]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623)
authorSebastian Pipping <sebastian@pipping.org>
Thu, 29 Feb 2024 22:52:50 +0000 (23:52 +0100)
committerGitHub <noreply@github.com>
Thu, 29 Feb 2024 22:52:50 +0000 (14:52 -0800)
commit6a95676bb526261434dd068d6c49927c44d24a9b
treee610bee9b3ca230b4e157745ebbe38c8a9923f89
parentd01886c5c9e3a62921b304ba7e5145daaa56d3cf
gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623)

Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods:

- `xml.etree.ElementTree.XMLParser.flush`
- `xml.etree.ElementTree.XMLPullParser.flush`
- `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled`
- `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled`
- `xml.sax.expatreader.ExpatParser.flush`

Based on the "flush" idea from https://github.com/python/cpython/pull/115138#issuecomment-1932444270 .

### Notes

- Please treat as a security fix related to CVE-2023-52425.

Includes code suggested-by: Snild Dolkow <snild@sony.com>
and by core dev Serhiy Storchaka.
16 files changed:
Doc/library/pyexpat.rst
Doc/library/xml.etree.elementtree.rst
Doc/whatsnew/3.13.rst
Include/pyexpat.h
Lib/test/test_pyexpat.py
Lib/test/test_sax.py
Lib/test/test_xml_etree.py
Lib/xml/etree/ElementTree.py
Lib/xml/sax/expatreader.py
Misc/NEWS.d/next/Security/2024-02-18-03-14-40.gh-issue-115398.tzvxH8.rst [new file with mode: 0644]
Misc/sbom.spdx.json
Modules/_elementtree.c
Modules/clinic/_elementtree.c.h
Modules/clinic/pyexpat.c.h
Modules/expat/pyexpatns.h
Modules/pyexpat.c