bpo-38243: Escape the server_title of DocXMLRPCServer when rendering #16373

corona10 · 2019-09-25T04:23:40Z

Escape the server_title of DocXMLRPCServer when rendering,
The title will only be escaped when the server_title should be rendered.

https://bugs.python.org/issue38243


        bpo-38243: Escape the server_title of DocXMLRPCServer when rendering

Lib/xmlrpc/server.py


        bpo-38243: Update unittest

corona10 · 2019-09-26T14:04:09Z

@tirkarthi I've updated the PR, thank you for the feedback.

Lib/test/test_docxmlrpc.py


        bpo-38243: Update unittest

corona10 · 2019-09-27T08:56:39Z

@tirkarthi I've reflected your comment. Thanks for the review.

Lib/test/test_docxmlrpc.py

Misc/NEWS.d/next/Security/2019-09-25-13-21-09.bpo-38243.1pfz24.rst


        bpo-38243: Reflect the vstinner's review

Misc/NEWS.d/next/Security/2019-09-25-13-21-09.bpo-38243.1pfz24.rst


        bpo-38243: Update misc news

corona10 · 2019-09-27T14:38:51Z

@vstinner Updated!

miss-islington · 2019-09-27T19:59:40Z

Thanks @corona10 for the PR, and @vstinner for merging it 🌮🎉.. I'm working now to backport this PR to: 3.6, 3.7, 3.8.
🐍🍒⛏🤖

bedevere-bot · 2019-09-27T20:00:16Z

GH-16439 is a backport of this pull request to the 3.8 branch.

bedevere-bot · 2019-09-27T20:00:26Z

GH-16440 is a backport of this pull request to the 3.7 branch.

miss-islington · 2019-09-27T20:00:34Z

Sorry, @corona10 and @vstinner, I could not cleanly backport this to 3.6 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker e8650a4f8c7fb76f570d4ca9c1fbe44e91c8dfaa 3.6


        bpo-38243, xmlrpc.server: Escape the server_title (pythonGH-16373)

Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering the document page as HTML. (cherry picked from commit e8650a4) Co-authored-by: Dong-hee Na <donghee.na92@gmail.com>


        bpo-38243, xmlrpc.server: Escape the server_title (pythonGH-16373)

Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering the document page as HTML. (cherry picked from commit e8650a4)

bedevere-bot · 2019-09-27T20:03:21Z

GH-16441 is a backport of this pull request to the 3.6 branch.

vstinner · 2019-09-27T20:04:43Z

@corona10: I backported manually your change to 3.6. I just had to fix a simple conflict on imports.

Would you mind to try to backport the change to Python 2.7 which also has the bug?


        bpo-38243, xmlrpc.server: Escape the server_title (GH-16373)

Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering the document page as HTML. (cherry picked from commit e8650a4) Co-authored-by: Dong-hee Na <donghee.na92@gmail.com>


        bpo-38243, xmlrpc.server: Escape the server_title (GH-16373)

Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering the document page as HTML. (cherry picked from commit e8650a4) Co-authored-by: Dong-hee Na <donghee.na92@gmail.com>

bedevere-bot · 2019-09-27T21:19:43Z

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot PPC64LE Fedora 3.7 has failed when building commit 39a0c75.

What do you need to do:

Don't panic.
Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
Go to the page of the buildbot that failed (https://buildbot.python.org/all/#builders/120/builds/1323) and take a look at the build logs.
Check if the failure is related to this commit (39a0c75) or if it is a false positive.
If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/all/#builders/120/builds/1323

Failed tests:

test_readline
test_os
test_asyncio

Failed subtests:

test_read_pty_output - test.test_asyncio.test_events.EPollEventLoopTests
test_bidirectional_pty - test.test_asyncio.test_events.SelectEventLoopTests
test_write_pty - test.test_asyncio.test_events.SelectEventLoopTests
test_bidirectional_pty - test.test_asyncio.test_events.PollEventLoopTests
test_auto_history_disabled - test.test_readline.TestReadline
test_write_pty - test.test_asyncio.test_events.PollEventLoopTests
test_history_size - test.test_readline.TestReadline
test_read_pty_output - test.test_asyncio.test_events.PollEventLoopTests
test_openpty - test.test_os.FDInheritanceTests
test_bidirectional_pty - test.test_asyncio.test_events.EPollEventLoopTests
test_nonascii - test.test_readline.TestReadline
test_write_pty - test.test_asyncio.test_events.EPollEventLoopTests
test_auto_history_enabled - test.test_readline.TestReadline
test_read_pty_output - test.test_asyncio.test_events.SelectEventLoopTests

Summary of the results of the build (if available):

== Tests result: FAILURE then FAILURE ==

400 tests OK.

10 slowest tests:

test_concurrent_futures: 2 min 35 sec
test_tokenize: 2 min 25 sec
test_multiprocessing_spawn: 2 min 23 sec
test_tools: 2 min 4 sec
test_lib2to3: 1 min 44 sec
test_multiprocessing_forkserver: 1 min 24 sec
test_multiprocessing_fork: 1 min 12 sec
test_io: 1 min 586 ms
test_asyncio: 59 sec 419 ms
test_subprocess: 39 sec 224 ms

3 tests failed:
test_asyncio test_os test_readline

13 tests skipped:
test_devpoll test_ioctl test_kqueue test_msilib test_ossaudiodev
test_startfile test_tix test_tk test_ttk_guionly test_winconsoleio
test_winreg test_winsound test_zipfile64

3 re-run tests:
test_asyncio test_os test_readline

Total duration: 20 min 20 sec

Click to see traceback logs

Traceback (most recent call last):
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/support/__init__.py", line 623, in wrapper
    return func(*args, **kw)
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_asyncio/test_events.py", line 1645, in test_bidirectional_pty
    master, read_slave = os.openpty()
FileNotFoundError: [Errno 2] No such file or directory


Traceback (most recent call last):
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_readline.py", line 149, in test_auto_history_enabled
    output = run_pty(self.auto_history_script.format(True))
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_readline.py", line 285, in run_pty
    [master, slave] = pty.openpty()
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/pty.py", line 29, in openpty
    master_fd, slave_name = _open_terminal()
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/pty.py", line 59, in _open_terminal
    raise OSError('out of pty devices')
OSError: out of pty devices


Traceback (most recent call last):
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_os.py", line 3273, in test_openpty
    master_fd, slave_fd = os.openpty()
FileNotFoundError: [Errno 2] No such file or directory


Traceback (most recent call last):
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_readline.py", line 274, in test_history_size
    run_pty(script, input=b"last input\r", env=env)
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_readline.py", line 285, in run_pty
    [master, slave] = pty.openpty()
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/pty.py", line 29, in openpty
    master_fd, slave_name = _open_terminal()
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/pty.py", line 59, in _open_terminal
    raise OSError('out of pty devices')
OSError: out of pty devices


Traceback (most recent call last):
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_readline.py", line 226, in test_nonascii
    output = run_pty(script, input)
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_readline.py", line 285, in run_pty
    [master, slave] = pty.openpty()
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/pty.py", line 29, in openpty
    master_fd, slave_name = _open_terminal()
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/pty.py", line 59, in _open_terminal
    raise OSError('out of pty devices')
OSError: out of pty devices


Traceback (most recent call last):
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_asyncio/test_events.py", line 1503, in test_read_pty_output
    master, slave = os.openpty()
FileNotFoundError: [Errno 2] No such file or directory


Traceback (most recent call last):
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_readline.py", line 153, in test_auto_history_disabled
    output = run_pty(self.auto_history_script.format(False))
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_readline.py", line 285, in run_pty
    [master, slave] = pty.openpty()
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/pty.py", line 29, in openpty
    master_fd, slave_name = _open_terminal()
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/pty.py", line 59, in _open_terminal
    raise OSError('out of pty devices')
OSError: out of pty devices


Traceback (most recent call last):
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/support/__init__.py", line 623, in wrapper
    return func(*args, **kw)
  File "/home/shager/cpython-buildarea/3.7.edelsohn-fedora-ppc64le/build/Lib/test/test_asyncio/test_events.py", line 1601, in test_write_pty
    master, slave = os.openpty()
FileNotFoundError: [Errno 2] No such file or directory

corona10 · 2019-09-27T21:47:19Z

@vstinner Sure!


        bpo-38243, xmlrpc.server: Escape the server_title (GH-16373) (GH-16441)

Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering the document page as HTML. (cherry picked from commit e8650a4)


        bpo-38243, xmlrpc.server: Escape the server_title (pythonGH-16373) (p…

…ythonGH-16441) Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering the document page as HTML. (cherry picked from commit e8650a4) (cherry picked from commit 1698cac)


        bpo-38243, xmlrpc.server: Escape the server_title (pythonGH-16373) (p…

…ythonGH-16441) Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering the document page as HTML. (cherry picked from commit e8650a4) (cherry picked from commit 1698cac)


        bpo-38243, xmlrpc.server: Escape the server_title (GH-16373) (GH-16441)…

… (#16516) Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering the document page as HTML. (cherry picked from commit e8650a4)


        bpo-38243, xmlrpc.server: Escape the server_title (pythonGH-16373)

Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering the document page as HTML.

bpo-38243: Escape the server_title of DocXMLRPCServer when rendering

Loading status checks…

52f2a59

the-knights-who-say-ni added the CLA signed label Sep 25, 2019

bedevere-bot added the awaiting review label Sep 25, 2019

tirkarthi reviewed Sep 25, 2019

View changes

Lib/xmlrpc/server.py Show resolved Hide resolved

bpo-38243: Update unittest

Loading status checks…

10d2f0b

corona10 force-pushed the corona10:bpo-38243 branch from b4448fa to 10d2f0b Sep 26, 2019

corona10 requested a review from vstinner Sep 26, 2019

tirkarthi reviewed Sep 27, 2019

View changes

Lib/test/test_docxmlrpc.py Outdated Show resolved Hide resolved

bpo-38243: Update unittest

Loading status checks…

2a992a9

vstinner reviewed Sep 27, 2019

View changes

Lib/test/test_docxmlrpc.py Outdated Show resolved Hide resolved

Misc/NEWS.d/next/Security/2019-09-25-13-21-09.bpo-38243.1pfz24.rst Outdated Show resolved Hide resolved

bpo-38243: Reflect the vstinner's review

Loading status checks…

3a8f7a7

vstinner added needs backport to 3.6 needs backport to 3.7 needs backport to 3.8 labels Sep 27, 2019

vstinner reviewed Sep 27, 2019

View changes

Misc/NEWS.d/next/Security/2019-09-25-13-21-09.bpo-38243.1pfz24.rst Outdated Show resolved Hide resolved

bpo-38243: Update misc news

Loading status checks…

2b2093c

bedevere-bot removed awaiting review needs backport to 3.8 labels Sep 27, 2019

bedevere-bot removed the needs backport to 3.7 label Sep 27, 2019

miss-islington assigned vstinner Sep 27, 2019

bedevere-bot removed the needs backport to 3.6 label Sep 27, 2019

aeros mentioned this pull request Oct 15, 2019

[3.5] bpo-38243, xmlrpc.server: Escape the server_title (GH-16373) (GH-16441) #16516

Merged

jacobneiltaylor added a commit to jacobneiltaylor/cpython that referenced this pull request Dec 5, 2019

bpo-38243, xmlrpc.server: Escape the server_title (pythonGH-16373)

0653a0d

Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering the document page as HTML.

python / cpython

bpo-38243: Escape the server_title of DocXMLRPCServer when rendering #16373

bpo-38243: Escape the server_title of DocXMLRPCServer when rendering #16373

corona10 commented Sep 25, 2019 •

edited

This comment has been minimized.

corona10 commented Sep 26, 2019

This comment has been minimized.

corona10 commented Sep 27, 2019

This comment has been minimized.

corona10 commented Sep 27, 2019

This comment has been minimized.

miss-islington commented Sep 27, 2019

This comment has been minimized.

bedevere-bot commented Sep 27, 2019

This comment has been minimized.

bedevere-bot commented Sep 27, 2019

This comment has been minimized.

miss-islington commented Sep 27, 2019

This comment has been minimized.

bedevere-bot commented Sep 27, 2019

This comment has been minimized.

vstinner commented Sep 27, 2019

This comment has been minimized.

bedevere-bot commented Sep 27, 2019

This comment has been minimized.

corona10 commented Sep 27, 2019

python / cpython

Sponsor python/cpython

Join GitHub today

bpo-38243: Escape the server_title of DocXMLRPCServer when rendering #16373

bpo-38243: Escape the server_title of DocXMLRPCServer when rendering #16373

Conversation

corona10 commented Sep 25, 2019 • edited

This comment has been minimized.

corona10 commented Sep 26, 2019

This comment has been minimized.

corona10 commented Sep 27, 2019

This comment has been minimized.

corona10 commented Sep 27, 2019

This comment has been minimized.

miss-islington commented Sep 27, 2019

This comment has been minimized.

bedevere-bot commented Sep 27, 2019

This comment has been minimized.

bedevere-bot commented Sep 27, 2019

This comment has been minimized.

miss-islington commented Sep 27, 2019

This comment has been minimized.

bedevere-bot commented Sep 27, 2019

This comment has been minimized.

vstinner commented Sep 27, 2019

This comment has been minimized.

bedevere-bot commented Sep 27, 2019

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

This comment has been minimized.

corona10 commented Sep 27, 2019

corona10 commented Sep 25, 2019 •

edited