Conversation
It doesn't look like a recognized directive :) |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #1319 +/- ##
==========================================
+ Coverage 96.63% 97.21% +0.57%
==========================================
Files 235 235
Lines 2915 2905 -10
==========================================
+ Hits 2817 2824 +7
+ Misses 98 81 -17 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
I know, it’s to remind myself to do it 🙂 |
There was a problem hiding this comment.
Pull request overview
This PR updates the upcoming 1.4.0 release notes and hardens the library against code-execution risks by removing eval() usage in locale metadata parsing and eliminating pickle-based timezone cache loading.
Changes:
- Replace
eval()parsing ofno_word_spacingwith strict boolean parsing and add regression tests to prevent code execution (#1056). - Remove import-time loading of timezone offsets/regexes from a packaged pickle cache, and stop shipping/building that cache via packaging/docs updates.
- Add 1.4.0 (unreleased) release notes covering the above changes.
Reviewed changes
Copilot reviewed 7 out of 8 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/test_languages.py | Adds security regression tests ensuring no_word_spacing cannot trigger code execution. |
| dateparser/languages/locale.py | Replaces eval() with a strict boolean parser for no_word_spacing. |
| dateparser/languages/dictionary.py | Replaces eval() with a strict boolean parser for no_word_spacing. |
| dateparser/timezone_parser.py | Removes pickle-cache loading and instead builds timezone offsets/regexes directly in module initialization. |
| dateparser/data/dateparser_tz_cache.pkl | Removes the packaged timezone pickle cache artifact. |
| MANIFEST.in | Stops including the timezone pickle cache in distributions. |
| CONTRIBUTING.rst | Removes instructions for rebuilding the timezone pickle cache. |
| HISTORY.rst | Adds 1.4.0 (unreleased) notes describing security fixes and other changes. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Fixes #1056, closes #1308, reopens #533.