GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Document the security of tomllib for untrusted input · Issue #111264 · python/cpython

Document the security of tomllib for untrusted input #111264

New issue
Copy link
New issue
Copy link
Closed
Closed
Document the security of tomllib for untrusted input#111264
Copy link
Labels
3.11only security fixesonly security fixes3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixes3.15bugs and security fixesbugs and security fixesdocsDocumentation in the Doc dirDocumentation in the Doc dirtype-securityA security issueA security issue

Description

@opk12
opk12
opened on Oct 24, 2023
Issue body actions

Documentation

The documentation for tomllib should be explicit on whether untrusted input is safe to parse, or what features should be avoided.

Linked PRs

  • gh-111264: Add a note about untrusted input to tomllib docs #146209
  • [3.14] gh-111264: Add a note about untrusted input to tomllib docs (GH-146209) #149223
  • [3.13] gh-111264: Add a note about untrusted input to tomllib docs (GH-146209) (GH-149223) #149226

Activity

  1. opk12
    added
    docsDocumentation in the Doc dirDocumentation in the Doc dir
    on Oct 24, 2023

  2. hukkin commented on Oct 10, 2024

    @hukkin
    hukkin
    on Oct 10, 2024
    Contributor
    More actions

    In PR #96499 json docs added the warning

    Warning
Be cautious when parsing JSON data from untrusted sources. A malicious JSON string may cause
the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is
recommended.

    as response to CVE-2020-10735 (cpython issue #95778).

    The countermeasures already exist in v3.11.0 where tomllib first appears so it's not vulnerable to that particular threat at least.

    Reacted by Pradyun Gedam
  3. StanFromIreland
    added
    type-securityA security issueA security issue
    on Mar 18, 2026
  4. github-project-automation
    added this to docs issueson Mar 18, 2026
  5. github-project-automation
    moved this to Todo in docs issueson Mar 18, 2026
  6. StanFromIreland
    added
    3.11only security fixesonly security fixes
    3.12only security fixesonly security fixes
    3.13only security fixesonly security fixes
    3.14bugs and security fixesbugs and security fixes
    3.15bugs and security fixesbugs and security fixes
    on Mar 18, 2026

  7. encukou commented on Mar 20, 2026

    @encukou
    encukou
    on Mar 20, 2026
    Member
    More actions

    Let's add a similar note. Perhaps not as a warning -- it's more about communicating what to worry about when dealing with untrusted data (it might make the fan spin but won't format your disk), but also a reminder that you should think about how trusted your data is, plus a basic precaution.

  8. encukou
    added a commit that references this issue on Mar 20, 2026

    pythongh-111264: Add a note about untrusted input to tomllib docs

    53edf83
  9. encukou
    added a commit that references this issue on Apr 30, 2026

    gh-111264: Add a note about untrusted input to tomllib docs (GH-146209)

    9d41e2a
  10. encukou
    closed this as completedon Apr 30, 2026
  11. encukou
    added a commit that references this issue on May 1, 2026

    [3.14] gh-111264: Add a note about untrusted input to tomllib docs (G…

    e6eac2b
  12. StanFromIreland
    added a commit that references this issue on May 2, 2026

    [3.13] gh-111264: Add a note about untrusted input to tomllib docs (#…

    b274204
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.11only security fixesonly security fixes3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixes3.15bugs and security fixesbugs and security fixesdocsDocumentation in the Doc dirDocumentation in the Doc dirtype-securityA security issueA security issue

    Projects

    • docs issues
      Status
      Todo
      Show more project fields

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions
    You are visitor 01402503 — GeezerVison does not store the pages you look up.
    Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.