文档

测试

构建

Windows

macOS

工具/示例

C API

Python 3.12.0 alpha 3

Release date: 2022-12-06

安全性

This is done by changing the http.server BaseHTTPRequestHandler .log_message method to replace control characters with a \xHH hex escape before printing.

核心与内置函数

Previously, a reference leak in a typed C API-based extension module could leak internals of the typing module, which could in turn introduce leaks in essentially any other package with typed function signatures. Although the typing package is not the original source of the problem, such nonlocal dependences exacerbate debugging of large-scale projects, and the implementation was therefore changed to reduce harm by providing better isolation.

文档

测试

构建

Windows

macOS

工具/示例

  • gh-64490 [https://github.com/python/cpython/issues/64490]: Argument Clinic varargs bugfixes

    • Fix out-of-bounds error in PyArgUnpackKeywordsWithVararg().

    • Fix incorrect check which allowed more than one varargs in clinic.py.

    • Fix miscalculation of noptargs in generated code.

    • Do not generate noptargs when there is a vararg argument and no optional argument.

C API

Python 3.12.0 alpha 2

Release date: 2022-11-14

安全性

  • gh-98433 [https://github.com/python/cpython/issues/98433]: The IDNA codec decoder used on DNS hostnames by socket or asyncio related name resolution functions no longer involves a quadratic algorithm. This prevents a potential CPU denial of service if an out-of-spec excessive length hostname involving bidirectional characters were decoded. Some protocols such as urllib http 3xx redirects potentially allow for an attacker to supply such a name.

Individual labels within an IDNA encoded DNS name will now raise an error early during IDNA decoding if they are longer than 1024 unicode characters given that each decoded DNS label must be 63 or fewer characters and the entire decoded DNS name is limited to 255. Only an application presenting a hostname or label consisting primarily of RFC 3454 [https://datatracker.ietf.org/doc/html/rfc3454.html] section 3.1 "Nothing" characters to be removed would run into of this new limit. See also RFC 5894 [https://datatracker.ietf.org/doc/html/rfc5894.html] section 6 and RFC 3491 [https://datatracker.ietf.org/doc/html/rfc3491.html].

核心与内置函数

The availability of these functions enables more efficient PEP 590 [https://peps.python.org/pep-0590/] vector calls from binary extension modules that avoid argument boxing/unboxing overheads.

Extensions implementing their own interpreters using PEP 523 need to be aware of this shim frame and the changes to the semantics of RETURN_VALUE, YIELD_VALUE, and RETURN_GENERATOR, which now clear the frame.

文档

测试

构建

Windows

macOS

C API