Add `limit=` keyword to `int()` and `str()` functions to avoid contention on global `PYTHONINTMAXSTRDIGITS`
還沒有人認領這個 Issue。
評估
研究方向
先從連結的 discuss.python.org 提案及其引用的討論開始，然後檢查 CPython 目前如何將 PYTHONINTMAXSTRDIGITS 套用於 int() 和 str() 轉換。該 issue 未指定原始碼檔案或測試，因此需要在開始工作之前就 API 行為、實作範圍和涵蓋範圍達成共識。
由索引模型根據 Issue 內容生成。
描述
Enhancement
With the mitigations for CVE-2020-10735 in place, there's tension between:
- security-minded folks which need to protect against DoS attacks
- scientific (and other) use-cases which need to process large numbers in some form
Those are both vying for the one setting (PYTHONINTMAXSTRDIGITS) that controls this, which is unfortunately global state.
Since several such libraries are often loaded in the same runtime, this makes it very tricky to balance.
The idea is simply to add a limit=None keyword to int() and str(), which defaults to PYTHONINTMAXSTRDIGITS if None, but can be set to any other value. Setting it to 0 (for example, or -1) would make it unlimited.
Pitch
This would not solve all the fallout right away, but it would provide a sane path forward, where the default can be safe, and callsites can explicitly opt into saying "I want this call to have a different limit".
In particular, it would not require global state to balance the divergent needs of different parts of the ecosystem anymore.
In case a spectacular new conversion algorithm comes along, the default could eventually be set to infinite again, but the API wouldn't stand out as useless/harmful, but still serve a clear purpose, and so this proposal is independent of future string algorithms or default limits.
Previous discussion
https://discuss.python.org/t/int-str-conversions-broken-in-latest-python-bugfix-releases/18889/
and many more places linked from there
- 主要語言
- Python
- 星號
- 77.2k
- 分支
- 36k
- 平均合併
- 1 天 9 小時
- 30 天內合併 PR
- 558
貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
python/cpython 的其他 Issue
-
docs pending
難度 2/5 1-3 小時 新手友好度 78/100
-
stdlib type-feature
難度 2/5 1-3 小時 新手友好度 78/100
-
stdlib type-feature
難度 2/5 1-3 小時 新手友好度 72/100
-
build type-bug
難度 2/5 1-3 小時 新手友好度 76/100
-
stdlib topic-email type-feature
難度 2/5 1-3 小時 新手友好度 70/100
相似的 Issue
-
難度 1/5 1 小時以內 新手友好度 90/100
-
bug
難度 2/5 1-3 小時 新手友好度 86/100
zostera/django-bootstrap4#894 ·
-
難度 2/5 1-3 小時 新手友好度 78/100
use-agent-os/agent-os#3276 ·
-
難度 2/5 1-3 小時 新手友好度 88/100
zephyrproject-rtos/zephyr#119726 ·
-
area/auth bug comp/agent P3 platform/discord type/security
難度 2/5 1-3 小時 新手友好度 88/100
NousResearch/hermes-agent#117848 ·