GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-115133: Fix tests for XMLPullParser with Expat 2.6.0 by serhiy-storchaka · Pull Request #115164 · python/cpython

Conversation

@serhiy-storchaka

@serhiy-storchaka serhiy-storchaka commented Feb 8, 2024 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

Feeding the parser by too small chunks defers parsing to prevent CVE-2023-52425. Future versions of Expat may be more reactive.

  • Issue: test.test_xml_etree*.XMLPullParserTest.test_simple_xml fails with (system) expat 2.6.0 #115133

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@serhiy-storchaka
pythongh-115133: Fix tests for XMLPullParser with Expat 2.6.0
e27eafb 
Feeding the parser by too small chunks defers parsing to prevent
CVE-2023-52425. Future versions of Expat may be more reactive.
@serhiy-storchaka serhiy-storchaka added tests Tests in the Lib/test dir needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes labels Feb 8, 2024
@bedevere-app bedevere-app Bot added the awaiting core review label Feb 8, 2024
@bedevere-app bedevere-app Bot mentioned this pull request Feb 8, 2024
test.test_xml_etree*.XMLPullParserTest.test_simple_xml fails with (system) expat 2.6.0 #115133
Closed
Snild-Sony
Snild-Sony approved these changes Feb 8, 2024
View reviewed changes
hartwork
hartwork approved these changes Feb 10, 2024
View reviewed changes
@lazka

lazka commented Feb 10, 2024 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

It stills fails here with this patch applied:

FAIL: test_simple_xml_chunk_8 (test.test_xml_etree.XMLPullParserTest.test_simple_xml_chunk_8)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "D:\a\cpython-mingw\cpython-mingw\Lib\test\test_xml_etree.py", line 1438, in test_simple_xml_chunk_8
    self.test_simple_xml(chunk_size=8)
  File "D:\a\cpython-mingw\cpython-mingw\Lib\test\test_xml_etree.py", line 1418, in test_simple_xml
    self.assert_event_tags(parser, [('end', 'element')])
  File "D:\a\cpython-mingw\cpython-mingw\Lib\test\test_xml_etree.py", line 1405, in assert_event_tags
    self.assertEqual([(action, elem.tag) for action, elem in events],
AssertionError: Lists differ: [] != [('end', 'element')]

Second list contains 1 additional elements.
First extra element 0:
('end', 'element')

- []
+ [('end', 'element')]

> python3 -c "import pyexpat; print(pyexpat.version_info)"
(2, 6, 0)
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@serhiy-storchaka

serhiy-storchaka commented Feb 10, 2024

Copy link
Copy Markdown
Member Author

What is the smallest value of chunk_size with which the test would pass?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@lazka

lazka commented Feb 10, 2024 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

chunk_size=22 is the smallest value that works on my machine.
hartwork reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
serhiy-storchaka
serhiy-storchaka commented Feb 10, 2024
View reviewed changes
Comment thread Lib/test/test_xml_etree.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
@serhiy-storchaka
Update Lib/test/test_xml_etree.py
aaffd5d
@serhiy-storchaka

serhiy-storchaka commented Feb 10, 2024

Copy link
Copy Markdown
Member Author

Thank you for testing @lazka.
hartwork reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@serhiy-storchaka
serhiy-storchaka merged commit 4a08e7b into python:main Feb 11, 2024
@miss-islington-app

miss-islington-app Bot commented Feb 11, 2024

Copy link
Copy Markdown

Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11, 3.12.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting core review label Feb 11, 2024
@serhiy-storchaka
serhiy-storchaka deleted the test-etree-xmlpullparser-expat-2.6.0 branch February 11, 2024 10:08
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Feb 11, 2024
@serhiy-storchaka @miss-islington
pythongh-115133: Fix tests for XMLPullParser with Expat 2.6.0 (python…
5cffa94 
…GH-115164)

Feeding the parser by too small chunks defers parsing to prevent
CVE-2023-52425. Future versions of Expat may be more reactive.
(cherry picked from commit 4a08e7b)

Co-authored-by: Serhiy Storchaka <[email protected]>
@bedevere-app

bedevere-app Bot commented Feb 11, 2024

Copy link
Copy Markdown

GH-115288 is a backport of this pull request to the 3.12 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Feb 11, 2024
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Feb 11, 2024
@serhiy-storchaka @miss-islington
pythongh-115133: Fix tests for XMLPullParser with Expat 2.6.0 (python…
f2eebf3 
…GH-115164)

Feeding the parser by too small chunks defers parsing to prevent
CVE-2023-52425. Future versions of Expat may be more reactive.
(cherry picked from commit 4a08e7b)

Co-authored-by: Serhiy Storchaka <[email protected]>
@bedevere-app

bedevere-app Bot commented Feb 11, 2024

Copy link
Copy Markdown

GH-115289 is a backport of this pull request to the 3.11 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Feb 11, 2024
@serhiy-storchaka serhiy-storchaka mentioned this pull request Feb 11, 2024
gh-115133: test_xml_etree.py: Fix for Expat >=2.6.0 with reparse deferral (fixes #115133) #115138
Closed
serhiy-storchaka added a commit that referenced this pull request Feb 11, 2024
@miss-islington @serhiy-storchaka
[3.12] gh-115133: Fix tests for XMLPullParser with Expat 2.6.0 (GH-11…
c4fa79b 
…5164) (GH-115288)

Feeding the parser by too small chunks defers parsing to prevent
CVE-2023-52425. Future versions of Expat may be more reactive.
(cherry picked from commit 4a08e7b)

Co-authored-by: Serhiy Storchaka <[email protected]>
serhiy-storchaka added a commit that referenced this pull request Feb 11, 2024
@miss-islington @serhiy-storchaka
[3.11] gh-115133: Fix tests for XMLPullParser with Expat 2.6.0 (GH-11…
3501eca 
…5164) (GH-115289)

Feeding the parser by too small chunks defers parsing to prevent
CVE-2023-52425. Future versions of Expat may be more reactive.
(cherry picked from commit 4a08e7b)

Co-authored-by: Serhiy Storchaka <[email protected]>
@hartwork hartwork mentioned this pull request Feb 12, 2024
expat: 2.5.0 -> 2.6.0 NixOS/nixpkgs#287040
Merged
2 of 13 tasks
fsc-eriker pushed a commit to fsc-eriker/cpython that referenced this pull request Feb 14, 2024
@serhiy-storchaka @fsc-eriker
pythongh-115133: Fix tests for XMLPullParser with Expat 2.6.0 (python…
0d01a88 
…GH-115164)

Feeding the parser by too small chunks defers parsing to prevent
CVE-2023-52425. Future versions of Expat may be more reactive.
@hartwork hartwork mentioned this pull request Feb 14, 2024
Release Expat 2.6.0 libexpat/libexpat#775
Closed
28 tasks done
@hartwork hartwork mentioned this pull request Feb 14, 2024
[3.8] Upgrade bundled libexpat to 2.6.0 (GH-115399) #115475
Merged
@sethmlarson sethmlarson added needs backport to 3.8 labels Feb 15, 2024
@miss-islington-app

miss-islington-app Bot commented Feb 15, 2024

Copy link
Copy Markdown

Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 3.8.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Feb 15, 2024

Copy link
Copy Markdown

Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 3.9.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Feb 15, 2024

Copy link
Copy Markdown

Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Feb 15, 2024

Copy link
Copy Markdown

Sorry, @serhiy-storchaka, I could not cleanly backport this to 3.8 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 4a08e7b3431cd32a0daf22a33421cd3035343dc4 3.8
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app miss-islington-app Bot assigned serhiy-storchaka Feb 15, 2024
@miss-islington-app

miss-islington-app Bot commented Feb 15, 2024

Copy link
Copy Markdown

Sorry, @serhiy-storchaka, I could not cleanly backport this to 3.9 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 4a08e7b3431cd32a0daf22a33421cd3035343dc4 3.9
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Feb 15, 2024
@serhiy-storchaka @miss-islington
pythongh-115133: Fix tests for XMLPullParser with Expat 2.6.0 (python…
81d0755 
…GH-115164)

Feeding the parser by too small chunks defers parsing to prevent
CVE-2023-52425. Future versions of Expat may be more reactive.
(cherry picked from commit 4a08e7b)

Co-authored-by: Serhiy Storchaka <[email protected]>
@bedevere-app

bedevere-app Bot commented Feb 15, 2024

Copy link
Copy Markdown

GH-115525 is a backport of this pull request to the 3.10 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.10 label Feb 15, 2024
sethmlarson pushed a commit to sethmlarson/cpython that referenced this pull request Feb 15, 2024
@serhiy-storchaka @sethmlarson
[3.9] pythongh-115133: Fix tests for XMLPullParser with Expat 2.6.0 (p…
cd1d5ea 
…ythonGH-115164)

Feeding the parser by too small chunks defers parsing to prevent
CVE-2023-52425. Future versions of Expat may be more reactive.
(cherry picked from commit 4a08e7b)

Co-authored-by: Serhiy Storchaka <[email protected]>
sethmlarson pushed a commit to sethmlarson/cpython that referenced this pull request Feb 15, 2024
@serhiy-storchaka @sethmlarson
[3.8] pythongh-115133: Fix tests for XMLPullParser with Expat 2.6.0 (p…
c9672ea 
…ythonGH-115164)

Feeding the parser by too small chunks defers parsing to prevent
CVE-2023-52425. Future versions of Expat may be more reactive.
(cherry picked from commit 4a08e7b)

Co-authored-by: Serhiy Storchaka <[email protected]>
@sethmlarson

sethmlarson commented Feb 15, 2024

Copy link
Copy Markdown
Contributor

Created backports for 3.9 and 3.8 manually:

  • [3.9] Fix tests for XMLPullParser with Expat 2.6.0 (GH-115133) #115535
  • [3.8] gh-115133: Fix tests for XMLPullParser with Expat 2.6.0 (GH-115164 #115536
hartwork reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
pablogsal pushed a commit that referenced this pull request Feb 19, 2024
@miss-islington @serhiy-storchaka
[3.10] gh-115133: Fix tests for XMLPullParser with Expat 2.6.0 (GH-11…
d9c79e1 
…5164) (#115525)

gh-115133: Fix tests for XMLPullParser with Expat 2.6.0 (GH-115164)

Feeding the parser by too small chunks defers parsing to prevent
CVE-2023-52425. Future versions of Expat may be more reactive.
(cherry picked from commit 4a08e7b)

Co-authored-by: Serhiy Storchaka <[email protected]>
naveen521kk pushed a commit to naveen521kk/cpython that referenced this pull request Feb 19, 2024
@miss-islington @serhiy-storchaka @naveen521kk
[3.12] pythongh-115133: Fix tests for XMLPullParser with Expat 2.6.0 (p…
8efd73c 
…ythonGH-115164) (pythonGH-115288)

Feeding the parser by too small chunks defers parsing to prevent
CVE-2023-52425. Future versions of Expat may be more reactive.
(cherry picked from commit 4a08e7b)

Co-authored-by: Serhiy Storchaka <[email protected]>
naveen521kk pushed a commit to naveen521kk/cpython that referenced this pull request Feb 19, 2024
@miss-islington @serhiy-storchaka @naveen521kk
[3.12] pythongh-115133: Fix tests for XMLPullParser with Expat 2.6.0 (p…
b2c5c9e 
…ythonGH-115164) (pythonGH-115288)

Feeding the parser by too small chunks defers parsing to prevent
CVE-2023-52425. Future versions of Expat may be more reactive.
(cherry picked from commit 4a08e7b)

Co-authored-by: Serhiy Storchaka <[email protected]>
naveen521kk pushed a commit to naveen521kk/cpython that referenced this pull request Feb 19, 2024
@miss-islington @serhiy-storchaka @naveen521kk
[3.12] pythongh-115133: Fix tests for XMLPullParser with Expat 2.6.0 (p…
f92fdcf 
…ythonGH-115164) (pythonGH-115288)

Feeding the parser by too small chunks defers parsing to prevent
CVE-2023-52425. Future versions of Expat may be more reactive.
(cherry picked from commit 4a08e7b)

Co-authored-by: Serhiy Storchaka <[email protected]>
@Bill-Sommerfeld Bill-Sommerfeld mentioned this pull request Feb 20, 2024
epoll patch Bill-Sommerfeld/oi-userland#13
Closed
ambv pushed a commit that referenced this pull request Feb 21, 2024
@sethmlarson @serhiy-storchaka
[3.8] gh-115133: Fix tests for XMLPullParser with Expat 2.6.0 (GH-115164
366f315 
) (GH-115536)

Feeding the parser by too small chunks defers parsing to prevent
CVE-2023-52425. Future versions of Expat may be more reactive.
(cherry picked from commit 4a08e7b)

Co-authored-by: Serhiy Storchaka <[email protected]>
naveen521kk pushed a commit to naveen521kk/cpython that referenced this pull request Feb 21, 2024
@miss-islington @serhiy-storchaka @naveen521kk
[3.12] pythongh-115133: Fix tests for XMLPullParser with Expat 2.6.0 (p…
7d3cf00 
…ythonGH-115164) (pythonGH-115288)

Feeding the parser by too small chunks defers parsing to prevent
CVE-2023-52425. Future versions of Expat may be more reactive.
(cherry picked from commit 4a08e7b)

Co-authored-by: Serhiy Storchaka <[email protected]>
naveen521kk pushed a commit to naveen521kk/cpython that referenced this pull request Jul 11, 2024
@miss-islington @serhiy-storchaka @naveen521kk
[3.12] pythongh-115133: Fix tests for XMLPullParser with Expat 2.6.0 (p…
e6aeef3 
…ythonGH-115164) (pythonGH-115288)

Feeding the parser by too small chunks defers parsing to prevent
CVE-2023-52425. Future versions of Expat may be more reactive.
(cherry picked from commit 4a08e7b)

Co-authored-by: Serhiy Storchaka <[email protected]>
naveen521kk pushed a commit to naveen521kk/cpython that referenced this pull request Jul 11, 2024
@miss-islington @serhiy-storchaka @naveen521kk
[3.12] pythongh-115133: Fix tests for XMLPullParser with Expat 2.6.0 (p…
76ea190 
…ythonGH-115164) (pythonGH-115288)

Feeding the parser by too small chunks defers parsing to prevent
CVE-2023-52425. Future versions of Expat may be more reactive.
(cherry picked from commit 4a08e7b)

Co-authored-by: Serhiy Storchaka <[email protected]>
naveen521kk pushed a commit to naveen521kk/cpython that referenced this pull request Jul 11, 2024
@miss-islington @serhiy-storchaka @naveen521kk
[3.12] pythongh-115133: Fix tests for XMLPullParser with Expat 2.6.0 (p…
95790f9 
…ythonGH-115164) (pythonGH-115288)

Feeding the parser by too small chunks defers parsing to prevent
CVE-2023-52425. Future versions of Expat may be more reactive.
(cherry picked from commit 4a08e7b)

Co-authored-by: Serhiy Storchaka <[email protected]>
naveen521kk pushed a commit to msys2-contrib/cpython-mingw that referenced this pull request Aug 5, 2024
@miss-islington @serhiy-storchaka @naveen521kk
[3.12] pythongh-115133: Fix tests for XMLPullParser with Expat 2.6.0 (p…
ad679e5 
…ythonGH-115164) (pythonGH-115288)

Feeding the parser by too small chunks defers parsing to prevent
CVE-2023-52425. Future versions of Expat may be more reactive.
(cherry picked from commit 4a08e7b)

Co-authored-by: Serhiy Storchaka <[email protected]>
@edmorley edmorley mentioned this pull request Oct 10, 2024
Python 3.13: test_xml_etree fails on expat 2.2.5 (RHEL8 / Rocky linux 8 / Ubuntu 22.04) #125067
Closed
@hugovk hugovk removed the needs backport to 3.9 label Feb 18, 2025
@serhiy-storchaka serhiy-storchaka removed their assignment Jul 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

2 more reviewers
@hartwork hartwork hartwork approved these changes
@Snild-Sony Snild-Sony Snild-Sony approved these changes
Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

tests Tests in the Lib/test dir

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

6 participants

@serhiy-storchaka @lazka @sethmlarson @hartwork @Snild-Sony @hugovk
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.