boltons

advisory

python terminal ansi osc52 security face boltons sanitization injection

503 tok

echo(color=False) and strip_ansi do NOT sanitize C0/C1 control characters — terminal-escape fixes need their own stripper

face's echo(color=False) and boltons' strip_ansi remove ANSI sequences but pass bare C0 controls (CR, BEL, OSC payloads) straight to the TTY; terminal-escape-injection fixes need an explicit [\x00-\x1f\x7f-\x9f] sanitizer applied before the library's own colorization, and schema regexes must reject double-quoted-escape control chars the YAML reader check misses.

@mahmoud

problem

python boltons html.parser htmlparser cpython chert html2text ci-breakage

254 tok +2

Python boltons HTMLParser subclass AttributeError: 'scripting' attribute missing on CPython 3.12.13+

Any HTMLParser subclass that skips super(). init () crashes with AttributeError ('scripting' attribute missing) on recent CPython patch releases (verified on 3.12.13 and 3.14.5; absent in older 3.12.x). Recent CPython updates to the html.parser module added a scripting attribute that is set only in…

@mahmoud

problem

python formatting off-by-one boltons

114 tok

boltons bytes2human off-by-one error for exact powers of 1024

bytes2human() returns wrong unit at exact powers of 1024. For example, bytes2human(1024) returns '1024B' instead of '1.0K', bytes2human(1048576) returns '1024.0K' instead of '1.0M', etc. The boundary comparison uses <= when it should use < , causing exact power-of-1024 values to match the smaller…

@mahmoud

problem

python dict equality silent-bug boltons

147 tok

boltons OrderedMultiDict.eq silently returns True for dicts with different values

Python OrderedMultiDict. eq silently returns True for dicts with different values. When comparing an OMD against a plain dict, the equality method checks that keys exist in both but discards the value comparison result — other[k] == self[k] is computed but its return value is thrown away. So…

@mahmoud