GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.11] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) by hartwork · Pull Request #116268 · python/cpython

Conversation

@hartwork

@hartwork hartwork commented Mar 3, 2024 •
edited by github-actions Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods:

  • xml.etree.ElementTree.XMLParser.flush
  • xml.etree.ElementTree.XMLPullParser.flush
  • xml.parsers.expat.xmlparser.GetReparseDeferralEnabled
  • xml.parsers.expat.xmlparser.SetReparseDeferralEnabled
  • xml.sax.expatreader.ExpatParser.flush

Based on the "flush" idea from #115138 (comment) .

  • Please treat as a security fix related to CVE-2023-52425.

Includes code suggested-by: Snild Dolkow [email protected]
and by core dev Serhiy Storchaka.

(cherry picked from commit 6a95676)

  • Issue: Please expose Expat >=2.6.0 API function XML_SetReparseDeferralEnabled #115398

📚 Documentation preview 📚: https://cpython-previews--116268.org.readthedocs.build/

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@hartwork
pythongh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-…
05e809a 
…52425) (pythonGH-115623)

Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods:

- `xml.etree.ElementTree.XMLParser.flush`
- `xml.etree.ElementTree.XMLPullParser.flush`
- `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled`
- `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled`
- `xml.sax.expatreader.ExpatParser.flush`

Based on the "flush" idea from python#115138 (comment) .

- Please treat as a security fix related to CVE-2023-52425.

Includes code suggested-by: Snild Dolkow <[email protected]>
and by core dev Serhiy Storchaka.

(cherry picked from commit 6a95676)
@bedevere-app bedevere-app Bot added the awaiting review label Mar 3, 2024
@bedevere-app bedevere-app Bot mentioned this pull request Mar 3, 2024
gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) #115623
Merged
@bedevere-app bedevere-app Bot added type-feature A feature request or enhancement type-security A security issue labels Mar 3, 2024
@bedevere-app bedevere-app Bot mentioned this pull request Mar 3, 2024
Please expose Expat >=2.6.0 API function XML_SetReparseDeferralEnabled #115398
Closed
hartwork and others added 2 commits March 6, 2024 22:18
@hartwork
pythongh-115398: Suggest use of hasattr with checking for 3.13 Expa…
b9e9e22 
…t API availability (pythonGH-116278)

Suggest use of "hasattr" with checking for 3.13 Expat API availability

(cherry picked from commit 73807eb)
@gpshead @hartwork
RESTify news API list.
8b338a9 
(cherry picked from commit eda2963)
@hartwork
hartwork force-pushed the backport-6a95676-3.11 branch from e2108d7 to 8b338a9 Compare March 6, 2024 21:20
gpshead
gpshead approved these changes Mar 6, 2024
View reviewed changes
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting review labels Mar 6, 2024
@gpshead
gpshead merged commit fc9da96 into python:3.11 Mar 6, 2024
@bedevere-app bedevere-app Bot removed the awaiting merge label Mar 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

type-feature A feature request or enhancement type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@hartwork @gpshead
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.