Skip to content

[2.7] bpo-34866: Adding max_num_fields to cgi.FieldStorage (GH-9660)#9969

Merged
vstinner merged 5 commits into
python:2.7from
matthewbelisle-wf:backport-2091448-2.7
Oct 30, 2018
Merged

[2.7] bpo-34866: Adding max_num_fields to cgi.FieldStorage (GH-9660)#9969
vstinner merged 5 commits into
python:2.7from
matthewbelisle-wf:backport-2091448-2.7

Conversation

@matthewbelisle-wf

@matthewbelisle-wf matthewbelisle-wf commented Oct 19, 2018 •
edited by bedevere-bot
Loading

Copy link
Copy Markdown
Contributor

Adding max_num_fields to cgi.FieldStorage to make DOS attacks harder by
limiting the number of MiniFieldStorage objects created by FieldStorage.

(cherry picked from commit 2091448)

https://bugs.python.org/issue34866

@bedevere-bot bedevere-bot mentioned this pull request Oct 19, 2018
Merged
@matthewbelisle-wf
bpo-34866: Adding max_num_fields to cgi.FieldStorage (pythonGH-9660)
16bf780 
Adding `max_num_fields` to `cgi.FieldStorage` to make DOS attacks harder by
limiting the number of `MiniFieldStorage` objects created by `FieldStorage`.

(cherry picked from commit 2091448)
@matthewbelisle-wf

matthewbelisle-wf commented Oct 19, 2018

Copy link
Copy Markdown
Contributor Author

@ambv @methane Here is the 2.7 backport of #9660. While doing this backport I noticed a logic bug in #9660 that my unit tests did not catch, and I'm making another bpo issue to fix it in 3.x. Sorry for the extra work there, it was my mistake. I'll CC you on that PR.

@matthewbelisle-wf matthewbelisle-wf mentioned this pull request Oct 22, 2018
Merged
@methane methane closed this Oct 23, 2018
@methane methane reopened this Oct 23, 2018
vstinner
vstinner requested changes Oct 24, 2018
View reviewed changes

@vstinner vstinner left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You must update the documentation as well: https://bugs.python.org/issue34866#msg328401

@bedevere-bot

bedevere-bot commented Oct 24, 2018

Copy link
Copy Markdown

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

@matthewbelisle-wf

matthewbelisle-wf commented Oct 30, 2018

Copy link
Copy Markdown
Contributor Author

Thanks for the info @vstinner , I added those changes in 90ab0d5.

For @bedevere-bot : I have made the requested changes; please review again.

@bedevere-bot

bedevere-bot commented Oct 30, 2018

Copy link
Copy Markdown

Thanks for making the requested changes!

@vstinner: please review the changes made to this pull request.

vstinner
vstinner approved these changes Oct 30, 2018
View reviewed changes

@vstinner vstinner left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Please write a PR for the master branch to document the new parameter.

This was referenced Oct 30, 2018
Merged
Merged
Merged
@matthewbelisle-wf

matthewbelisle-wf commented Oct 30, 2018

Copy link
Copy Markdown
Contributor Author

Thanks @vstinner . Here are the PRs for master, 3.7, and 3.6:

#10247
#10246
#10248

vstinner
vstinner reviewed Oct 30, 2018
View reviewed changes
Comment thread Doc/library/urlparse.rst Outdated
Copied from the :mod:`cgi` module.

.. versionchanged:: 2.7.16
Added *max_num_fields* param.

@vstinner vstinner Oct 30, 2018

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh, please replace "param" with "parameter.

vstinner
vstinner reviewed Oct 30, 2018
View reviewed changes
Comment thread Doc/library/urlparse.rst Outdated
Copied from the :mod:`cgi` module.

.. versionchanged:: 2.7.16
Added *max_num_fields* param.

@vstinner vstinner Oct 30, 2018

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ditto.

@matthewbelisle-wf

matthewbelisle-wf commented Oct 30, 2018

Copy link
Copy Markdown
Contributor Author

@vstinner Sure thing, fixed in commit 1767079.

@matthewbelisle-wf

matthewbelisle-wf commented Oct 30, 2018

Copy link
Copy Markdown
Contributor Author

Okay this is ready for review again @vstinner

@vstinner vstinner merged commit bc6f74a into python:2.7 Oct 30, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vstinner vstinner vstinner approved these changes

Assignees

No one assigned

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@matthewbelisle-wf @bedevere-bot @vstinner @methane @the-knights-who-say-ni