🌐 Mailman 3 June 2010 - Python-list - python.org

Re: Need instruction on how to use isinstance
by alex23 June 28, 2010

June 28, 2010

Stephen Hansen <me+list/pyt...(a)ixokai.io> wrote: > What the hell? When did that show up? o.O (Did I not pay attention > enough during the ABC conversations? It seemed so boring). The PEPs & post-release docs detailing Py3 changes were worth reading, it's noted in the sections on changes to built-ins: http://www.python.org/dev/peps/pep-3100/ http://docs.python.org/py3k/whatsnew/3.0.html > A) how is Callable a collection, in any way shape or form? And B) does > that really return True for everything callable-esque? (I don't have a > 3.x to play with on this temporary computer) A) I was tempted to say "it's a collection of code" :) But really, the role of the collections model has expanded in 3.x to also provide a repository for ABCs: "In addition to containers, the collections module provides some ABCs (abstract base classes) that can be used to test whether a class provides a particular interface, for example, whether it is hashable or a mapping." http://docs.python.org/py3k/library/collections.html B) In a quick test in 3.1.2, it returned true for a function, a bound and unbound lambda, and an instance of a class with a __call__ defined. If there's any other kind of callable you can think of, let me know and I'll be happy to test it.

2 1

Re: Why Is Escaping Data Considered So Magical?
by Roy Smith June 28, 2010

June 28, 2010

In article <mailman.2117.1277511935.32709.python-list(a)python.org>, Ian Kelly <ian.g.kelly(a)gmail.com> wrote: > On Fri, Jun 25, 2010 at 5:17 PM, Nobody <nobody(a)nowhere.com> wrote: > > To be fair, it isn't actually limited to web developers. I've seen the > > following in scientific code written in C (or, more likely, ported to C > > from Fortran) for Unix: > > > > sprintf(buff, "rm -f %s", filename); > > system(buff); > > Tsk, tsk. And it's so easy to fix, too: > > #define BUFSIZE 1000000 > char buff[BUFSIZE]; > if (snprintf(buff, BUFSIZE, "rm -f %s", filename) >= BUFSIZE) { > printf("No buffer overflow for you!\n"); > } else { > system(buff); > } > > There, that's much more secure. I recently fixed a bug in some production code. The programmer was careful to use snprintf() to avoid buffer overflows. The only problem is, he wrote something along the lines of: snprintf(buf, strlen(foo), foo); I'm sure the code got reviewed originally, and probably looked at dozens of times over the years. Nobody caught the problem until we ran a static code analysis tool (Coverity) over it. To bring this back to something remotely Python related, the point of all this is that security is hard. A lot of the security best practices (such as "don't compose SQL queries on the fly with externally tainted strings") exist because they address ways that people have gotten burned in the past. It if foolish to think that you're smarter than everybody else and have thought of every possibility to avoid getting burned by doing the things that have gotten other people in trouble.

6 7

Re: Why Is Escaping Data Considered So Magical?
by Lawrence D'Oliveiro June 28, 2010

June 28, 2010

In message <mailman.2184.1277626565.32709.python-list(a)python.org>, Kushal Kumaran wrote: > On Sun, Jun 27, 2010 at 9:47 AM, Lawrence D'Oliveiro > <ldo(a)geek-central.gen.new_zealand> wrote: > >> In message <roy-854954.20435125062010(a)news.panix.com>, Roy Smith wrote: >> >>> I recently fixed a bug in some production code. The programmer was >>> careful to use snprintf() to avoid buffer overflows. The only problem >>> is, he wrote something along the lines of: >>> >>> snprintf(buf, strlen(foo), foo); >> >> A long while ago I came up with this macro: >> >> #define Descr(v) &v, sizeof v >> >> making the correct version of the above become >> >> snprintf(Descr(buf), foo); > > Not quite right. If buf is a char array, as suggested by the use of > sizeof, then you're not passing a char* to snprintf. What am I passing, then?

2 1

Re: Why are String Formatted Queries Considered So Magical?
by Carl Banks June 28, 2010

June 28, 2010

On Jun 27, 9:02 pm, Stephen Hansen <me+list/pyt...(a)ixokai.io> wrote: > On 6/27/10 8:48 PM, Carl Banks wrote: > > > I don't know the exact details of all of these, but I'm going to opine > > that at least some of these are easily expressible with a function > > call API. Perhaps more naturally than with string queries. For > > instance, set operations: > > > query1 = rdb_query(...) > > query2 = rdb_query(...) > > > final_query = rdb_union(query1,query2) > > > or > > > final_query = query1& query2 > > But, see, that's not actually what's going on behind the scenes in the > database. Unless your "query1" and "query2" objects are opaque > pseudo-objects which do not actually represent results That's exactly what they are. Nothing is actually sent to the database until the user starts retrieving results. This is fairly common thing for some interfaces to do. For instance, OpenGL almost always returns immediately after a command is posted without doing anything. The driver will queue the command in memory until some event happens to trigger it (maybe a signal from the graphics that is is done processing commands, or the queue being full, or an explicit flush request from the user). Incidentally, OpenGL has its own DSL for per-vertex and per-pixel operations (known as vertex and fragment shaders) that replaces an older binary API. I daresay it's a little less at risk for an injection attack, seeing that the shaders run on the GPU and only run simple math operations. But you never know. Carl Banks

1 0

Re: Why are String Formatted Queries Considered So Magical?
by Owen Jacobson June 28, 2010

June 28, 2010

On 2010-06-28 00:02:57 -0400, Stephen Hansen said: > On 6/27/10 8:48 PM, Carl Banks wrote: >> I don't know the exact details of all of these, but I'm going to opine >> that at least some of these are easily expressible with a function >> call API. Perhaps more naturally than with string queries. For >> instance, set operations: >> >> query1 = rdb_query(...) >> query2 = rdb_query(...) >> >> final_query = rdb_union(query1,query2) >> >> or >> >> final_query = query1& query2 > > But, see, that's not actually what's going on behind the scenes in the > database. Unless your "query1" and "query2" objects are opaque > pseudo-objects which do not actually represent results -- the query > planners do a *lot* of stuff by looking at the whole query and > computing just how to go about executing all of the instructions. I believe that *is* his point: that we can replace the SQL language with a "query object model" that lets us specify what we want without resorting to string-whacking when our needs are dynamic, without changing the rest of the workflow. This is obviously true: each RDBMS does something very much like what Carl is proposing, internally. However, implementing such an API usefully (never mind comfortably) in a cross-language way is... difficult, and an RDBMS that can only be used from Python (or even from Python and other Smalltalk-like languages) is not terribly useful at all. -o

1 0

Re: Why are String Formatted Queries Considered So Magical?
by Carl Banks June 28, 2010

June 28, 2010

On Jun 27, 8:52 pm, Stephen Hansen <me+list/pyt...(a)ixokai.io> wrote: > Then there's the type of SQL that results in DBA's having jobs-- and > deservedly so. Its *really* a very flexible and powerful language > capable of doing quite a lot to bend, flex, twist, and interleave that > data in the server while building up a result set for you. All right, I get it. I'm not talking about SQL, I'm talking about RDBs. But I guess it is important for serious RDBs to support queries complex enough that a language like SQL is really needed to express it--even if being called from an expressive language like Python. Not everything is a simple inner joins. I defer to the community then, as my knowledge of advanced SQL is minimal. We'll just have accept the risk of injection attacks as a trade off, and try to educate people to use placeholders when writing SQL. Carl Banks

1 0

Re: problems getting os.system and wxmenu to read options from a file and then execute
by eric dexter June 28, 2010

June 28, 2010

On Jun 27, 8:18 pm, MRAB <pyt...(a)mrabarnett.plus.com> wrote: > eric dexter wrote: > > On Jun 27, 5:56 pm, MRAB <pyt...(a)mrabarnett.plus.com> wrote: > >> Eric_Dex...(a)msn.com wrote: > >>> I managed to get the program running and the menu options are > >>> appearing on the list but the programs are not running. I suspect it > >>> is my onexecutemethod > >> [snip] > > >>> #add execute files from the text file list > >>> idtool = 400 > >>> for e in menuoptions: > >>> wx.EVT_MENU(self, idtool, self.OnExecute(idtool, e)) > >> This calls the OnExecute method and then passes its result to > >> wx.EVT_MENU. If, for example, OnExecute is returning None, then that's > >> what is being passed into wx.EVT_MENU. > > >> What you should actually be doing is passing a function which can be > >> called when the menu item is clicked, something like this: > > >> wx.EVT_MENU(self, idtool, lambda idtool=idtool, e=e: > >> self.OnExecute(idtool, e)) > > >>> idtool += 1 > >>> ##print e > >> [snip] > >>> def OnExecute(self,tool,e): > >>> print tool > >>> os.system(e) > >>> #print tool > >>> # Get rid of the dialog to keep things tidy > >> [snip] > > > wx.EVT_MENU(self, idtool, self.OnExecute(idtool, e)) > > > I changed it to this and it seems to be calling self.OnExecute befour > > the editor comes up and then after the editor is up it doesn't respond > > to anything. > > > > That is what the line was in your original post, and I explained the > change you needed to do. > > > I got rid off all the spaces but one in the text file (I> supose I need to use the strip method in real like though).. I was > > able to get an infinite loop by calling the editor as one of the > > options and then it keeps calling itself. It may be another problem > > or perhaps I didn't grasp the answer. > > > > I've noticed that you're opening the menu file before the class > statement but reading from it in the __init__ method. It would be better > if you opened the file in the __init__ method itself. You can split a > line on whitespace with: > > t = line.split() > > It won't then matter how many spaces or tabs are between the fields. I think it may and that is why there is a strip method. all 4 files want to execute befour the editor comes up so there is a problem of some sort that isn't adressed by that but it probily would be nice if I coded it that way.

1 0

Need instruction on how to use isinstance
by Steven W. Orr June 28, 2010

June 28, 2010

I need to test an argument for a few different types. I'm calling my function like this arf = MyFunc(list) What I want to do is to test for whether something is a string, tuple, list or function. It's that last one that's causing me a problem. if isinstance(arg, (str, tuple, list)): No problem, but there are a lot of types that the type function returns. If I have a simple function def foo(): pass type(foo) prints out <type 'function'> So, my question is, what value can I use as the 2nd arg to isinstance to see if foo is a function? And while I'm on the subject, what types does isinstance not support? And last, what is the correct way to do it if this is not the right way? TIA (and hoping I'm clear) -- Time flies like the wind. Fruit flies like a banana. Stranger things have .0. happened but none stranger than this. Does your driver's license say Organ ..0 Donor?Black holes are where God divided by zero. Listen to me! We are all- 000 individuals! What if this weren't a hypothetical question? steveo at syslang.net

3 4

Re: I strongly dislike Python 3
by Paul Rubin June 28, 2010

June 28, 2010

Terry Reedy <tjreedy(a)udel.edu> writes: > Python3 is about finishing transitions. The last stage in a transition > that replaces something old with something new is to remove the old,.. Main problem is that by the time Python3 has stopped being disruptive, Python4 will be underway. Python3 is incompatible enough with Python2 to cause hassle and headaches, but not incompatible enough for the benefits to be more than slight. So making more radical changes will require undergong the transition and disruption twice. I think it would have been better to just do it once.

2 1

Re: I strongly dislike Python 3
by John Bokma June 28, 2010

June 28, 2010

geremy condra <debatem1(a)gmail.com> writes: > On Sun, Jun 27, 2010 at 9:25 PM, John Bokma <john(a)castleamber.com> wrote: >> geremy condra <debatem1(a)gmail.com> writes: >> >>> On Sun, Jun 27, 2010 at 8:50 PM, Grant Edwards <invalid(a)invalid.invalid> wrote: >>>> On 2010-06-27, Benjamin Kaplan <benjamin.kaplan(a)case.edu> wrote: >>>> >>>>>> It should be easier to have a large number of python versions on one >>>>>> machine... ?I am realy fond of 2.5 so I am probily going to start >>>>>> compiling them or just include the python2.5 exe if I port stuff and >>>>>> settle it that way.. >>>>> >>>>> You're on the only platform where it isn't that easy. All us *nix >>>>> users have to do is compile it with the altinstall flag, and then use >>>>> #!/usr/bin/env python25 >>>>> Windows uses the file extension instead of the shebang line to execute >>>>> stuff, so it's harder for you to have multiple versions. >>>> >>>> If you install a real shell on Windows, then the hash-bang line works >>>> fine. :) >>> >>> Might as well spare yourself the trouble and install linux or *bsd. It's >>> probably easier. >> >> Ah, yeah, and then run all those Windows applications one requires on >> Wine... > > If you're bound to a platform, use it. My advice is just to get bound to > a platform that does what you need it to do, and in my experience it's > quite a bit easier to teach linux to do what you wanted windows to do > than the other way around. I've used several operating systems over many years and each OS has its own issues. I am currently using mostly Linux and it's far from the flawless OS some people seem to think it is. While it's true that some things are easier on OS A than on OS B changing your operating system because one (minor) thing "doesn't work" is often not an option. On top of that, I don't think it's that hard to make a small program that one associates with .py files which checks the first line and feeds the .py to the correct version of Python based on the information in the aformentioned first line. Another option (instead of installing a better shell) might be to make several VMs, each with their own Python version. Run subversion (or any other version control system) on your host, and you can test whatever you want. There are plenty of people who are very happy with coding under an MS OS. I now and then miss those days :-). -- John Bokma j3b Hacking & Hiking in Mexico - http://johnbokma.com/ http://castleamber.com/ - Perl & Python Development

3 2