GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.9] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) by hartwork · Pull Request #116272 · python/cpython

Conversation

@hartwork

@hartwork hartwork commented Mar 3, 2024 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods:

  • xml.etree.ElementTree.XMLParser.flush
  • xml.etree.ElementTree.XMLPullParser.flush
  • xml.parsers.expat.xmlparser.GetReparseDeferralEnabled
  • xml.parsers.expat.xmlparser.SetReparseDeferralEnabled
  • xml.sax.expatreader.ExpatParser.flush

Based on the "flush" idea from #115138 (comment) .

  • Please treat as a security fix related to CVE-2023-52425.

Includes code suggested-by: Snild Dolkow [email protected]
and by core dev Serhiy Storchaka.

(cherry picked from commit 6a95676)

  • Issue: Please expose Expat >=2.6.0 API function XML_SetReparseDeferralEnabled #115398

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@bedevere-app bedevere-app Bot added the awaiting review label Mar 3, 2024
@bedevere-app bedevere-app Bot mentioned this pull request Mar 3, 2024
gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) #115623
Merged
@bedevere-app bedevere-app Bot added type-feature A feature request or enhancement type-security A security issue labels Mar 3, 2024
@bedevere-app bedevere-app Bot mentioned this pull request Mar 3, 2024
Please expose Expat >=2.6.0 API function XML_SetReparseDeferralEnabled #115398
Closed
@hartwork
pythongh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-…
fb7ea6f 
…52425) (pythonGH-115623)

Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods:

- `xml.etree.ElementTree.XMLParser.flush`
- `xml.etree.ElementTree.XMLPullParser.flush`
- `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled`
- `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled`
- `xml.sax.expatreader.ExpatParser.flush`

Based on the "flush" idea from python#115138 (comment) .

- Please treat as a security fix related to CVE-2023-52425.

Includes code suggested-by: Snild Dolkow <[email protected]>
and by core dev Serhiy Storchaka.

(cherry picked from commit 6a95676)
@hartwork
hartwork force-pushed the backport-6a95676-3.9 branch from 2ab9c9b to fb7ea6f Compare March 3, 2024 15:25
hartwork and others added 2 commits March 6, 2024 22:22
@hartwork
pythongh-115398: Suggest use of hasattr with checking for 3.13 Expa…
d1e179d 
…t API availability (pythonGH-116278)

Suggest use of "hasattr" with checking for 3.13 Expat API availability

(cherry picked from commit 73807eb)
@gpshead @hartwork
RESTify news API list.
fb1edd5 
(cherry picked from commit eda2963)
@gpshead gpshead assigned ambv Mar 6, 2024
@gpshead

gpshead commented Mar 6, 2024

Copy link
Copy Markdown
Member

@ambv - 3.12 and 3.11 branch backports have been merged.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@ambv
ambv merged commit 2007624 into python:3.9 Mar 6, 2024
@bedevere-app bedevere-app Bot removed the awaiting review label Mar 6, 2024
@mattip mattip mentioned this pull request Mar 20, 2024
Update for latest CPython release pypy/pypy#4927
Closed
8 tasks done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@ambv ambv

Labels

type-feature A feature request or enhancement type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@hartwork @gpshead @ambv
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.