Ben Darnell

Results 19 issues of Ben Darnell

In tornadoweb/tornado#2019, we need a way to tell whether colorama is enabled (analogous to the check a curses-based system would do by looking at the TERM environment variable). There doesn't...

`expand_if_in_registry` calls itself recursively when a macro is used with arguments, but it doesn't preserve `**kwargs`. This means that you cannot use both `args` and `target` at the same time...

The python formatter `black` will occasionally decide to put a binary operator by itself on a line ([example](https://github.com/tornadoweb/tornado/blob/715ef05682c354e704c7621bfd1a28ad9a52e0d6/tornado/http1connection.py#L406)). This triggers the newly-added W504 warning. I believe that W504 (and W503,...

We occasionally see issues in production in which writes to our raft log are not fully persisted before MsgAppResps are sent (Sometimes this is deliberate, as when users disable fsync...

The websocket ping implementation behaves confusingly when the ping timeout is set to less than the ping interval. It doesn't close the connection until the interval has elapsed, even if...

websocket

Several problems in Loader.resolve_path: - If RequestHandler.render() is passed an absolute path, relative paths in {%extends%} and friends don't work. - It uses startswith('/') instead of isabs() - Strange things...

template
windows

WebSocketHandler doesn't currently have a good way of installing a class-wide handler for uncaught exceptions. The only way is to override `_run_callback`, but that's awkward (and the method is changing...

websocket

The `HTTPRequest.remote_ip` field is intended to contain a trustworthy equivalent of the TCP-level remote address, so it accepts only a single `X-Forwarded-For` hop, and only when configured to do so....

httpserver

In a multi-user system, the testserver binary could have been written by another user and may be malicious. We should include the username in the path (either in the filename...

A) Insecure mode should be opt-in in general; I was surprised and disappointed to see that battleschool has a hard-coded default of `--insecure` when downloading packages. B) Certain sites fail...

security