Comments (6)
Hrm, I see that this has been reported before #3107 and #3104. In my case I'm not using tornado directly -- rather it's a transitive dependency via other packages I'm using. Therefore having to modify my build process to account for the nuances of a transitive dependency really isn't something I'd want to do.
from tornado.
Similarly, modifying my build process to account for the nuances of unknown tools used by a transitive dependent isn't really something I'd want to do. Work with the vendor of your security scanner to prevent this class of false positive.
If there's some way to mark this key as testing-only and silence the warning I'd probably do so, but I don't want to remove the test files from the distribution because I find it useful to have them there and removing them would not actually improve security.
from tornado.
Thanks for the reply. I (personally) agree with you on security and while I can kinda see why you might want to install the test files locally for running the tests, it's much less clear to me that including them in people's importable modules is the right thing for any package to do. (What would happen if all packages did this? What are the impacts on tooling which auto-imports packages at runtime? What happens if a test runner for a consumer project auto-imports "test*" packages and tries to run tornado tests in their environment?)
I'd urge you to reconsider the inclusion by default of test files within the installed modules.
from tornado.
What would happen if all packages did this?
Virtualenvs would be a little bit bigger?
What are the impacts on tooling which auto-imports packages at runtime? What happens if a test runner for a consumer project auto-imports "test*" packages and tries to run tornado tests in their environment?
That's risky in Python in any case since importing a module can execute arbitrary code. But even setting that possibility aside, trying to import every bit of code you can find is just going to waste a lot of cpu time compiling everything. You're going to want your tools to be more selective about what code they pull in just for efficiency's sake.
from tornado.
What would happen if all packages did this?
Virtualenvs would be a little bit bigger?
Virtualenvs would potentially be a lot bigger after test data is accounted for.
A lot of packages also have their tests at /tests
within their source tree, meaning that there's a lot of potential for name collisions and files being left behind when packages are uninstalled. I realise tornado doesn't do this, however I've seen (and helped fix) a lot of packages which do.
from tornado.
Oh I completely agree that no one should install tests outside of their namespace. And packages that have large amounts of data shouldn't ship it in their package. I'm not advocating for all packages to install their tests; I'm not even sure if I'd do it this way myself in future projects. But this is the way I've done it in this project for many years and I'd need a very good reason to go through the effort of changing.
from tornado.
Related Issues (20)
- iostream: SSL logging is too noisy
- Tornado was blocked for more than 1 second in HOT 1
- static_url with a prefix does not work in a Template tag HOT 2
- how to handle the http stream data without using callback but based on coroutine? HOT 1
- Test fail with openssl 3.2 HOT 1
- tornado.websocket.WebSocketClosedError HOT 1
- Send 204 as HTTPError
- Tornado Websocket write message performance degradation when binary is False HOT 2
- `Subprocess.wait_for_exit` never resolves if process terminated before it is called HOT 3
- Websocket Client Handshake URI issue HOT 1
- Questions about Copilot + Open Source Software Hierarchy
- tornado.httputil.HTTPServerRequest and tornado.web.RequestHandler HOT 1
- Please update to 3.11 HOT 1
- TypeError: WebSocketHandler.init() missing 2 required positional arguments: 'application' and 'request' HOT 3
- Under pytest 8.2.0, 'AsyncHTTPTestCase' has no attribute 'runTest' HOT 1
- 6.4.1: pytest fails in multiple nits with `AttributeError: 'TestIOStreamMixin' object has no attribute 'io_loop'` error HOT 3
- Vulnerability: GHSA-753j-mpmx-qq6g HOT 1
- v6.1,CPU increased to 100% when the client closes the connection HOT 4
- Tornado version and version_info inconsistent HOT 2
- ValueError when If-Modified-Since is invalid for StaticFileHandler request HOT 7
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from tornado.