]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
[3.14] gh-90949: expose Expat API to tune exponential expansion protections (GH-13936...
authorStan Ulbrych <stan@python.org>
Tue, 9 Jun 2026 12:42:16 +0000 (13:42 +0100)
committerGitHub <noreply@github.com>
Tue, 9 Jun 2026 12:42:16 +0000 (13:42 +0100)
commitc078637e8642783d90b33c6b983fa15ff29c24d6
tree998bf8bb7484961e79b47956cdebb156c2a4293c
parentbdaf1520429a0eaa6d95e6757d5d953f5fa4106f
[3.14] gh-90949: expose Expat API to tune exponential expansion protections (GH-139368) (#150496)

Expose the XML Expat 2.7.2 APIs to tune protections against
"billion laughs" [1] attacks.

The exposed APIs are available on Expat parsers, that is,
parsers created by `xml.parsers.expat.ParserCreate()`, as:

- `parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold)`, and
- `parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor)`.

This completes the work in f04bea44c37793561d753dd4ca6e7cd658137553,
and improves the existing related documentation.

[1]: https://en.wikipedia.org/wiki/Billion_laughs_attack
(cherry picked from commit 666112376d574c7802646ee1df6244062671cd61)

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
Doc/library/pyexpat.rst
Include/pyexpat.h
Lib/test/test_pyexpat.py
Misc/NEWS.d/3.14.1.rst
Misc/NEWS.d/next/Library/2025-09-26-18-04-28.gh-issue-90949.YHjSzX.rst [new file with mode: 0644]
Modules/clinic/pyexpat.c.h
Modules/pyexpat.c