Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[2.7] bpo-38243: Escape the server title of DocXMLRPCServer #16447

Merged
merged 3 commits into from
Oct 1, 2019
Merged

[2.7] bpo-38243: Escape the server title of DocXMLRPCServer #16447

merged 3 commits into from
Oct 1, 2019

Conversation

corona10
Copy link
Member

@corona10 corona10 commented Sep 28, 2019 •
edited by bedevere-bot
Loading

@corona10 corona10 added the type-security A security issue label Sep 28, 2019
@corona10
Copy link
Member Author

@vstinner Please take a look :)

vstinner
vstinner requested changes Sep 30, 2019
View reviewed changes
Lib/DocXMLRPCServer.py Outdated Show resolved Hide resolved
@bedevere-bot
Copy link

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

@corona10
Copy link
Member Author

corona10 commented Oct 1, 2019

I have made the requested changes; please review again

@bedevere-bot
Copy link

Thanks for making the requested changes!

@vstinner: please review the changes made to this pull request.

@vstinner
Copy link
Member

vstinner commented Oct 1, 2019

I'd like to optimize html.escape of master version with b41cde8 if this showing better performance. What do you think?

5 str.replace() calls sound inefficient, so there is likely room for enhancement. But I am not sure what is the best approach. If you find something which is faster, please open a separated issue. But a security fix in a super stable branch (2.7) is not the right place to experiment optimization :-) Correctness matters more here ;-)

vstinner
vstinner reviewed Oct 1, 2019
View reviewed changes
Lib/DocXMLRPCServer.py Outdated Show resolved Hide resolved
@corona10
Copy link
Member Author

corona10 commented Oct 1, 2019

Updated!

If you find something which is faster,

Okay, I will take a look at it :)

vstinner
vstinner approved these changes Oct 1, 2019
View reviewed changes
Copy link
Member

@vstinner vstinner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks. It's now better than the first version of the PR ;-)

@vstinner vstinner merged commit 8eb6415 into python:2.7 Oct 1, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@vstinner vstinner vstinner approved these changes

Assignees
No one assigned
Labels
type-security A security issue
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@corona10 @bedevere-bot @vstinner @the-knights-who-say-ni