cpython/Modules/clinic
Sebastian Pipping 0e4cd89781
[3.12] gh-90949: add Expat API to prevent XML deadly allocations (CVE-2025-59375) (GH-139234) (#139527)
* [3.12] gh-90949: add Expat API to prevent XML deadly allocations (CVE-2025-59375) (GH-139234)

Expose the XML Expat 2.7.2 mitigation APIs to disallow use of
disproportional amounts of dynamic memory from within an Expat
parser (see CVE-2025-59375 for instance).

The exposed APIs are available on Expat parsers, that is,
parsers created by `xml.parsers.expat.ParserCreate()`, as:

- `parser.SetAllocTrackerActivationThreshold(threshold)`, and
- `parser.SetAllocTrackerMaximumAmplification(max_factor)`.

(cherry picked from commit f04bea44c3)
(cherry picked from commit 68a1778b77)
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
2025-12-17 15:58:59 +01:00
..
_abc.c.h
_asynciomodule.c.h
_bisectmodule.c.h [3.12] gh-113993: Make interned strings mortal (GH-120520, GH-121364, GH-121903, GH-122303) (#123065) 2024-09-27 13:28:48 -07:00
_bz2module.c.h
_codecsmodule.c.h
_collectionsmodule.c.h
_contextvarsmodule.c.h
_cryptmodule.c.h
_csv.c.h
_curses_panel.c.h
_cursesmodule.c.h [3.12] gh-120378: Fix crash caused by integer overflow in curses (GH-124555) (#124911) 2024-10-02 21:40:49 +00:00
_datetimemodule.c.h
_dbmmodule.c.h
_elementtree.c.h
_functoolsmodule.c.h
_gdbmmodule.c.h
_hashopenssl.c.h [3.12] gh-113993: Make interned strings mortal (GH-120520, GH-121364, GH-121903, GH-122303) (#123065) 2024-09-27 13:28:48 -07:00
_heapqmodule.c.h
_localemodule.c.h
_lsprof.c.h
_lzmamodule.c.h
_opcode.c.h
_operator.c.h
_pickle.c.h
_posixsubprocess.c.h
_queuemodule.c.h
_randommodule.c.h
_ssl.c.h
_statisticsmodule.c.h
_struct.c.h
_testclinic.c.h [3.12] gh-113993: Make interned strings mortal (GH-120520, GH-121364, GH-121903, GH-122303) (#123065) 2024-09-27 13:28:48 -07:00
_testinternalcapi.c.h [3.12] gh-119213: Be More Careful About _PyArg_Parser.kwtuple Across Interpreters (gh-119331) (gh-119425) 2024-05-22 22:26:58 +00:00
_testmultiphase.c.h [3.12] gh-113993: Make interned strings mortal (GH-120520, GH-121364, GH-121903, GH-122303) (#123065) 2024-09-27 13:28:48 -07:00
_tkinter.c.h [3.12] gh-71592: Add ability to trace Tcl commands executed by Tkinter (GH-118291) (GH-118662) 2024-05-06 19:26:08 +00:00
_tracemalloc.c.h
_typingmodule.c.h
_weakref.c.h
_winapi.c.h gh-119690: Adds Unicode support for named pipes in _winapi (GH-119717) 2024-05-30 15:40:23 +01:00
_zoneinfo.c.h
arraymodule.c.h
audioop.c.h
binascii.c.h
cmathmodule.c.h [3.12] gh-113993: Make interned strings mortal (GH-120520, GH-121364, GH-121903, GH-122303) (#123065) 2024-09-27 13:28:48 -07:00
fcntlmodule.c.h [3.12] Revert "[3.12] gh-69214: Fix fcntl.ioctl() request type (#119498) (#1… (#119905) 2024-06-01 17:08:07 +02:00
gcmodule.c.h
grpmodule.c.h
itertoolsmodule.c.h [3.12] gh-113993: Make interned strings mortal (GH-120520, GH-121364, GH-121903, GH-122303) (#123065) 2024-09-27 13:28:48 -07:00
mathmodule.c.h [3.12] gh-113993: Make interned strings mortal (GH-120520, GH-121364, GH-121903, GH-122303) (#123065) 2024-09-27 13:28:48 -07:00
md5module.c.h
overlapped.c.h
posixmodule.c.h [3.12] gh-127614: Correctly check for ttyname_r() in configure (#128503) (#128599) 2025-01-07 22:05:42 +00:00
pwdmodule.c.h
pyexpat.c.h [3.12] gh-90949: add Expat API to prevent XML deadly allocations (CVE-2025-59375) (GH-139234) (#139527) 2025-12-17 15:58:59 +01:00
readline.c.h
resource.c.h
selectmodule.c.h [3.12] gh-121905: Consistently use "floating-point" instead of "floating point" (GH-121907) (GH-122013) 2024-07-19 09:08:33 +00:00
sha1module.c.h
sha2module.c.h
sha3module.c.h
signalmodule.c.h [3.12] gh-121905: Consistently use "floating-point" instead of "floating point" (GH-121907) (GH-122013) 2024-07-19 09:08:33 +00:00
socketmodule.c.h
spwdmodule.c.h
symtablemodule.c.h
syslogmodule.c.h
termios.c.h
unicodedata.c.h
zlibmodule.c.h