Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork32k
Fix bpo-29528 Use a secure variable to stop spam#13
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Merged
Uh oh!
There was an error while loading.Please reload this page.
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.Learn more about bidirectional Unicode characters
If the IRC notification is stored in plaintext, then anyone who forksthe repository and also adds it to travis will send notifications tothe IRC channel for their fork by default. Since the secure variableis encrypted using a repository specific key, this will only work whenit is being built using the correct repository.
vstinner approved these changesFeb 11, 2017
paulmon added a commit to paulmon/cpython that referenced this pull requestJan 10, 2019
fix importlib and distutils formatting of platform tag for ARM
emmatyping added a commit to emmatyping/cpython that referenced this pull requestMar 16, 2020
nanjekyejoannah added a commit to nanjekyejoannah/cpython that referenced this pull requestNov 29, 2022
13: warn for hmac and hexlify r=ltratt a=nanjekyejoannahThis PR adds warnings for the following modules:- `hmac`- `binascii.hexlify`- `binascii.b2a_hex`See the notes below:1. warn for the 'digest' parameter in hmac in pygrate2In Python 2:```>>> import hashlib>>> import hmac>>> string1 = 'firststring'.encode('utf-8')>>> string2 = 'secondstring'.encode('utf-8')>>> digest = hmac.new(key=string1, msg=string2, digestmod=hashlib.sha256).digest()>>> digest = hmac.new(key=string1, msg=string2).digest() >>> ```In Python 3:```string1 = 'firststring'.encode('utf-8')>>> string2 = 'secondstring'.encode('utf-8')>>> digest = hmac.new(key=string1, msg=string2, digestmod=hashlib.sha256).digest()Traceback (most recent call last): File "<stdin>", line 1, in <module>NameError: name 'hmac' is not defined>>> import hashlib>>> import hmac>>> digest = hmac.new(key=string1, msg=string2, digestmod=hashlib.sha256).digest()>>> digest = hmac.new(key=string1, msg=string2).digest() Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/local/Cellar/python@3.9/3.9.12_1/Frameworks/Python.framework/Versions/3.9/lib/python3.9/hmac.py", line 170, in new return HMAC(key, msg, digestmod) File "/usr/local/Cellar/python@3.9/3.9.12_1/Frameworks/Python.framework/Versions/3.9/lib/python3.9/hmac.py", line 56, in __init__ raise TypeError("Missing required parameter 'digestmod'.")TypeError: Missing required parameter 'digestmod'.>>> ```2. Warn for hexlify In python 2:```>>> import codecs>>> hexlify = codecs.getencoder('hex')>>> hexlify(b'Blaah')[0]'426c616168'>>> import binascii>>> binascii.hexlify(b'Blaah')'426c616168'>>> binascii.hexlify('Blaah')'426c616168'>>> ```In Python 3:```>>> import codecs>>> hexlify = codecs.getencoder('hex')>>> hexlify(b'Blaah')[0]b'426c616168'>>> import binascii>>> binascii.hexlify(b'Blaah')b'426c616168'>>> binascii.hexlify('Blaah')Traceback (most recent call last): File "<stdin>", line 1, in <module>TypeError: a bytes-like object is required, not 'str'>>> ```Co-authored-by: Joannah Nanjekye <jnanjekye@python.org>
nanjekyejoannah added a commit to nanjekyejoannah/cpython that referenced this pull requestDec 1, 2022
16: Warn for specific thread module methods r=ltratt a=nanjekyejoannahDont merge untilpython#13 andpython#14 are merged, some helper code cuts across.This replacespython#15 Threading module NotesPython 2:```>>> from thread import get_ident>>> from threading import get_identTraceback (most recent call last): File "<stdin>", line 1, in <module>ImportError: cannot import name get_ident>>> import threading>>> from threading import _get_ident>>>```Python 3:```>>> from threading import get_ident>>> from thread import get_identTraceback (most recent call last): File "<stdin>", line 1, in <module>ModuleNotFoundError: No module named 'thread'>```**Note:**There is no neutral way of portingCo-authored-by: Joannah Nanjekye <jnanjekye@python.org>
jaraco pushed a commit that referenced this pull requestDec 2, 2022
oraluben referenced this pull request in oraluben/cpythonJun 25, 2023
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
If the IRC notification is stored in plaintext, then anyone who forks the repository and also adds it to travis will send notifications to the IRC channel for their fork by default. Since the secure variable is encrypted using a repository specific key, this will only work when it is being built using the correct repository.