Skip to content

Add a security warning to pydoc#150409

Open
StanFromIreland wants to merge 1 commit into
python:mainfrom
StanFromIreland:pydoc-warning
Open

Add a security warning to pydoc#150409
StanFromIreland wants to merge 1 commit into
python:mainfrom
StanFromIreland:pydoc-warning

Conversation

@StanFromIreland
Copy link
Copy Markdown
Member

@picnixz and @woodruffw IIRC you've also suggested this before.

Copy link
Copy Markdown
Member

@picnixz picnixz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I'm tired of closing reports that claim vulns when it affects a dev component. So I'm in favor of that. But move that warning below (L75 in your PR) where we mention HTTP server. pydoc can be used in the CLI

@read-the-docs-community
Copy link
Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #32840146 | 📁 Comparing e9b96cd against main (c714b56)

  🔍 Preview build  

1 file changed
± library/pydoc.html

@StanFromIreland
Copy link
Copy Markdown
Member Author

But move that warning below (L75 in your PR) where we mention HTTP server. pydoc can be used in the CLI

I'll disagree here, the introductory paragraph introduces that it can "served to a web browser," and there is no section specifically for the HTTP server. I'd generally prefer to put warnings in visible places (i.e., at the top of sections).

@woodruffw
Copy link
Copy Markdown
Contributor

Seems reasonable to me! I don't have an opinion on placement.

@StanFromIreland StanFromIreland requested a review from picnixz May 25, 2026 15:40
@picnixz
Copy link
Copy Markdown
Member

picnixz commented May 25, 2026

there is no section specifically for the HTTP server

The paragraph serves a section for me. It has sufficient information about the port as well:

You can also use :program:pydoc to start an HTTP server on the local machine
that will serve documentation to visiting web browsers. :program:python -m pydoc -p 1234
will start a HTTP server on port 1234, allowing you to browse the
documentation at http://localhost:1234/ in your preferred web browser.
Specifying 0 as the port number will select an arbitrary unused port.

:program:python -m pydoc -n <hostname> will start the server listening at the given
hostname. By default the hostname is 'localhost' but if you want the server to
be reached from other machines, you may want to change the host name that the
server responds to. During development this is especially useful if you want
to run pydoc from within a container.

The fact that it serves localhost is important as well. So I would prefer having it there. Serving to a web browser has nothing to do with the HTTP server itself. You can serve to a webbrowser using other means. What's vulnerable is the HTTP server itself.

Note that someone wanting to know about the HTTP server itself may have Google jump to that sentence in the paragraph specifically. And having the warning closer is better. Especially if we use the words "especially useful".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

Status: Todo

Development

Successfully merging this pull request may close these issues.

3 participants