python / cpython

GH-19251)

(cherry picked from commit cd16661)

…ttp.client. (GH-19052)

Add host validation for control characters for more
CVE-2019-18348 protection.
(cherry picked from commit 83fc701)

Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>

(cherry picked from commit f4800b8)

Co-authored-by: Inada Naoki <songofacandy@gmail.com>

…or the (#17774)

desired behavior under windows platform.

Suggestion by David Bolen

(cherry picked from commit 32f1443)

Co-authored-by: Ned Deily <nad@python.org>

(cherry picked from commit 946b29e)

Co-authored-by: Benjamin Peterson <benjamin@python.org>

…transfer (#1040)

* bpo-27973: Fix urllib.urlretrieve failing on subsequent ftp transfers from the same host.

* bpo-35411: Skip test_urllibnet FTP tests on Travis CI.

(cherry picked from commit 5c7ed75)

Co-authored-by: William Ayd <william.ayd@icloud.com>

…acOS Catalina (GH-17636)

(cherry picked from commit bf3aa10)

Co-authored-by: Ned Deily <nad@python.org>

In all these cases, we know the exact length we want copied, so memcpy is the right function to use.

…he output format (GH-17418). (#17452)

(cherry picked from commit a62ad47)

Co-authored-by: Matthew Rollings <1211162+stealthcopter@users.noreply.github.com>

(cherry picked from commit fdafa1d)

Co-authored-by: idomic <michael.ido@gmail.com>

The regex http.cookiejar.LOOSE_HTTP_DATE_RE was vulnerable to regular
expression denial of service (REDoS).

LOOSE_HTTP_DATE_RE.match is called when using http.cookiejar.CookieJar
to parse Set-Cookie headers returned by a server.
Processing a response from a malicious HTTP server can lead to extreme
CPU usage and execution will be blocked for a long time.

The regex contained multiple overlapping \s* capture groups.
Ignoring the ?-optional capture groups the regex could be simplified to

    \d+-\w+-\d+(\s*\s*\s*)$

Therefore, a long sequence of spaces can trigger bad performance.

Matching a malicious string such as

    LOOSE_HTTP_DATE_RE.match("1-c-1" + (" " * 2000) + "!")

caused catastrophic backtracking.

The fix removes ambiguity about which \s* should match a particular
space.

You can create a malicious server which responds with Set-Cookie headers
to attack all python programs which access it e.g.

    from http.server import BaseHTTPRequestHandler, HTTPServer

    def make_set_cookie_value(n_spaces):
        spaces = " " * n_spaces
        expiry = f"1-c-1{spaces}!"
        return f"b;Expires={expiry}"

    class Handler(BaseHTTPRequestHandler):
        def do_GET(self):
            self.log_request(204)
            self.send_response_only(204)  # Don't bother sending Server and Date
            n_spaces = (
                int(self.path[1:])  # Can GET e.g. /100 to test shorter sequences
                if len(self.path) > 1 else
                65506  # Max header line length 65536
            )
            value = make_set_cookie_value(n_spaces)
            for i in range(99):  # Not necessary, but we can have up to 100 header lines
                self.send_header("Set-Cookie", value)
            self.end_headers()

    if __name__ == "__main__":
        HTTPServer(("", 44020), Handler).serve_forever()

This server returns 99 Set-Cookie headers. Each has 65506 spaces.
Extracting the cookies will pretty much never complete.

Vulnerable client using the example at the bottom of
https://docs.python.org/3/library/http.cookiejar.html :

    import http.cookiejar, urllib.request
    cj = http.cookiejar.CookieJar()
    opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj))
    r = opener.open("http://localhost:44020/")

The popular requests library was also vulnerable without any additional
options (as it uses http.cookiejar by default):

    import requests
    requests.get("http://localhost:44020/")

* Regression test for http.cookiejar REDoS

If we regress, this test will take a very long time.

* Improve performance of http.cookiejar.ISO_DATE_RE

A string like

"444444" + (" " * 2000) + "A"

could cause poor performance due to the 2 overlapping \s* groups,
although this is not as serious as the REDoS in LOOSE_HTTP_DATE_RE was.

(cherry picked from commit 1b779bf)

GH-17081)

…at. (GH-17077)

…IX_C_SOURCE (GH-16733)

(cherry picked from commit 8177404)

Co-authored-by: Pablo Galindo <Pablogsal@gmail.com>

(cherry picked from commit d898d20)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

…nts in decorators. (GH-16861). (GH-16931)

(cherry picked from commit 26ae9f6)

(cherry picked from commit 01659ca)

Co-authored-by: Ned Deily <nad@python.org>

AddRefActCtx() does not return a value.

(cherry picked from commit dfe726b)

Co-authored-by: Kyle Stanley <aeros167@gmail.com>

GH-16869). (GH-16877)

(cherry picked from commit 5bc6a7c)