Description

hartwork

opened on Feb 13, 2024

Issue body actions

Feature or enhancement

Proposal:

Hello CPython team! 👋

Expat 2.6.0 introduced a new function XML_SetReparseDeferralEnabled that currently neither xml.parsers.expat.XMLParserType of pyexpat nor xml.etree.ElementTree.XMLParser of ElementTree give access to it, so when some Python-based library or application finds themselves in a situation where toggling reparse deferral is beneficial or needed for their scenario in the future, they will not be able to do so with ease or at all.

Please note that this is a sibling ticket to #90949 in some sense and implementations could be combined or done in one go, potentially.

Also please note that…

• for xml.etree.ElementTree.XMLParser a new method def flush(self): could be a reasonable API addition based on the idea gh-115133: test_xml_etree.py: Fix for Expat >=2.6.0 with reparse deferral (fixes #115133) #115138 (comment) ;
• the same seems to apply to xml.sax.xmlreader.IncrementalParser.

I cannot provide a pull request on the topic economically myself unfortunately, but I am happy to support any related efforts (including voice calls on the topic as needed). Thanks in advance!

Best, Sebastian

CC #90949
CC #115133

Has this already been discussed elsewhere?

This is a minor feature, which does not need previous discussion elsewhere

Links to previous discussion of this feature:

No response

Linked PRs

• gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) #115623
• [3.12] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) #116248
• [3.11] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) #116268
• [3.10] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) #116270
• [3.9] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) #116272
• [3.8] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) #116275
• gh-115398: Suggest use of hasattr with checking for 3.13 Expat API availability #116278
• gh-115398: Increment PyExpat_CAPI_MAGIC for SetReparseDeferralEnabled addition #116301
• gh-115398: Revert PyExpat_CAPI_MAGIC version bump #116411

Reacted by Serhiy Storchaka

Activity

1. hartwork

   added

   type-featureA feature request or enhancementA feature request or enhancement

   on Feb 13, 2024
2. Eclips4

   added

   topic-XML

   on Feb 13, 2024
3. gpshead

   added a commit that references this issue on Feb 29, 2024

   gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (…

   6a95676
4. hartwork

   added 5 commits that reference this issue on Mar 2, 2024

   pythongh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-…

   ac019e3

   pythongh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-…

   0444649

   pythongh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-…

   2ab9c9b

   pythongh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-…

   1110d3e

   pythongh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-…

   fb7ea6f
5. gpshead

   added a commit that references this issue on Mar 4, 2024

   gh-115398: Increment PyExpat_CAPI_MAGIC for SetReparseDeferralEnabled…

   eda2963
6. woodruffw

   added 2 commits that reference this issue on Mar 4, 2024

   pythongh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-…

   bd08a42

   pythongh-115398: Increment PyExpat_CAPI_MAGIC for SetReparseDeferralE…

   682ce0d
7. hartwork

   added a commit that references this issue on Mar 6, 2024

   Revert "pythongh-115398: Increment PyExpat_CAPI_MAGIC for SetReparseD…

   f4eca41
8. gpshead

   added 2 commits that reference this issue on Mar 6, 2024

   gh-115398: Revert `PyExpat_CAPI_MAGIC` version bump (GH-116411)

   8a8e920

   gh-115398: Suggest use of `hasattr` with checking for 3.13 Expat API …

   73807eb
9. hartwork

   added a commit that references this issue on Mar 6, 2024

   pythongh-115398: Suggest use of `hasattr` with checking for 3.13 Expa…

   5573d60
10. 28 remaining items
11. ambv

    added 2 commits that reference this issue on Mar 27, 2024

    [3.9] gh-117187: Fix XML tests for vanilla Expat <2.6.0 (GH-117203) (G…

    f7c7e72

    [3.8] gh-117187: Fix XML tests for vanilla Expat <2.6.0 (GH-117203) (#…

    928d735
12. NGRsoftlab

    added 2 commits that reference this issue on Apr 2, 2024

    Squashed commit of the following:

    1b5fe4c

    Squashed commit of the following:

    a016a54
13. algitbot

    added a commit that references this issue on Apr 14, 2024

    main/python3: upgrade to 3.11.9

    fc81cdc
14. diegorusso

    added 5 commits that reference this issue on Apr 17, 2024

    pythongh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-…

    1069c2d

    pythongh-115398: Increment PyExpat_CAPI_MAGIC for SetReparseDeferralE…

    45eb588

    pythongh-115398: Revert `PyExpat_CAPI_MAGIC` version bump (pythonGH-1…

    6ce8614

    pythongh-115398: Suggest use of `hasattr` with checking for 3.13 Expa…

    c21055b

    pythongh-117187: Fix XML tests for vanilla Expat <2.6.0 (pythonGH-117203

    451eb61
15. hroncok commented on Apr 18, 2024

    

    hroncok

    on Apr 18, 2024

    Contributor

    More actions

    ⚠️ Linux distro maintainers.

    Python built --with-system-expat with expat >= 2.6 will require expat >= 2.6 on runtime as well. If you updated to expat >= 2.6 and built Python with this fix, do not allow your users to update Python independently without updating expat as well, or they will get undefined symbol: XML_SetReparseDeferralEnabled from pyexpat (e.g. when using the venv module).

    https://lists.fedoraproject.org/archives/list/[email protected]/thread/7XHGWHBQDNFKNGSZTP44SSD6PQKZPG6C/

    cc @mgorny @danigm @mcepl @mitya57 @asottile

    Reacted by Abel Aoun
16. danigm commented on Apr 18, 2024

    

    danigm

    on Apr 18, 2024

    Contributor

    More actions

    ⚠️ Linux distro maintainers.

    Python built --with-system-expat with expat >= 2.6 will require expat >= 2.6 on runtime as well. If you updated to expat >= 2.6 and built Python with this fix, do not allow your users to update Python without updating expat as well, or they will get undefined symbol: XML_SetReparseDeferralEnabled from pyexpat (e.g. when using the venv module).

    https://lists.fedoraproject.org/archives/list/[email protected]/thread/7XHGWHBQDNFKNGSZTP44SSD6PQKZPG6C/

    @hroncok Thanks for the heads up. As far as I know this shouldn't be a problem for Tumbleweed because how it's updated, but for Leap is something to keep in mind.
17. gerrit-photon

    added a commit that references this issue on Aug 14, 2024

    python3: update expat dependency

    1da024e
18. ReimarBauer commented on Aug 30, 2024

    

    ReimarBauer

    on Aug 30, 2024

    More actions

    On MSS it was reported 2.6.1 works with python 3.11.8 and 2.6.2 doesn't.
19. jamesdalg commented on Sep 1, 2025

    

    jamesdalg

    on Sep 1, 2025

    More actions

    This is still a recurring issue, years on.

    Reacted by Emile

Issue actions