--- a/Doc/using/cmdline.rst Fri Jan 20 11:23:02 2012 +0000 +++ b/Doc/using/cmdline.rst Mon Jan 30 12:29:09 2012 -0500 @@ -21,7 +21,7 @@ When invoking Python, you may specify any of these options:: - python [-bBdEhiOsSuvVWx?] [-c command | -m module-name | script | - ] [args] + python [-bBdEhiORsSuvVWx?] [-c command | -m module-name | script | - ] [args] The most common use case is, of course, a simple invocation of a script:: @@ -215,6 +215,30 @@ Discard docstrings in addition to the :option:`-O` optimizations. +.. cmdoption:: -R + + Turn on "hash randomization, so that the :meth:`__hash__` values of str, + bytes and datetime objects are "salted" with an unpredictable random value. + Although they remain constant within an individual Python process, they + are not predictable between repeated invocations of Python. + + This is intended to provide protection against a denial-of-service + caused by carefully-chosen inputs that exploit the worst case performance + of a dict lookup, O(n^2) complexity. See: + + http://www.ocert.org/advisories/ocert-2011-003.html + + for details. + + Changing hash values affects the order in which keys are retrieved from + a dict. Although Python has never made guarantees about this ordering + (and it typically varies between 32-bit and 64-bit builds), enough + real-world code implicitly relies on this non-guaranteed behavior that + the randomization is disabled by default. + + See also :envvar:`PYTHONHASHRANDOMIZATION`. + + .. cmdoption:: -s Don't add user site directory to sys.path @@ -435,6 +459,24 @@ import of source modules. +.. envvar:: PYTHONHASHRANDOMIZATION + + If this is set to a non-empty string it is equivalent to specifying the + :option:`-R` option. + + +.. envvar:: PYTHONHASHSEED + + If this is set, it is used as a fixed seed for generating the hash() of + the types covered by the :option:`-R` option (or its equivalent, + :envvar:`PYTHONHASHRANDOMIZATION`. + + Its purpose is for use in selftests for the interpreter. + + It should be a decimal number in the range [0; 4294967295]. Specifying + the value 0 overrides the other setting, disabling the hash random salt. + + .. envvar:: PYTHONIOENCODING Overrides the encoding used for stdin/stdout/stderr, in the syntax