May 29, 2025 · May 29, 2025 · May 30, 2025 · May 30, 2025 · May 30, 2025 · May 30, 2025
diff --git a/Lib/idlelib/editor.py b/Lib/idlelib/editor.py
            self.apply_bindings(keydefs)
            for vevent in keydefs:
                methodname = vevent.replace("-", "_")
                while methodname[:1] == '<':
                    methodname = methodname[1:]
                while methodname[-1:] == '>':
                    methodname = methodname[:-1]
                methodname = methodname.lstrip('<').rstrip('>')
                methodname = methodname + "_event"
                if hasattr(ins, methodname):
                    self.text.bind(vevent, getattr(ins, methodname))
                self.usetabs = False
        self.set_tk_tabwidth(self.tabwidth)

    def delete_trail_whitespace(self, want, chars, tabwidth):
        current_pos = 0
        ncharsretained = 0
        for char in chars:
            if char == '\t':
                current_pos = (current_pos // tabwidth + 1) * tabwidth
            else:
                current_pos += 1
            ncharsretained += 1
            if current_pos > want:
                ncharsretained -= 1
                break
        for i in range(ncharsretained, len(chars)):
            if chars[i] not in " \t":
                ncharsretained = i + 1
        chars = chars[:ncharsretained]
        return len(chars) - ncharsretained, chars

    def smart_backspace_event(self, event):
        text = self.text
        first, last = self.get_selection_indices()
        assert have > 0
        want = ((have - 1) // self.indentwidth) * self.indentwidth
        # Debug prompt is multilined....
        ncharsdeleted = 0
        while True:
            chars = chars[:-1]
            ncharsdeleted = ncharsdeleted + 1
            have = len(chars.expandtabs(tabwidth))
            if have <= want or chars[-1] not in " \t":
                break
        ncharsdeleted, chars = self.delete_trail_whitespace(want, chars, tabwidth)
        text.undo_block_start()
        text.delete("insert-%dc" % ncharsdeleted, "insert")
        if have < want:
diff --git a/Lib/idlelib/idle_test/test_editor.py b/Lib/idlelib/idle_test/test_editor.py
        pass


 class DeleteWantTest(unittest.TestCase):

    def test_delete_trail_whitespace(self):
        with unittest.mock.patch.object(Editor, '__init__', return_value=None) as mock_init:
            ew = Editor()
            test_str = "abcde" + 10000 * "\t" + 10000 * " "
            res_str = ew.delete_trail_whitespace(30000, test_str, 4)[1]
            self.assertEqual(res_str, "abcde" + 7499 * "\t")
            res_str = ew.delete_trail_whitespace(41005, test_str, 4)[1]
            self.assertEqual(res_str, "abcde" + 10000 * "\t" + 1001 * " ")
            res_str = ew.delete_trail_whitespace(3, test_str, 4)[1]
            self.assertEqual(res_str, "abcde")
            res_str = ew.delete_trail_whitespace(6, test_str, 4)[1]
            self.assertEqual(res_str, "abcde")
            res_str = ew.delete_trail_whitespace(30002, test_str, 4)[1]
            self.assertEqual(res_str, "abcde" + 7499 * "\t")

 if __name__ == '__main__':
    unittest.main(verbosity=2)
diff --git a/Misc/NEWS.d/next/Security/2025-05-29-03-24-18.gh-issue-134873.dziqkQ.rst b/Misc/NEWS.d/next/Security/2025-05-29-03-24-18.gh-issue-134873.dziqkQ.rst
 Fix a DOS vulnerability in :mod:`idlelib` regarding string slicing.
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1203,10 +1203,7 @@ def load_extension(self, name):
		self.apply_bindings(keydefs)
		for vevent in keydefs:
		methodname = vevent.replace("-", "_")
		while methodname[:1] == '<':
		methodname = methodname[1:]
		while methodname[-1:] == '>':
		methodname = methodname[:-1]
johnzhou721 marked this conversation as resolved. Show resolvedHide resolved
		methodname = methodname.lstrip('<').rstrip('>')
		methodname = methodname + "_event"
		if hasattr(ins, methodname):
		self.text.bind(vevent, getattr(ins, methodname))
Expand DownExpand Up		@@ -1341,6 +1338,24 @@ def set_indentation_params(self, is_py_src, guess=True):
		self.usetabs = False
		self.set_tk_tabwidth(self.tabwidth)

		def delete_trail_whitespace(self, want, chars, tabwidth):
		current_pos = 0
		ncharsretained = 0
		for char in chars:
		if char == '\t':
		current_pos = (current_pos // tabwidth + 1) * tabwidth
		else:
		current_pos += 1
		ncharsretained += 1
		if current_pos > want:
		ncharsretained -= 1
		break
		for i in range(ncharsretained, len(chars)):
		if chars[i] not in " \t":
		ncharsretained = i + 1
		chars = chars[:ncharsretained]
		return len(chars) - ncharsretained, chars

		def smart_backspace_event(self, event):
		text = self.text
		first, last = self.get_selection_indices()
Expand DownExpand Up		@@ -1369,13 +1384,7 @@ def smart_backspace_event(self, event):
		assert have > 0
		want = ((have - 1) // self.indentwidth) * self.indentwidth
		# Debug prompt is multilined....
picnixz marked this conversation as resolved. Show resolvedHide resolved
		ncharsdeleted = 0
		while True:
		chars = chars[:-1]
		ncharsdeleted = ncharsdeleted + 1
		have = len(chars.expandtabs(tabwidth))
		if have <= want or chars[-1] not in " \t":
		break
		ncharsdeleted, chars = self.delete_trail_whitespace(want, chars, tabwidth)
		text.undo_block_start()
		text.delete("insert-%dc" % ncharsdeleted, "insert")
		if have < want:
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -237,5 +237,22 @@ def test_rclick(self):
		pass


		class DeleteWantTest(unittest.TestCase):

		def test_delete_trail_whitespace(self):
		with unittest.mock.patch.object(Editor, '__init__', return_value=None) as mock_init:
		ew = Editor()
		test_str = "abcde" + 10000 * "\t" + 10000 * " "
		res_str = ew.delete_trail_whitespace(30000, test_str, 4)[1]
		self.assertEqual(res_str, "abcde" + 7499 * "\t")
		res_str = ew.delete_trail_whitespace(41005, test_str, 4)[1]
		self.assertEqual(res_str, "abcde" + 10000 * "\t" + 1001 * " ")
		res_str = ew.delete_trail_whitespace(3, test_str, 4)[1]
		self.assertEqual(res_str, "abcde")
		res_str = ew.delete_trail_whitespace(6, test_str, 4)[1]
		self.assertEqual(res_str, "abcde")
		res_str = ew.delete_trail_whitespace(30002, test_str, 4)[1]
		self.assertEqual(res_str, "abcde" + 7499 * "\t")

		if __name__ == '__main__':
		unittest.main(verbosity=2)
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		Fix a DOS vulnerability in :mod:`idlelib` regarding string slicing.