func(*args, **kw)
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_asyncio/test_events.py", line 1601, in test_write_pty
    master, slave = os.openpty()
FileNotFoundError: [Errno 2] No such file or directory

corona10 · 2019-09-27T21:47:19Z

@vstinner Sure!

Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering the document page as HTML. (cherry picked from commit e8650a4)

… (#16516) Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering the document page as HTML. (cherry picked from commit e8650a4)

Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering the document page as HTML.

bpo-38243: Escape the server_title of DocXMLRPCServer when rendering

52f2a59

the-knights-who-say-ni added the CLA signed label Sep 25, 2019

bedevere-bot added the awaiting review label Sep 25, 2019

tirkarthi reviewed Sep 25, 2019

View reviewed changes

Lib/xmlrpc/server.py Show resolved Hide resolved

bpo-38243: Update unittest

10d2f0b

corona10 force-pushed the bpo-38243 branch from b4448fa to 10d2f0b Compare September 26, 2019 13:16

corona10 requested a review from vstinner September 26, 2019 14:05

tirkarthi reviewed Sep 27, 2019

View reviewed changes

Lib/test/test_docxmlrpc.py Outdated Show resolved Hide resolved

bpo-38243: Update unittest

2a992a9

vstinner reviewed Sep 27, 2019

View reviewed changes

Lib/test/test_docxmlrpc.py Outdated Show resolved Hide resolved

Misc/NEWS.d/next/Security/2019-09-25-13-21-09.bpo-38243.1pfz24.rst Outdated Show resolved Hide resolved

bpo-38243: Reflect the vstinner's review

3a8f7a7

vstinner added needs backport to 3.6 labels Sep 27, 2019

vstinner reviewed Sep 27, 2019

View reviewed changes

Misc/NEWS.d/next/Security/2019-09-25-13-21-09.bpo-38243.1pfz24.rst Outdated Show resolved Hide resolved

bpo-38243: Update misc news

2b2093c

vstinner merged commit e8650a4 into python:master Sep 27, 2019

bedevere-bot removed awaiting review needs backport to 3.8 labels Sep 27, 2019

bedevere-bot removed the needs backport to 3.7 label Sep 27, 2019

miss-islington assigned vstinner Sep 27, 2019

bedevere-bot removed the needs backport to 3.6 label Sep 27, 2019

ned-deily pushed a commit that referenced this pull request Sep 28, 2019

bpo-38243, xmlrpc.server: Escape the server_title (GH-16373) (GH-16441)

1698cac

Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering the document page as HTML. (cherry picked from commit e8650a4)

aeros mentioned this pull request Oct 15, 2019

[3.5] bpo-38243, xmlrpc.server: Escape the server_title (GH-16373) (GH-16441) #16516

Merged

jacobneiltaylor pushed a commit to jacobneiltaylor/cpython that referenced this pull request Dec 5, 2019

bpo-38243, xmlrpc.server: Escape the server_title (pythonGH-16373)

0653a0d

Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering the document page as HTML.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

bpo-38243: Escape the server_title of DocXMLRPCServer when rendering #16373

bpo-38243: Escape the server_title of DocXMLRPCServer when rendering #16373

corona10 commented Sep 25, 2019 •

edited

Loading

corona10 commented Sep 26, 2019

corona10 commented Sep 27, 2019

corona10 commented Sep 27, 2019

miss-islington commented Sep 27, 2019

bedevere-bot commented Sep 27, 2019

bedevere-bot commented Sep 27, 2019

miss-islington commented Sep 27, 2019

bedevere-bot commented Sep 27, 2019

vstinner commented Sep 27, 2019

bedevere-bot commented Sep 27, 2019

corona10 commented Sep 27, 2019

bpo-38243: Escape the server_title of DocXMLRPCServer when rendering #16373

bpo-38243: Escape the server_title of DocXMLRPCServer when rendering #16373

Conversation

corona10 commented Sep 25, 2019 • edited Loading

corona10 commented Sep 26, 2019

corona10 commented Sep 27, 2019

corona10 commented Sep 27, 2019

miss-islington commented Sep 27, 2019

bedevere-bot commented Sep 27, 2019

bedevere-bot commented Sep 27, 2019

miss-islington commented Sep 27, 2019

bedevere-bot commented Sep 27, 2019

vstinner commented Sep 27, 2019

bedevere-bot commented Sep 27, 2019

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

corona10 commented Sep 27, 2019

corona10 commented Sep 25, 2019 •

edited

Loading