Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[3.11] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) #116268

Merged
merged 3 commits into from
Mar 6, 2024

Conversation

hartwork
Copy link
Contributor

@hartwork hartwork commented Mar 3, 2024

Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods:

  • xml.etree.ElementTree.XMLParser.flush
  • xml.etree.ElementTree.XMLPullParser.flush
  • xml.parsers.expat.xmlparser.GetReparseDeferralEnabled
  • xml.parsers.expat.xmlparser.SetReparseDeferralEnabled
  • xml.sax.expatreader.ExpatParser.flush

Based on the "flush" idea from #115138 (comment) .

Includes code suggested-by: Snild Dolkow [email protected]
and by core dev Serhiy Storchaka.

(cherry picked from commit 6a95676)


📚 Documentation preview 📚: https://cpython-previews--116268.org.readthedocs.build/

…52425) (pythonGH-115623)

Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods:

- `xml.etree.ElementTree.XMLParser.flush`
- `xml.etree.ElementTree.XMLPullParser.flush`
- `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled`
- `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled`
- `xml.sax.expatreader.ExpatParser.flush`

Based on the "flush" idea from python#115138 (comment) .

- Please treat as a security fix related to CVE-2023-52425.

Includes code suggested-by: Snild Dolkow <[email protected]>
and by core dev Serhiy Storchaka.

(cherry picked from commit 6a95676)
hartwork and others added 2 commits March 6, 2024 22:18
…t API availability (pythonGH-116278)

Suggest use of "hasattr" with checking for 3.13 Expat API availability

(cherry picked from commit 73807eb)
(cherry picked from commit eda2963)
@gpshead gpshead merged commit fc9da96 into python:3.11 Mar 6, 2024
24 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type-feature A feature request or enhancement type-security A security issue
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants