ilusha/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython synced 2026-09-28 02:13:17 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623)

Browse source 
Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods:

- `xml.etree.ElementTree.XMLParser.flush`
- `xml.etree.ElementTree.XMLPullParser.flush`
- `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled`
- `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled`
- `xml.sax.expatreader.ExpatParser.flush`

Based on the "flush" idea from https://github.com/python/cpython/pull/115138#issuecomment-1932444270 .

### Notes

- Please treat as a security fix related to CVE-2023-52425.

Includes code suggested-by: Snild Dolkow <snild@sony.com>
and by core dev Serhiy Storchaka.
This commit is contained in:
Sebastian Pipping 2024-02-29 23:52:50 +01:00 • committed by GitHub
parent d01886c5c9
commit 6a95676bb5
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
16 changed files with 435 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

11
Doc/whatsnew/3.13.rst
View file

@ -174,6 +174,17 @@ Other Language Changes
(Contributed by Victor Stinner in :gh:`114570`.)
* Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425)
by adding five new methods:
* :meth:`xml.etree.ElementTree.XMLParser.flush`
* :meth:`xml.etree.ElementTree.XMLPullParser.flush`
* :meth:`xml.parsers.expat.xmlparser.GetReparseDeferralEnabled`
* :meth:`xml.parsers.expat.xmlparser.SetReparseDeferralEnabled`
* :meth:`!xml.sax.expatreader.ExpatParser.flush`
(Contributed by Sebastian Pipping in :gh:`115623`.)
New Modules
===========