Skip to content

[2.7] bpo-38243: Escape the server title of DocXMLRPCServer #16447

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
vstinner merged 3 commits into from
Oct 1, 2019
Merged

[2.7] bpo-38243: Escape the server title of DocXMLRPCServer #16447

vstinner merged 3 commits into from
Oct 1, 2019

Conversation

@corona10
Copy link
Member

@corona10 corona10 commented Sep 28, 2019 •
edited by bedevere-bot
Loading

@corona10 corona10 requested a review from vstinner September 28, 2019 01:38
@corona10 corona10 added the type-security A security issue label Sep 28, 2019
@corona10
Copy link
Member Author

corona10 commented Sep 30, 2019

@vstinner Please take a look :)

vstinner
vstinner requested changes Sep 30, 2019
View reviewed changes
@bedevere-bot
Copy link

bedevere-bot commented Sep 30, 2019

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

@corona10
Copy link
Member Author

corona10 commented Oct 1, 2019

I have made the requested changes; please review again

@bedevere-bot
Copy link

bedevere-bot commented Oct 1, 2019

Thanks for making the requested changes!

@vstinner: please review the changes made to this pull request.

@bedevere-bot bedevere-bot requested a review from vstinner October 1, 2019 01:40
@vstinner
Copy link
Member

vstinner commented Oct 1, 2019

I'd like to optimize html.escape of master version with b41cde8 if this showing better performance. What do you think?

5 str.replace() calls sound inefficient, so there is likely room for enhancement. But I am not sure what is the best approach. If you find something which is faster, please open a separated issue. But a security fix in a super stable branch (2.7) is not the right place to experiment optimization :-) Correctness matters more here ;-)

vstinner
vstinner reviewed Oct 1, 2019
View reviewed changes
@corona10
Copy link
Member Author

corona10 commented Oct 1, 2019

Updated!

If you find something which is faster,

Okay, I will take a look at it :)

vstinner
vstinner approved these changes Oct 1, 2019
View reviewed changes
Copy link
Member

@vstinner vstinner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks. It's now better than the first version of the PR ;-)

@vstinner vstinner merged commit 8eb6415 into python:2.7 Oct 1, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vstinner vstinner vstinner approved these changes

Assignees

No one assigned

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@corona10 @bedevere-bot @vstinner @the-knights-who-say-ni