1. 15 Dec, 1997 12 commits
  2. 12 Dec, 1997 5 commits
  3. 11 Dec, 1997 18 commits
  4. 10 Dec, 1997 5 commits
    • Guido van Rossum's avatar
      Jim Fulton writes: · f96c1896
      Guido van Rossum authored
      The attached patch adds the following behavior to the handling
      of REDUCE codes:
      
      - A user-defined type may have a __reduce__ method that returns
        a string rather than a tuple, in which case the object is
        saved as a global object with a name given by the string returned
        by reduce.
      
        This was a feature added to cPickle a long time ago.
      
      
      - User-defined types can now support unpickling without
        executing a constructor.
      
        The second value returned from '__reduce__' can now be None,
        rather than an argument tuple.  On unpickling, if the
        second value returned from '__reduce__' during pickling was
        None, then rather than calling the first value returned from
        '__reduce__', directly, the '__basicnew__' method of the
        first value returned from '__reduce__' is called without
        arguments.
      
      I also got rid of a few of Chris' extra ()s, which he used
      to make python ifs look like C ifs.
      f96c1896
    • Guido van Rossum's avatar
    • Guido van Rossum's avatar
    • Guido van Rossum's avatar
      At Barry's suggestion, plug the security leak by using an empty · 564c8ffd
      Guido van Rossum authored
      __builtins__ for all calls to eval().  This still allows someone to
      write string.atof("[1]*1000000") (which Jim Fulton worries about) but
      effectively disables access to system modules and functions.
      564c8ffd
    • Guido van Rossum's avatar
      Since this module is used as a fallback in case no built-in modules · 2c1f604d
      Guido van Rossum authored
      have been configured, string.atof() should not fail when "import re"
      fails (usually because pcre is not there).
      
      This opens up a tiny security hole: *if* an attacker can make "import
      re" fail, they can also make string.atof(arbitrary_string) evaluate
      the arbitrary string.  Nothing to keep me awake at night...
      2c1f604d