Add a security warning to pydoc#150409
Conversation
picnixz
left a comment
There was a problem hiding this comment.
Yeah, I'm tired of closing reports that claim vulns when it affects a dev component. So I'm in favor of that. But move that warning below (L75 in your PR) where we mention HTTP server. pydoc can be used in the CLI
Documentation build overview
|
I'll disagree here, the introductory paragraph introduces that it can "served to a web browser," and there is no section specifically for the HTTP server. I'd generally prefer to put warnings in visible places (i.e., at the top of sections). |
|
Seems reasonable to me! I don't have an opinion on placement. |
The paragraph serves a section for me. It has sufficient information about the port as well:
The fact that it serves localhost is important as well. So I would prefer having it there. Serving to a web browser has nothing to do with the HTTP server itself. You can serve to a webbrowser using other means. What's vulnerable is the HTTP server itself. Note that someone wanting to know about the HTTP server itself may have Google jump to that sentence in the paragraph specifically. And having the warning closer is better. Especially if we use the words "especially useful". |
@picnixz and @woodruffw IIRC you've also suggested this before.