penguinolog / urwid

94%

master: 94%

LAST BUILD ON BRANCH web-initial-request-decode

branch: web-initial-request-decode

CHANGE BRANCH

x

Reset

Sync Branches

• web-initial-request-decode
• 2.4.1
• 2.4.2
• 2.4.3
• 2.4.4
• 2.4.5
• 2.4.6
• 2.5.0
• 2.5.1
• 2.5.2
• 2.5.3
• 2.6.0
• 2.6.0.post0
• 2.6.1
• 2.6.11
• 2.6.12
• 2.6.13
• 2.6.14
• 2.6.15
• 2.6.16
• 2.6.2
• 2.6.3
• 2.6.4
• 2.6.5
• 2.6.6
• 2.6.7
• 2.6.8
• 2.6.9
• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 4.0.0
• 4.0.1
• 4.0.10
• 4.0.11
• 4.0.12
• 4.0.13
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0.5
• 4.0.6
• 4.0.7
• 4.0.8
• 4.0.9
• 4.1.0
• 4.1.1
• 4.1.2
• 4.1.3
• 4.1.4
• 4.1.5
• 4.1.6
• 4.1.7
• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4
• 4.2.5
• 5.0.0
• 5.0.1
• 5.1.0
• AttrMap_compat
• ListBox_relative_scroll
• add-xterm-insert-keypad-keys
• add_run_in_exectutor
• annotations
• ansi-text-raw-display-attributes-3
• artifacts_bdist
• ascii-fallbacks
• async_callbacks
• async_in_event_loop
• attr_shadow_attr
• bar_graph
• base_class_events
• big_text_static_text
• bigtext-fonts
• black
• bug_layout
• bug_rows_max_listbox
• bug_scrollable_no_size
• build_limited_api
• builld-system
• bump_ruff
• button-brackets-selectable-text
• calc-example
• call-from-thread
• canvas_optimisation
• changelog
• changelog-5.0.0
• changelog-5.1.0
• changelog-5.1.1
• changelog-5.1.2
• changelog-5.1.3
• changelog_406
• changelog_407
• changelog_501
• changelog_gen
• changelog_pre-release
• check_mixed
• ci/pypy-tests
• ci_actionlint
• ci_cd_extend
• ci_cd_generate_changelog
• ci_ci
• ci_finalise_uv
• ci_project
• ci_py314
• ci_tests
• ci_try_enable_osx
• ci_tuning
• class_docstrings
• classifiers
• clean-up
• clean_graphics
• cleanup
• cleanup_code
• cleanup_helper
• cleanup_unused
• clear-iexten
• clipboard-copy-osc52
• closed_io
• code_cleanup
• columns-hidden-columns
• columns_accept_focus_widget
• columns_consistency
• columns_maxcol
• columns_optimisation
• columns_render
• columns_special_case_fixed
• columns_support_fixed
• columns_zero_width
• command-map-help
• command_enum
• command_map_api_extend
• constants_symbols
• container-focus-changed-hook
• container_deprecated_setters
• content_validation
• corner_case_ellipsis_not_fit
• cover_listbox_scrollable
• coverage_no_tests
• coverage_special
• curses_fix
• deduplicate
• deprecate-lcd-display
• deprecate_content_delta
• deprecate_progress_bar_set_done
• deprecated_attr_wrap
• deprecated_decoration
• deprecated_fix
• deprecated_positioning
• deprecated_public
• deprecation
• deprecation-process-2
• deprecation_binary_font
• deprecation_deadline
• deprecation_part0
• deprecation_part1
• deprecation_part2
• deprecation_part3
• deprecation_release_4
• deprecation_super
• deprecations
• deprecations_for_5
• deprecations_handle
• deprecations_term_scroller
• deque_walker_ansi_parser
• descriptors
• devcontainer
• devcontainers
• disable-macos-ci
• disallow_broken_wcwidth
• display-hardening
• display-leftovers-csi-key
• doc
• doc-console-fonts
• doc-draw-screen-thread
• doc_env
• doc_event_loop
• doc_examples
• doc_fix_typo
• doc_raises
• doc_update
• doc_windows
• docs
• docs-pdf
• docs-symbol-console-coverage
• docs-textcanvas-attr-examples
• docs_build
• docs_changelog
• docs_disconnect_by_key
• docs_fixes
• docs_readability
• docs_screenshots
• docs_scrollable
• docstring-fields
• docstrings
• document_fix_graalpy
• drop-down-widget
• drop-graalpy
• drop_c_helper
• drop_unused
• dropdown-postchange
• dropdown-single-option-read-only
• ds_store
• edit-cancel-signal
• edit-grapheme-cursor
• edit-kill-buffer
• edit-max-length
• edit-placeholder-validator-completer
• edit-postchange-intedit-ellipsis
• edit-text-pos-readline-submit
• edit-validated-signal
• edit_typing
• editorconfig
• empty_grid_flow
• enable_typing
• enable_windows_asyncio_tests
• escape-sequence-fixes
• escape_test
• event_loop
• event_loop_executor
• example_browse
• examples_code_style
• examples_deprecated
• exceptiongroup
• expand_tabs
• expose_widget
• extend_scrollable
• extended-keyboard
• extra_input_handling
• extra_tests
• extra_typing
• faint_extend
• faster-container-sizing
• faster-overlay
• feat_font
• feat_terminal_detection
• feat_tornado
• feature/ansi-osc8-hyperlinks
• feature/inherit-attr
• feature/osc8-hyperlinks
• feature/radio-button-selected-button
• feature/running-loop
• feature_canvas_repr
• feature_fixed_text
• feature_selectors
• feature_wimp_pack
• filtered-list-walker
• fix-ansitext-security
• fix-asyncio-loop-cleanup
• fix-attribute-defined-outside-init
• fix-bargraph-security
• fix-base-widget-mock-loop
• fix-canvascache-leak
• fix-columns-cursor-dropped-column
• fix-columns-security
• fix-deque-insert-index
• fix-display-event-loop-typing
• fix-edit-override-cursor
• fix-edit-security
• fix-event-loop-callbacks
• fix-event-loop-stale-watch
• fix-fallback-call-test-flake
• fix-focus-list-pickle
• fix-gpm-tracking
• fix-gridflow-wheel-and-hidden-focus
• fix-hangup-teardown
• fix-input-parser-crashes
• fix-layout-attributes-invalidate
• fix-lcd-get-input
• fix-listbox-emptied-body-focus
• fix-listbox-focus-moves
• fix-listbox-security
• fix-macos-dev-tty-selector
• fix-main-loop-cleanup
• fix-mouse-tracking-restart
• fix-numedit-negative-zeros
• fix-osc-esc-termination
• fix-pile-security
• fix-pop-up-size-type
• fix-popup-false-widget-and-stubs
• fix-posix-input-read
• fix-progressbar-security
• fix-quadratic-input-decoding
• fix-radiobutton-initial-state
• fix-raw-display-c1-controls
• fix-raw-display-fallback-size
• fix-raw-screen-socket-cycle
• fix-reverse-video-cost
• fix-scrollbar-decorated-widget
• fix-scrollbar-keypress-before-render
• fix-setup-g1-hang
• fix-signal-handler-races
• fix-signals-leak
• fix-terminal-keypress-before-render
• fix-text-control-chars
• fix-text-pack-tab-stops
• fix-text-security
• fix-tree-security
• fix-watch-pipe
• fix-widget-races
• fix-win32-console-size
• fix-win32-input-thread
• fix-zmq-watch-keys
• fix/deque-insert-index-pypy
• fix/hidden-focus-candidates
• fix/space-wrap-zero-width-before-break
• fix/terminal-watch-handle
• fix/vterm-defects-2
• fix_asyncio_del_closed_loop
• fix_build_windows
• fix_display_typing
• fix_docstring_event_loop
• fix_docstrings
• fix_edit
• fix_font
• fix_import_warn
• fix_imports_moved
• fix_listbox_render_empty_elements
• fix_overlay
• fix_ovl_items_replace
• fix_py312
• fix_readme
• fix_regressions
• fix_rerais
• fix_rle_product
• fix_rows_typing
• fix_ruff
• fix_term_scroll
• fix_toc_html
• fix_tree_listbox_render_empty_elements
• fix_zope.interface
• fixed_flow_overlay
• fixes
• flow_filler
• focus-deque-moved-callback
• follow-end-walkers
• font-hex-and-math-glyphs
• frame-flow-opt-in
• frame-focus-changed-signal
• frame-min-body-rows
• frame_fix
• frame_focus
• freebsd-console-mouse
• get_cursor_coord
• gitter_badge
• glib_deprecation
• gpm-virtual-console
• graalpy-pickle-and-checker-fixes
• grid_flow_support_fixed
• gridflow_focus
• handle_mypy_warnings
• handle_non_subclassed_widget
• html_fragment
• html_fragment-deprecate_monkeypatch
• implement_scrollbar_layout
• imports_deprecation_warning
• in-band-resize
• initial_mypy
• input-closed-error
• integeredit-default-corner-cases
• isort
• iterable_microopt
• join_display
• khal_insufficient_padding_width
• kill_py37_py38
• labeler_scope
• labeler_update_rules
• last-row-zero-width-and-escapes
• lazy_imports
• lazy_load_explicit_package
• lb_max_left_right
• line-box-fixed
• line_box
• line_box_double_inheritance
• line_box_replace
• linebox-long-title
• linebox-title-markup
• listbox-edge-stop
• listbox-empty-not-selectable
• listbox-fixes
• listbox-flow-opt-in
• listbox-flow-render
• listbox-scroll-and-search
• listbox-scroll-view
• listbox-wheel-selectable
• listbox_contents
• listbox_guard_walker
• listbox_tests
• live-container-selectable
• logging
• mainloop-paused-context
• maintenance_code_quality
• maintenance_internal
• maintenance_labeler
• maintenance_pre_commit
• maintenance_pyproject
• maintenance_pytest
• maintenance_ruff
• maintenance_rules
• maintenance_typing
• maintenance_yamllint
• master
• meta_super_position
• missed_test
• missed_tests
• monitored_list_move
• monkeypathch_pad
• mouse-button
• move_listbox_tree
• mro_simplefocuslistwalker
• mypy_global_fixes
• mypy_warnings
• name-dec-private-modes
• nested_popups
• notifications
• numedit
• optimisations
• optimise_signals
• optional_dependencies
• outdated-scripts
• overlay-filler-shrink-to-fit
• overlay-menu-signal
• overlay-stack
• overlay_typing_repr
• pack_extra
• pack_on_edit
• packaging_setup
• packaging_tests
• packaging_unstable_test
• padding_given
• padding_pack_weight
• padding_support_fixed
• palette-hashable-names
• part_f_keys
• part_osx
• pep_424_lazy
• pile_support_fixed
• poc_gen_changelog
• popup-close-on-click-outside
• popup-launcher-close-on-menu
• posix_raw_display_optimise
• pr_template
• pre-412
• pre-release_changelog
• pre_305
• pre_4.0.2
• pre_4010
• pre_4011
• pre_4012
• pre_4013
• pre_404
• pre_405
• pre_409
• pre_410
• pre_411
• pre_413
• pre_414
• pre_415
• pre_416
• pre_417
• pre_420
• pre_421
• pre_422
• pre_423
• pre_424
• pre_425
• pre_release
• prep_2_2_2
• prep_403
• prepare_408
• provisional_typing
• public-palette-access
• py311_migration_single
• py312_no_bdist
• py313
• py_version_description
• pydocstyle
• pylint
• pylint_silence
• pylint_warnings
• pyrefly
• pyrefly-unused-ignores
• pyright-typing-fixes
• raw_display_optimization
• raw_display_var_naming
• raw_display_windows_resize
• raw_input_optimizations
• ref_dead_code
• refactor_scrollable
• refactor_super
• refactoring_code_style
• refurb
• refurb_fixes
• regression_enums
• regression_linebox
• regression_ovl_relative
• regression_treetools
• regressions
• rel_3.0
• rel_3.0.1
• rel_3.0.2
• relnotes-release
• remove_temporary_dev_script
• requirements_security
• restore_palette
• restore_win32_support
• rich_repr
• ruff
• ruff_0_2
• ruff_bump
• ruff_up
• ruff_update
• screenshots_trminus
• scripted-screen-unscripted
• scrollable
• scrollable_annotations
• scrollable_bar
• scrollable_bug
• scrollable_listbox
• scrollbar-always-visible
• scrollbar-cursor-coords
• scrollbar-end-markers
• scrollbar-markers-4-rows
• scrollbar-zero-rows
• scrollbar_estimated_size
• security_rules
• select-nav-wrap-around
• select-navigation
• selectable_icon
• setuptools_scm_api
• sgrmouse_shift_handle
• shard_body_row_fix
• shards-zero-row
• shards_inconsistency
• signals_subclass_abc
• sigstp
• simplify_code
• sizing-error-messages
• sizing_columns
• sizing_container_list_contents
• sizing_fixes
• slots-safe-places
• special_case_empty_columns_pile
• sphinx_build_gh_pages_ready
• spinner
• split_widget_enums
• static_check_fix
• static_checks
• static_fix
• static_fixes
• static_update
• stop_monkeypatch
• str_optimise
• strict_mypy
• strict_typing
• subiquity-inspired-bugfixes
• support_sync_output
• symbols_use_dataclass
• table
• table-activate-key
• table-column-attr
• table-container-protocol
• table-footer
• table-scrollbar-options
• table-set-focus-unfocused-focus-attr-func
• tabs
• tabs-underline
• tagmarkup-linear
• terminal-demo-mouse
• terminal-modified-keys
• terminal-mouse-forwarding
• terminal-report-typeerror
• terminfo-colors
• terminfo-device-safety
• test_req_fix
• test_tree
• test_vterm
• testing-module
• testing-virtual-clock
• tests
• tests_display_restart
• tests_explicit_encoding
• tests_org
• tests_organisation
• tests_windows
• text-layout-cache-thread-safety
• text_fixed_api
• text_layout
• text_layout_encoding
• text_pack
• tox_envs
• tree
• tree-leaf-icon-lines
• tree-navigation-helpers
• tree_undeprecate
• treetools_coverage
• treetools_regression
• trio_typing
• type_annotations_trivial
• typing
• typing-delegate-mixin
• typing_
• typing_attr_map
• typing_attr_wrap
• typing_bar_graph
• typing_big_text_progress_bar
• typing_canvas
• typing_containders
• typing_display
• typing_errors
• typing_escape
• typing_event_loop
• typing_examples
• typing_filler_
• typing_fixes
• typing_generic
• typing_glib_loop
• typing_issues
• typing_listbox
• typing_literal_constants
• typing_monitored_list
• typing_part_listbox
• typing_polish
• typing_radiobutton_checkbox
• typing_silence
• typing_split_repr-command_map
• typing_text
• typing_util_part_canvas
• typing_widget
• typing_widget_decoration
• typing_widget_vterm_edit
• typing_wimp
• typo_job_name
• un-deprecate_user_arg
• unfocused-focus-attr
• unicode_line_breaks
• unicode_table
• unicode_win
• unwarn_escape
• update-static-checkers
• update_black
• update_checkers
• update_screenshots
• upload_download_artifact
• use_base_class_for_row_display
• uuid_as_signal_key
• virtual-clock-run-until-idle
• vterm-alt-screen-kitty-keys
• watch_pipe_implicit_none
• wcwidth_unicode_auto
• web-input-line-limit
• web_display
• web_display_fixes
• web_display_id
• web_display_init
• web_encoding_handling
• web_resize
• websocket_display_examples
• weight_float
• weighted-pile-and-undrawn-children
• wheel-view-single-focus-move
• wheels_only_upstream
• widget-disable-toggle
• widget_like
• widget_mouse_keypress
• widget_type
• wimp_symbols
• win_support_mark
• window-title
• window_resize_trottle
• windows_asyncio
• windows_curses
• windows_event_debug
• windows_garbage_commands
• windows_last_line
• windows_use_unicode_input
• workflow_labeler
• ws-web-screen
• wsl_fix
• zmq_loop_async

Build # 43238183459

Build Type

push

github

Committed by penguinolog

Commit Message

Read CGI web request bodies up to CONTENT_LENGTH

The CGI web display read a request body until a size limit or end of
input. A web server does not have to close stdin after the body, so
such a read could block forever, and an over-long first request was
accepted cut short.

- Both the first request and keystroke requests read exactly
  CONTENT_LENGTH bytes; no CONTENT_LENGTH means no body.
- A length that is not a decimal number, or over the limit, is
  answered with 400 without reading the body: MAX_INITIAL_READ (50)
  for the first request, MAX_READ for keystrokes, which were
  truncated before.
- The first request is decoded whole, so any request charset works;
  invalid bytes anywhere in it are answered with 400.
- SECURITY.md and the reference list the new limit.

Coverage Stats

7104 of 7770 branches covered (91.43%)

Branch coverage included in aggregate %.

17 of 17 new or added lines in 1 file covered. (100.0%)

18332 of 19342 relevant lines covered (94.78%)

15.0 hits per line