1. 15 Dec, 1997 10 commits
  2. 12 Dec, 1997 5 commits
  3. 11 Dec, 1997 18 commits
  4. 10 Dec, 1997 7 commits
    • Guido van Rossum's avatar
      Jim Fulton writes: · f96c1896
      Guido van Rossum authored
      The attached patch adds the following behavior to the handling
      of REDUCE codes:
      
      - A user-defined type may have a __reduce__ method that returns
        a string rather than a tuple, in which case the object is
        saved as a global object with a name given by the string returned
        by reduce.
      
        This was a feature added to cPickle a long time ago.
      
      
      - User-defined types can now support unpickling without
        executing a constructor.
      
        The second value returned from '__reduce__' can now be None,
        rather than an argument tuple.  On unpickling, if the
        second value returned from '__reduce__' during pickling was
        None, then rather than calling the first value returned from
        '__reduce__', directly, the '__basicnew__' method of the
        first value returned from '__reduce__' is called without
        arguments.
      
      I also got rid of a few of Chris' extra ()s, which he used
      to make python ifs look like C ifs.
      f96c1896
    • Guido van Rossum's avatar
    • Guido van Rossum's avatar
    • Guido van Rossum's avatar
      At Barry's suggestion, plug the security leak by using an empty · 564c8ffd
      Guido van Rossum authored
      __builtins__ for all calls to eval().  This still allows someone to
      write string.atof("[1]*1000000") (which Jim Fulton worries about) but
      effectively disables access to system modules and functions.
      564c8ffd
    • Guido van Rossum's avatar
      Since this module is used as a fallback in case no built-in modules · 2c1f604d
      Guido van Rossum authored
      have been configured, string.atof() should not fail when "import re"
      fails (usually because pcre is not there).
      
      This opens up a tiny security hole: *if* an attacker can make "import
      re" fail, they can also make string.atof(arbitrary_string) evaluate
      the arbitrary string.  Nothing to keep me awake at night...
      2c1f604d
    • Guido van Rossum's avatar
      Don't specify base 0 to string.atoi when unpickling integers in text · f9f1761d
      Guido van Rossum authored
      mode.  The pickler always uses base 10 so the default base should be
      fine.  (The base gets us in trouble when there's no strop module, as
      the atoi() in string.py only supports base 10.  This is for JPython.)
      f9f1761d
    • Guido van Rossum's avatar
      New names. · db0965cb
      Guido van Rossum authored
      db0965cb