Skip to content

Instantly share code, notes, and snippets.

@devdanzin
devdanzin / io_archive_files.md
Created March 18, 2026 11:25
CPython Lib/ Audit: Lib/ IO/Archive Files Audit — 5 Critical, 8 High

Lib/ IO/Archive Files Audit — 5 Critical, 8 High

Files Analyzed

pickle.py (1,962), tarfile.py (3,171), zipfile/init.py (2,391), shutil.py (1,670), tempfile.py (977), pdb.py (3,707), contextlib.py (797), configparser.py (1,415)

Critical Issues

1. tarfile: PAX header numeric fields silently coerced to zero (tarfile.py:1647-1650)

Invalid uid/gid/size/mtime in PAX headers → silently replaced with 0. size=0 truncates extracted files. uid=0 means root ownership. Security-relevant.

@devdanzin
devdanzin / large_files.md
Created March 18, 2026 11:25
CPython Lib/ Audit: Lib/ Large Files Audit (typing, argparse, inspect, subprocess, dataclasses) — 5 Critical, 8 High

Lib/ Large Files Audit (typing, argparse, inspect, subprocess, dataclasses) — 5 Critical, 8 High

Critical

  1. typing.py: _tp_cache swallows TypeError from cached function (typing.py:420-423): except TypeError intended for unhashable args also catches TypeError raised inside the function. Double-call with side effects.

  2. typing.py: _collect_protocol_members catches except Exception (typing.py:1891): Too broad for __annotations__ access. Masks broken metaclasses, produces wrong isinstance results.

  3. typing.py: _GenericAlias.__call__ catches except Exception for __orig_class__ (typing.py:1290): Masks bugs in __setattr__.

@devdanzin
devdanzin / importlib_logging.md
Created March 18, 2026 11:25
CPython Lib/ Audit: Lib/importlib + Lib/logging Audit — 5 Critical, 7 High

Lib/importlib + Lib/logging Audit — 5 Critical, 7 High

Critical

  1. SocketHandler.send() silently drops log records on network failure (logging/handlers.py:643): OSError caught inside send(), never propagated to emit(). Log records silently lost during network interruptions.

  2. Logging config listener uses eval-like fallback with broad except (logging/config.py:996-1008): dictConfig() failure falls through to fileConfig(). If dictConfig partially cleared handlers, logging system left in inconsistent state.

  3. Pyc validation catches ImportError silently (importlib/_bootstrap_external.py:867): Damaged Python installation silently falls back to source compilation.

@devdanzin
devdanzin / http_multiprocessing_concurrent.md
Created March 18, 2026 11:25
CPython Lib/ Audit: Lib/http + multiprocessing + concurrent Audit — 7 Critical, 9 High

Lib/http + multiprocessing + concurrent Audit — 7 Critical, 9 High

Critical

  1. Queue feeder thread silently drops unpicklable objects (multiprocessing/queues.py:262): put() returns successfully but item never delivered. Silent data loss.
  2. Manager shutdown silently ignores connection failures (multiprocessing/managers.py:670): except Exception: pass around entire shutdown dispatch. Zombie manager processes.
  3. resource_tracker bare except: pass (multiprocessing/resource_tracker.py:383): Catches SystemExit/KeyboardInterrupt. Leaked system resources go undetected.
  4. cookiejar silently drops ALL cookies on parsing exception (http/cookiejar.py:1617): Single malformed cookie header drops entire batch. Session/auth cookies vanish.
  5. resource_tracker warning suppression (multiprocessing/resource_tracker.py:401): except Exception: pass around warnings.warn() — leaked resources invisible.
  6. Manager serve_client swallows send failures (multiprocessing/managers.py:310): Clien
@devdanzin
devdanzin / email_xml.md
Created March 18, 2026 11:25
CPython Lib/ Audit: Lib/email + Lib/xml Audit — 4 Critical, 6 High

Lib/email + Lib/xml Audit — 4 Critical, 6 High

Critical

  1. Bare except: in SAX external entity resolution (xml/sax/expatreader.py:427): Catches SystemExit, KeyboardInterrupt, ALL errors during entity parsing. Has FIXME comment acknowledging the problem. Error info completely lost.

  2. Bare except: in email header parser (email/_header_value_parser.py:2544): except: pass catches everything during get_extended_attrtext. Every other get_* call catches HeaderParseError — this is inconsistent.

  3. decode_b() returns inconsistent type on failure (email/_encoded_words.py:136): Returns raw bytes on base64 error, caller decodes with charset → silently garbled text.

@devdanzin
devdanzin / asyncio.md
Created March 18, 2026 11:25
CPython Lib/ Audit: Lib/asyncio Audit — 3 Critical, 8 High

Lib/asyncio Audit — 3 Critical, 8 High

Critical

  1. _accept_connection2 silently swallows ALL errors unless debug mode (selector_events.py:249-262): When self._debug=False (default), any exception from protocol_factory() or transport creation is completely silenced. Incoming connections vanish. Highest-impact fix — always call call_exception_handler.

  2. _fatal_error discards OSError unless debug mode (5 locations across 4 files): Method named "fatal_error" silently discards the most common real-world transport failures in production. Network problems go unreported.

  3. shutdown_asyncgens checks Exception not BaseException (base_events.py:588-589): gather(return_exceptions=True) returns BaseException instances. Custom BaseException subclasses (e.g., trio.Cancelled) silently lost.

@devdanzin
devdanzin / lib_summary.md
Created March 18, 2026 11:25
CPython Lib/ Audit: Lib/ Directory Audit — Final Summary

Lib/ Directory Audit — Final Summary

Scope

~94,000 lines of Python code across 6 batches covering asyncio, email, xml, http, multiprocessing, concurrent.futures, importlib, logging, typing, argparse, inspect, subprocess, dataclasses, pickle, tarfile, zipfile, shutil, tempfile, pdb, contextlib, configparser.

Results: 26 Critical + 38 High issues

By Module Group

@devdanzin
devdanzin / typing_broad_except.md
Created March 18, 2026 11:25
CPython Lib/ bug: typing.py: Multiple `except Exception` too broad for annotation/attribute access

typing.py: Multiple except Exception too broad for annotation/attribute access

Summary

Lines 1290, 1891, 2141: except Exception: pass used to guard __annotations__ and __orig_class__ access. Masks broken metaclasses, buggy __setattr__, producing wrong isinstance results for Protocol classes.

Fix

Narrow to specific exception types (AttributeError, TypeError).

@devdanzin
devdanzin / tarfile_raise_e.md
Created March 18, 2026 11:25
CPython Lib/ bug: tarfile.py: `raise e` loses traceback in next()

tarfile.py: raise e loses traceback in next()

Summary

At line 2892, raise e (instead of bare raise) resets the traceback to the current line, losing the original error location. Makes debugging corrupt tar files much harder.

Reproducer

import tarfile
@devdanzin
devdanzin / tarfile_pax_coercion.md
Created March 18, 2026 11:25
CPython Lib/ bug: tarfile.py: PAX header numeric fields silently coerced to zero — security-relevant

tarfile.py: PAX header numeric fields silently coerced to zero — security-relevant

Summary

Invalid numeric values in PAX extended headers (uid, gid, size, mtime) are silently replaced with 0 at tarfile.py:1647-1650. For size, this truncates extracted files. For uid, this means root ownership. Security-relevant.

Reproducer

import tarfile, io