◐ Shell
reader mode source ↗
Skip to content

[2.7] bpo-38243: Escape the server title of DocXMLRPCServer#16447

Merged
vstinner merged 3 commits into
python:2.7from
corona10:bpo-38243-2.7
Oct 1, 2019
Merged

[2.7] bpo-38243: Escape the server title of DocXMLRPCServer#16447
vstinner merged 3 commits into
python:2.7from
corona10:bpo-38243-2.7

Conversation

@corona10

@corona10 corona10 commented Sep 28, 2019 •
edited by bedevere-bot
Loading

Copy link
Copy Markdown
Member

@corona10 corona10 requested a review from vstinner September 28, 2019 01:38
@corona10 corona10 added the type-security A security issue label Sep 28, 2019
@corona10

corona10 commented Sep 30, 2019

Copy link
Copy Markdown
Member Author

@vstinner Please take a look :)

@bedevere-bot bedevere-bot removed the label Sep 30, 2019
@bedevere-bot

bedevere-bot commented Sep 30, 2019

Copy link
Copy Markdown

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

@corona10

corona10 commented Oct 1, 2019

Copy link
Copy Markdown
Member Author

I have made the requested changes; please review again

@bedevere-bot

bedevere-bot commented Oct 1, 2019

Copy link
Copy Markdown

Thanks for making the requested changes!

@vstinner: please review the changes made to this pull request.

@bedevere-bot bedevere-bot requested a review from vstinner October 1, 2019 01:40
@vstinner

vstinner commented Oct 1, 2019

Copy link
Copy Markdown
Member

I'd like to optimize html.escape of master version with b41cde8 if this showing better performance. What do you think?

5 str.replace() calls sound inefficient, so there is likely room for enhancement. But I am not sure what is the best approach. If you find something which is faster, please open a separated issue. But a security fix in a super stable branch (2.7) is not the right place to experiment optimization :-) Correctness matters more here ;-)

@corona10

corona10 commented Oct 1, 2019

Copy link
Copy Markdown
Member Author

Updated!

If you find something which is faster,

Okay, I will take a look at it :)

vstinner
vstinner approved these changes Oct 1, 2019
View reviewed changes

@vstinner vstinner left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hide comment

LGTM, thanks. It's now better than the first version of the PR ;-)

@vstinner vstinner merged commit 8eb6415 into python:2.7 Oct 1, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vstinner vstinner vstinner approved these changes

Assignees

No one assigned

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@corona10 @bedevere-bot @vstinner @the-knights-who-say-ni