forked from pool/python315
Matěj Cepl
6e06723682
- Tests
- gh-144415: The Android testbed now distinguishes between
stdout/stderr messages which were triggered by a newline,
and those triggered by a manual call to flush. This fixes
logging of progress indicators and similar content.
- gh-65784: Add support for parametrized resource wantobjects
in regrtests, which allows to run Tkinter tests with the
specified value of tkinter.wantobjects, for example -u
wantobjects=0.
- Security
- CVE-2024-6923: BytesGenerator will now refuse to serialize
(write) headers that are unsafely folded or delimited; see
verify_generated_headers. (Contributed by Bas Bloemsaat and
Petr Viktorin in gh-121650). (bsc#1228780, gh-144125)
- CVE-2025-11468: Fixed a bug in the folding of comments when
flattening an email message using a modern email policy.
Comments consisting of a very long sequence of non-foldable
characters could trigger a forced line wrap that omitted
the required leading space on the continuation line,
causing the remainder of the comment to be interpreted as
a new header field. This enabled header injection with
carefully crafted inputs. (bsc#1257029, gh-143935)
- CVE-2025-15282: Reject control characters in data: URL
media types. (bsc#1257046, gh-143925)
- CVE-2025-15367: Reject control characters in POP3 commands.
(bsc#1257041, gh-143923)
- CVE-2025-15366: Reject control characters in IMAP commands.
(bsc#1257044, gh-143921)
- CVE-2026-0672: Reject control characters in
http.cookies.Morsel fields and values. (bsc#1257031,
gh-143919)
- CVE-2026-0865: Reject C0 control characters within
wsgiref.headers.Headers fields, values, and parameters.
(bsc#1257042, gh-143916)
- Library
- gh-144538: Bump the version of pip bundled in ensurepip to
version 26.0.1
- gh-144493: Improve an exception error message in
_overlapped.BindLocal() that is raised when
asyncio.loop.sock_connect() is called on
a asyncio.ProactorEventLoop with a socket that has an
invalid address family.
- gh-144386: Add support for arbitrary descriptors
__enter__(), __exit__(), __aenter__(), and __aexit__() in
contextlib.ExitStack and contextlib.AsyncExitStack, for
consistency with the with and async with statements.
- gh-123471: Make concurrent iteration over
itertools.combinations_with_replacement and
itertools.permutations safe under free-threading.
- gh-74453: Deprecate os.path.commonprefix() in favor of
os.path.commonpath() for path segment prefixes.
- The os.path.commonprefix() function is being deprecated due
to having a misleading name and module. The function is not
safe to use for path prefixes despite being included in
a module about path manipulation, meaning it is easy to
accidentally introduce path traversal vulnerabilities into
Python programs by using this function.
- gh-144380: Improve performance of io.BufferedReader line
iteration by ~49%.
- gh-144363: Update bundled libexpat to 2.7.4
- gh-140824: When faulthandler dumps the list of third-party
extension modules, ignore sub-modules of stdlib packages.
Patch by Victor Stinner.
- gh-144206: Improve error messages for buffer overflow in
fcntl.fcntl() and fcntl.ioctl().
- gh-144264: Speed up Base64 decoding of data containing
ignored characters (both in non-strict mode and with an
explicit ignorechars argument). It is now up to 2 times
faster for multiline Base64 data.
- gh-144249: Add filename context to OSError exceptions
raised by ssl.SSLContext.load_cert_chain(), allowing users
to have more context.
- gh-132888: Fix incorrect use of ctypes.GetLastError() and
add missing error checks for Windows API calls in
_pyrepl.windows_console.
- gh-142956: Updated tomllib to parse TOML 1.1.0.
- gh-144217: mimetypes: Add support for DICOM files (for
medical imaging) with the official MIME type
application/dicom. Patch by Benedikt Johannes.
- gh-144212: Mime type image/jxl is now supported by
mimetypes.
- gh-143594: Add symtable.Function.get_cells() and
symtable.Symbol.is_cell() methods.
- gh-144169: Fix three crashes when non-string keyword
arguments are supplied to objects in the ast module.
- gh-144128: Fix a crash in array.array.fromlist() when an
element’s __index__() method mutates the input list during
conversion.
- gh-144100: Fixed a crash in ctypes when using a deprecated
POINTER(str) type in argtypes. Instead of aborting, ctypes
now raises a proper Python exception when the pointer
target type is unresolved.
- gh-143658: importlib.metadata: Use str.lower() and
str.replace() to further improve performance of
importlib.metadata.Prepared.normalize(). Patch by Hugo van
Kemenade and Henry Schreiner.
- gh-144050: Fix stat.filemode() in the pure-Python
implementation to avoid misclassifying invalid mode values
as block devices.
- gh-83069: subprocess.Popen.wait(): when timeout is not
None, an efficient event-driven mechanism now waits for
process termination, if available. Linux >= 5.3 uses
os.pidfd_open() + select.poll(). macOS and other BSD
variants use select.kqueue() + KQ_FILTER_PROC
+ KQ_NOTE_EXIT. Windows keeps using WaitForSingleObject
(unchanged). If none of these mechanisms are available, the
function falls back to the traditional busy loop
(non-blocking call and short sleeps). Patch by Giampaolo
Rodola.
- gh-144030: The Python implementation of
functools.lru_cache() differed from the default
C implementation in that it did not check that its argument
is callable. This discrepancy is now fixed and both raise
a TypeError.
- gh-144001: Added the ignorechars parameter in
binascii.a2b_base64() and base64.b64decode().
- gh-144023: Fixed validation of file descriptor 0 in posix
functions when used with follow_symlinks parameter.
- gh-143999: Fix an issue where inspect.getgeneratorstate()
and inspect.getcoroutinestate() could fail for generators
wrapped by types.coroutine() in the suspended state.
- gh-143952: Fixed asyncio debugging tools to work with new
remote debugging API. Patch by Bartosz Sławecki.
- gh-143904: struct.pack_into() now raises OverflowError
instead of IndexError for too large offset argument.
- gh-143897: Remove the isxidstart() and isxidcontinue()
methods of unicodedata.ucd_3_2_0. They are now only exposed
as unicodedata.isxidstart() and
unicodedata.isxidcontinue().
- gh-143831: annotationlib.ForwardRef objects are now
hashable when created from annotation scopes with closures.
Previously, hashing such objects would throw an exception.
Patch by Bartosz Sławecki.
- gh-143874: Fixed a bug in pdb where expression results were
not sent back to remote client.
- gh-143754: Add new tkinter widget methods pack_content(),
place_content() and grid_content() which are alternative
spelling of old *_slaves() methods.
- gh-143756: Fix potential thread safety issues in ssl
module.
- gh-132604: Previously, Protocol classes that were not
decorated with @~typing.runtime_checkable, but that
inherited from another Protocol class that did have this
decorator, could be used in isinstance() and issubclass()
checks. This behavior is now deprecated and such checks
will throw a TypeError in Python 3.20. Patch by Bartosz
Sławecki.
- gh-143543: Fix a crash in itertools.groupby that could
occur when a user-defined __eq__() method re-enters the
iterator during key comparison.
- gh-143689: Fix io.BufferedReader.read1() state cleanup on
buffer allocation failure.
- gh-143602: Fix a inconsistency issue in write() that leads
to unexpected buffer overwrite by deduplicating the buffer
exports.
- gh-142434: Use ppoll() if available in select.poll() to
have a timeout resolution of 1 nanosecond, instead of
a resolution of 1 ms. Patch by Victor Stinner.
- gh-140557: array.array buffers now have the same alignment
when empty as when allocated. Unaligned buffers can still
be created by slicing.
- gh-143423: Fix free-threaded build detection in the
sampling profiler when Py_GIL_DISABLED is set to 0.
- gh-101178: Add Ascii85, Base85, and Z85 support to binascii
and improve the performance of the base-85 converters in
base64.
- gh-142966: Fix ctypes.POINTER.set_type() not updating the
format string to match the type.
- gh-142555: array: fix a crash in a[i] = v when converting
i to an index via i.__index__ or i.__float__ mutates the
array.
- gh-142438: Fix _decimal builds configured with
EXTRA_FUNCTIONALITY by correcting the Context.apply wrapper
to pass the right argument.
- gh-141860: Add an on_error keyword-only parameter to
multiprocessing.set_forkserver_preload() to control how
import failures during module preloading are handled.
Accepts 'ignore' (default, silent), 'warn' (emit
ImportWarning), or 'fail' (raise exception). Contributed by
Nick Neumann and Gregory P. Smith.
- CVE-2025-12781: Accepting + and / characters with an
alternative alphabet in base64.b64decode() and
base64.urlsafe_b64decode() is now deprecated. In future
Python versions they will be errors in the strict mode and
discarded in the non-strict mode. (bsc#1257108, gh-125346)
- gh-140715: Add '%F' support to strptime().
- gh-67041: Add the missing_as_none parameter to urlparse(),
urlsplit() and urldefrag() functions. Add the keep_empty
parameter to urlunparse() and urlunsplit() functions. This
allows to distinguish between empty and not defined URI
components and preserve empty components.
- gh-77188: The pickle module now properly handles
name-mangled private methods.
- IDLE
- gh-143774: Better explain the operation of Format / Format
Paragraph.
- Core and Builtins
- gh-134584: Optimize and eliminate ref-counting in
_BINARY_OP_SUBSCR_LIST_SLICE
- gh-144563: Fix interaction of the Tachyon profiler and
ctypes and other modules that load the Python shared
library (if present) in an independent map as this was
causing the mechanism that loads the binary information to
be confused. Patch by Pablo Galindo
- gh-144601: Fix crash when importing a module whose PyInit
function raises an exception from a subinterpreter.
- gh-144549: Fix building the tail calling interpreter on
Visual Studio 2026 with free-threading.
- gh-144513: Fix potential deadlock when using critical
sections during stop-the-world pauses in the free-threaded
build.
- gh-131798: Optimise _GUARD_TOS_SLICE in the JIT.
- gh-144330: Move classmethod and staticmethod initialization
from __init__() to __new__(). Patch by Victor Stinner.
- gh-144446: Fix data races in the free-threaded build when
reading frame object attributes while another thread is
executing the frame.
- gh-120321: Add gi_state, cr_state, and ag_state attributes
to generators, coroutines, and async generators that return
the current state as a string (e.g., GEN_RUNNING). The
inspect module functions getgeneratorstate(),
getcoroutinestate(), and getasyncgenstate() now return
these attributes directly.
- gh-141563: Fix thread safety of PyDateTime_IMPORT.
- gh-144280: Fix a bug in JIT where the predicate symbol had
no truthiness
- gh-140550: In PyModuleDef.m_slots, allow slots that repeat
information present in PyModuleDef.
- gh-139103: Improve scaling of namedtuple() instantiation in
the free-threaded build.
- gh-144307: Prevent a reference leak in module teardown at
interpreter finalization.
- gh-144319: Add huge pages support for the pymalloc
allocator. Patch by Pablo Galindo
- gh-120321: Made gi_yieldfrom thread-safe in the
free-threading build by using a lightweight lock on the
frame state.
- gh-144194: Fix error handling in perf jitdump
initialization on memory allocation failure.
- gh-143962: Name suggestion for not normalized name suggests
now the normalized name or the closest name to the
normalized name. If the suggested name is not ASCII,
include also its ASCII representation.
- gh-144157: bytes.translate() now allows the compiler to
unroll its loop more usefully for a 2x speedup in the
common no-deletions specified case.
- gh-144068: Fix JIT tracer memory leak, ensure the JIT
tracer state is freed when daemon threads are cleaned up
during interpreter shutdown.
- gh-144012: Check if the result is NULL in BINARY_OP_EXTENT
opcode.
- gh-144007: Eliminate redundant refcounting in the JIT for
BINARY_OP.
- gh-144005: Eliminate redundant refcounting from
BINARY_OP_EXTEND.
- gh-143939: Fix erroneous “cannot reuse already awaited
coroutine” error that could occur when a generator was run
during the process of clearing a coroutine’s frame.
- gh-141805: Fix crash in set when objects with the same hash
are concurrently added to the set after removing an element
with the same hash while the set still contains elements
with the same hash.
- gh-143670: Fixes a crash in ga_repr_items_list function.
- gh-143650: Fix race condition in importlib where a thread
could receive a stale module reference when another
thread’s import fails.
- gh-143569: Generator expressions in 3.15 now conform to the
documented behavior when the iterable does not support
iteration. This matches the behavior in 3.14 and earlier
- gh-143192: Improve performance of bitwise operations on
multi-digit ints.
- gh-132657: If we are specializing to LOAD_GLOBAL_MODULE or
LOAD_ATTR_MODULE, try to enable deferred reference counting
for the value, if the object is owned by a different
thread. This applies to the free-threaded build only and
should improve scaling of multi-threaded programs. Note
that when deferred reference counting is enabled, the
object will be deallocated by the GC, rather than by
Py_DECREF().
- gh-143055: Implement PEP 798 (Unpacking in Comprehensions).
Patch by Adam Hartz.
- gh-142037: Improve error messages for printf-style
formatting. For errors in the format string, always include
the position of the start of the format unit. For errors
related to the formatted arguments, always include the
number or the name of the argument. Raise more specific
errors and include more information (type and number of
arguments, most probable causes of error).
- gh-140557: bytearray buffers now have the same alignment
when empty as when allocated. Unaligned buffers can still
be created by slicing.
- gh-140232: Frozenset objects with immutable elements are no
longer tracked by the garbage collector.
- gh-115231: Setup __module__ attribute for built-in static
methods. Patch by Sergey B Kirpichev.
- C API
- gh-143869: Added PyLong_GetNativeLayout(), PyLongLayout,
PyLongExport, PyLong_Export(), PyLong_FreeExport(),
PyLongWriter, PyLongWriter_Create(), PyLongWriter_Finish()
and PyLongWriter_Discard() to the limited API.
- gh-141070: Renamed PyUnstable_Object_Dump() to
PyObject_Dump().
- Build
- gh-140421: Disable the perf trampoline on older macOS
versions where it cannot be built.
- gh-144309: Build Python with POSIX 2024, instead of POSIX
2008. Patch by Victor Stinner.
- gh-144278: Enables defining the _PY_IMPL_NAME and
_PY_IMPL_CACHE_TAG preprocessor definitions to override
sys.implementation at build time. Definitions need to
include quotes when setting to a string literal. Setting
the cache tag to NULL has the effect of completely
disabling automatic creation and use of .pyc files.
- gh-143960: Add support for OpenSSL 3.6, drop EOL 3.2. Patch
by Hugo van Kemenade.
- gh-143941: Move WASI-related files to Platforms/WASI. Along
the way, leave a deprecated Tools/wasm/wasi/__main__.py
behind for backwards-compatibility.
- gh-143842: Prevent static builds from clashing with curses
by making the optimizer COLORS table static.
Remove upstreamed patches:
- CVE-2024-6923-follow-up-EOL-email-headers.patch
- CVE-2025-11468-email-hdr-fold-comment.patch
- CVE-2025-12781-b64decode-alt-chars.patch
- CVE-2025-15282-urllib-ctrl-chars.patch
- CVE-2025-15366-imap-ctrl-chars.patch
- CVE-2025-15367-poplib-ctrl-chars.patch
- CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
- CVE-2026-0865-wsgiref-ctrl-chars.patch
52 lines
2.5 KiB
Diff
52 lines
2.5 KiB
Diff
From d8850aac54c234201966c66e83225564302cd15c Mon Sep 17 00:00:00 2001
|
|
From: Seth Michael Larson <seth@python.org>
|
|
Date: Fri, 16 Jan 2026 10:54:09 -0600
|
|
Subject: [PATCH 1/2] Add 'test.support' fixture for C0 control characters
|
|
|
|
---
|
|
Lib/test/test_urllib.py | 7 +++++++
|
|
Lib/urllib/request.py | 5 +++++
|
|
Misc/NEWS.d/next/Security/2026-01-16-11-51-19.gh-issue-143925.mrtcHW.rst | 1 +
|
|
3 files changed, 13 insertions(+)
|
|
|
|
Index: Python-3.15.0a6/Lib/test/test_urllib.py
|
|
===================================================================
|
|
--- Python-3.15.0a6.orig/Lib/test/test_urllib.py 2026-02-11 22:31:19.832904633 +0100
|
|
+++ Python-3.15.0a6/Lib/test/test_urllib.py 2026-02-11 22:57:02.393345971 +0100
|
|
@@ -513,6 +513,13 @@
|
|
self.assertFalse(e.exception.filename)
|
|
self.assertTrue(e.exception.reason)
|
|
|
|
+ def test_invalid_mediatype(self):
|
|
+ for c0 in control_characters_c0():
|
|
+ self.assertRaises(ValueError,urllib.request.urlopen,
|
|
+ f'data:text/html;{c0},data')
|
|
+ for c0 in control_characters_c0():
|
|
+ self.assertRaises(ValueError,urllib.request.urlopen,
|
|
+ f'data:text/html{c0};base64,ZGF0YQ==')
|
|
|
|
class urlopen_DataTests(unittest.TestCase):
|
|
"""Test urlopen() opening a data URL."""
|
|
Index: Python-3.15.0a6/Lib/urllib/request.py
|
|
===================================================================
|
|
--- Python-3.15.0a6.orig/Lib/urllib/request.py 2026-02-11 22:31:20.220618979 +0100
|
|
+++ Python-3.15.0a6/Lib/urllib/request.py 2026-02-11 22:57:02.393916978 +0100
|
|
@@ -1641,6 +1641,11 @@
|
|
raise ValueError(
|
|
"Control characters not allowed in data: mediatype")
|
|
|
|
+ # Disallow control characters within mediatype.
|
|
+ if re.search(r"[\x00-\x1F\x7F]", mediatype):
|
|
+ raise ValueError(
|
|
+ "Control characters not allowed in data: mediatype")
|
|
+
|
|
# even base64 encoded data URLs might be quoted so unquote in any case:
|
|
data = unquote_to_bytes(data)
|
|
if mediatype.endswith(";base64"):
|
|
Index: Python-3.15.0a6/Misc/NEWS.d/next/Security/2026-01-16-11-51-19.gh-issue-143925.mrtcHW.rst
|
|
===================================================================
|
|
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
|
|
+++ Python-3.15.0a6/Misc/NEWS.d/next/Security/2026-01-16-11-51-19.gh-issue-143925.mrtcHW.rst 2026-02-11 22:57:02.394304909 +0100
|
|
@@ -0,0 +1 @@
|
|
+Reject control characters in ``data:`` URL media types.
|