penguinolog / urwid

86%

master: 86%

LAST BUILD ON BRANCH fix-edit-security

branch: fix-edit-security

CHANGE BRANCH

x

Reset

Sync Branches

• fix-edit-security
• 2.4.1
• 2.4.2
• 2.4.3
• 2.4.4
• 2.4.5
• 2.4.6
• 2.5.0
• 2.5.1
• 2.5.2
• 2.5.3
• 2.6.0
• 2.6.0.post0
• 2.6.1
• 2.6.11
• 2.6.12
• 2.6.13
• 2.6.14
• 2.6.15
• 2.6.16
• 2.6.2
• 2.6.3
• 2.6.4
• 2.6.5
• 2.6.6
• 2.6.7
• 2.6.8
• 2.6.9
• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 4.0.0
• 4.0.1
• 4.0.10
• 4.0.11
• 4.0.12
• 4.0.13
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0.5
• 4.0.6
• 4.0.7
• 4.0.8
• 4.0.9
• 4.1.0
• 4.1.1
• 4.1.2
• 4.1.3
• 4.1.4
• 4.1.5
• 4.1.6
• 4.1.7
• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.4
• AttrMap_compat
• ListBox_relative_scroll
• add_run_in_exectutor
• annotations
• artifacts_bdist
• async_callbacks
• async_in_event_loop
• attr_shadow_attr
• bar_graph
• base_class_events
• big_text_static_text
• black
• bug_layout
• bug_rows_max_listbox
• bug_scrollable_no_size
• build_limited_api
• builld-system
• bump_ruff
• canvas_optimisation
• changelog_406
• changelog_407
• changelog_gen
• changelog_pre-release
• check_mixed
• ci_actionlint
• ci_cd_extend
• ci_cd_generate_changelog
• ci_ci
• ci_finalise_uv
• ci_project
• ci_py314
• ci_tests
• ci_try_enable_osx
• class_docstrings
• classifiers
• clean-up
• clean_graphics
• cleanup
• cleanup_code
• cleanup_helper
• cleanup_unused
• closed_io
• code_cleanup
• columns_accept_focus_widget
• columns_consistency
• columns_maxcol
• columns_optimisation
• columns_render
• columns_special_case_fixed
• columns_support_fixed
• columns_zero_width
• command_enum
• command_map_api_extend
• constants_symbols
• container_deprecated_setters
• content_validation
• corner_case_ellipsis_not_fit
• cover_listbox_scrollable
• coverage_no_tests
• coverage_special
• curses_fix
• deduplicate
• deprecate_content_delta
• deprecate_progress_bar_set_done
• deprecated_attr_wrap
• deprecated_decoration
• deprecated_fix
• deprecated_positioning
• deprecated_public
• deprecation
• deprecation_binary_font
• deprecation_deadline
• deprecation_part0
• deprecation_part1
• deprecation_part2
• deprecation_part3
• deprecation_release_4
• deprecation_super
• deprecations
• deprecations_term_scroller
• deque_walker_ansi_parser
• descriptors
• devcontainer
• devcontainers
• disallow_broken_wcwidth
• doc
• doc-draw-screen-thread
• doc_env
• doc_event_loop
• doc_examples
• doc_fix_typo
• doc_raises
• doc_windows
• docs
• docs_build
• docs_changelog
• docs_disconnect_by_key
• docs_fixes
• docs_readability
• docs_screenshots
• docs_scrollable
• docstrings
• document_fix_graalpy
• drop_c_helper
• drop_unused
• ds_store
• edit_typing
• editorconfig
• empty_grid_flow
• enable_typing
• enable_windows_asyncio_tests
• escape_test
• event_loop
• event_loop_executor
• example_browse
• examples_code_style
• examples_deprecated
• exceptiongroup
• expand_tabs
• expose_widget
• extend_scrollable
• extra_input_handling
• extra_tests
• extra_typing
• faint_extend
• feat_font
• feat_terminal_detection
• feat_tornado
• feature_canvas_repr
• feature_fixed_text
• feature_selectors
• feature_wimp_pack
• fix-ansitext-security
• fix-asyncio-loop-cleanup
• fix-attribute-defined-outside-init
• fix-bargraph-security
• fix-canvascache-leak
• fix-columns-security
• fix-deque-insert-index
• fix-event-loop-stale-watch
• fix-gpm-tracking
• fix-input-parser-crashes
• fix-listbox-emptied-body-focus
• fix-listbox-security
• fix-main-loop-cleanup
• fix-osc-esc-termination
• fix-pile-security
• fix-posix-input-read
• fix-progressbar-security
• fix-raw-display-c1-controls
• fix-raw-screen-socket-cycle
• fix-setup-g1-hang
• fix-signal-handler-races
• fix-signals-leak
• fix-text-control-chars
• fix-text-pack-tab-stops
• fix-text-security
• fix-tree-security
• fix-watch-pipe
• fix-widget-races
• fix-win32-input-thread
• fix-zmq-watch-keys
• fix_build_windows
• fix_display_typing
• fix_docstring_event_loop
• fix_docstrings
• fix_font
• fix_import_warn
• fix_imports_moved
• fix_listbox_render_empty_elements
• fix_overlay
• fix_ovl_items_replace
• fix_py312
• fix_readme
• fix_regressions
• fix_rerais
• fix_rle_product
• fix_rows_typing
• fix_ruff
• fix_term_scroll
• fix_toc_html
• fix_tree_listbox_render_empty_elements
• fix_zope.interface
• fixed_flow_overlay
• fixes
• flow_filler
• frame_fix
• frame_focus
• get_cursor_coord
• gitter_badge
• glib_deprecation
• grid_flow_support_fixed
• gridflow_focus
• handle_mypy_warnings
• handle_non_subclassed_widget
• html_fragment
• html_fragment-deprecate_monkeypatch
• implement_scrollbar_layout
• imports_deprecation_warning
• initial_mypy
• isort
• iterable_microopt
• join_display
• khal_insufficient_padding_width
• kill_py37_py38
• labeler_scope
• labeler_update_rules
• lazy_imports
• lazy_load_explicit_package
• lb_max_left_right
• line_box
• line_box_double_inheritance
• line_box_replace
• listbox_contents
• listbox_guard_walker
• listbox_tests
• live-container-selectable
• logging
• maintenance_code_quality
• maintenance_internal
• maintenance_labeler
• maintenance_pre_commit
• maintenance_pyproject
• maintenance_pytest
• maintenance_ruff
• maintenance_rules
• maintenance_typing
• maintenance_yamllint
• master
• meta_super_position
• missed_test
• missed_tests
• monitored_list_move
• monkeypathch_pad
• move_listbox_tree
• mro_simplefocuslistwalker
• mypy_global_fixes
• mypy_warnings
• nested_popups
• numedit
• optimisations
• optimise_signals
• optional_dependencies
• outdated-scripts
• overlay_typing_repr
• pack_extra
• pack_on_edit
• packaging_setup
• packaging_tests
• packaging_unstable_test
• padding_given
• padding_pack_weight
• padding_support_fixed
• palette-hashable-names
• part_f_keys
• part_osx
• pep_424_lazy
• pile_support_fixed
• poc_gen_changelog
• posix_raw_display_optimise
• pr_template
• pre-412
• pre-release_changelog
• pre_305
• pre_4.0.2
• pre_4010
• pre_4011
• pre_4012
• pre_4013
• pre_404
• pre_405
• pre_409
• pre_410
• pre_411
• pre_413
• pre_414
• pre_415
• pre_416
• pre_417
• pre_420
• pre_421
• pre_422
• pre_423
• pre_424
• pre_425
• pre_release
• prep_2_2_2
• prep_403
• prepare_408
• provisional_typing
• py312_no_bdist
• py313
• py_version_description
• pydocstyle
• pylint
• pylint_silence
• pylint_warnings
• raw_display_optimization
• raw_display_var_naming
• raw_display_windows_resize
• raw_input_optimizations
• ref_dead_code
• refactor_scrollable
• refactor_super
• refactoring_code_style
• refurb
• refurb_fixes
• regression_enums
• regression_linebox
• regression_ovl_relative
• regression_treetools
• regressions
• rel_3.0
• rel_3.0.1
• rel_3.0.2
• relnotes-release
• remove_temporary_dev_script
• requirements_security
• restore_palette
• restore_win32_support
• rich_repr
• ruff
• ruff_0_2
• ruff_bump
• ruff_up
• ruff_update
• screenshots_trminus
• scrollable
• scrollable_annotations
• scrollable_bar
• scrollable_bug
• scrollable_listbox
• scrollbar_estimated_size
• security_rules
• selectable_icon
• setuptools_scm_api
• sgrmouse_shift_handle
• shard_body_row_fix
• shards_inconsistency
• signals_subclass_abc
• sigstp
• simplify_code
• sizing_columns
• sizing_container_list_contents
• sizing_fixes
• slots-safe-places
• special_case_empty_columns_pile
• sphinx_build_gh_pages_ready
• split_widget_enums
• static_check_fix
• static_checks
• static_fix
• static_fixes
• static_update
• stop_monkeypatch
• str_optimise
• strict_mypy
• strict_typing
• support_sync_output
• symbols_use_dataclass
• test_req_fix
• test_tree
• test_vterm
• tests
• tests_display_restart
• tests_explicit_encoding
• tests_org
• tests_organisation
• tests_windows
• text-layout-cache-thread-safety
• text_fixed_api
• text_layout
• text_layout_encoding
• text_pack
• tree
• tree_undeprecate
• treetools_coverage
• treetools_regression
• trio_typing
• type_annotations_trivial
• typing
• typing_
• typing_attr_map
• typing_attr_wrap
• typing_bar_graph
• typing_big_text_progress_bar
• typing_canvas
• typing_containders
• typing_display
• typing_errors
• typing_escape
• typing_event_loop
• typing_examples
• typing_filler_
• typing_fixes
• typing_generic
• typing_glib_loop
• typing_issues
• typing_listbox
• typing_literal_constants
• typing_monitored_list
• typing_part_listbox
• typing_polish
• typing_radiobutton_checkbox
• typing_silence
• typing_split_repr-command_map
• typing_text
• typing_util_part_canvas
• typing_widget
• typing_widget_decoration
• typing_widget_vterm_edit
• typing_wimp
• typo_job_name
• un-deprecate_user_arg
• unicode_line_breaks
• unicode_table
• unicode_win
• unwarn_escape
• update_black
• update_checkers
• update_screenshots
• upload_download_artifact
• use_base_class_for_row_display
• uuid_as_signal_key
• watch_pipe_implicit_none
• wcwidth_unicode_auto
• web_display
• web_display_fixes
• web_display_id
• web_display_init
• web_encoding_handling
• web_resize
• weight_float
• wheels_only_upstream
• widget_like
• widget_mouse_keypress
• widget_type
• win_support_mark
• window_resize_trottle
• windows_asyncio
• windows_curses
• windows_event_debug
• windows_garbage_commands
• windows_last_line
• windows_use_unicode_input
• workflow_labeler
• wsl_fix
• zmq_loop_async

Build # 37016981947

Build Type

push

github

Committed by penguinolog

Commit Message

Harden Edit against text leaks and control input

A masked Edit exposed its text outside the rendered canvas, and
the input filters let through characters that break layout or
conversion:

- Edit repr shows the masked text and the mask instead of the text.
- insert_text_result keeps the text out of its ValueError when masked.
- valid_char refuses Unicode control characters (Cc) and DEL bytes,
  which render as "?" but count as zero columns.
- IntEdit refuses a digit that would take the text past
  sys.get_int_max_str_digits(), so value() can convert what the user
  typed.

Coverage Stats

4611 of 5546 branches covered (83.14%)

Branch coverage included in aggregate %.

11 of 12 new or added lines in 1 file covered. (91.67%)

11568 of 13200 relevant lines covered (87.64%)

9.79 hits per line