gh-141778: add missing validation in ast.literal_eval() for non-string input - #142969
gh-141778: add missing validation in ast.literal_eval() for non-string input#142969skirpichev wants to merge 12 commits into
Conversation
…-string input This also changes parsing of the private `__text_signature__` attribute by inspect.signature(). Now we accept here only types, valid for ast.Constant().
| _type_Ellipsis = type(...) | ||
|
|
||
|
|
||
| def _convert_literal(node, omit_validation=False): |
There was a problem hiding this comment.
Why do we need this change? It may make life harder for some users.
There was a problem hiding this comment.
Could you be more precise, any example?
We need this, because literal_eval() accepts invalid AST for non-string input. Per documentation:
The string or node provided may only consist of the following Python literal structures: strings, bytes, numbers, tuples, lists, dicts, sets, booleans, None and Ellipsis.
There was a problem hiding this comment.
Based on case from stdlib (_signature_fromstr()), I think that possible cases of using this undocumented feature are rare, if exist at all.
Though, we can properly deprecate old behavior for extra safety.
Documentation build overview
439 files changed ·
|
previously IntEnum was rendered as 2. I think we should rather preserve repr for int's subclass, like pure-Python methods do. see also python#61005
|
I can split out sentinel support to a separate pr. |
2 participants
Also support sentinel in the literal_eval().
This also changes parsing of the private
__text_signature__attribute byinspect.signature(). Now we accept here only types, valid forast.Constant().The signature of
_thread.interrupt_main()was marked as unsupported. I think it's a reasonable regression. Previously it was rendered with2as default. I think we should rather preserve repr for int's subclasses, like pure-Python methods do. See also #61005.