GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-115398: Increment PyExpat_CAPI_MAGIC for SetReparseDeferralEnabled addition by gpshead · Pull Request #116301 · python/cpython

Conversation

@gpshead

@gpshead gpshead commented Mar 4, 2024 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

Increment PyExpat_CAPI_MAGIC due to SetReparseDeferralEnabled addition.

This is a followup to git commit 6a95676 from Github PR #115623.

Also ReSTify's the NEWS entry.

  • Issue: Please expose Expat >=2.6.0 API function XML_SetReparseDeferralEnabled #115398

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
gpshead added 2 commits March 4, 2024 10:01
@gpshead
Increment PyExpat_CAPI_MAGIC due to SetReparseDeferralEnabled addition.
71f8eaa
This is a followup to git commit
6a95676 from Github PR python#115623.
@gpshead
RESTify news API list.
9eab96f
@bedevere-app bedevere-app Bot mentioned this pull request Mar 4, 2024
Please expose Expat >=2.6.0 API function XML_SetReparseDeferralEnabled #115398
Closed
@gpshead
gpshead marked this pull request as ready for review March 4, 2024 10:14
@bedevere-app bedevere-app Bot added the awaiting core review label Mar 4, 2024
@gpshead
gpshead enabled auto-merge (squash) March 4, 2024 10:17
This was referenced Mar 4, 2024
[3.12] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) #116248
Merged
gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) #115623
Merged
@gpshead gpshead self-assigned this Mar 4, 2024
@gpshead
gpshead merged commit eda2963 into python:main Mar 4, 2024
@bedevere-app bedevere-app Bot removed the awaiting core review label Mar 4, 2024
woodruffw pushed a commit to woodruffw-forks/cpython that referenced this pull request Mar 4, 2024
@gpshead @woodruffw
pythongh-115398: Increment PyExpat_CAPI_MAGIC for SetReparseDeferralE…
682ce0d
…nabled addition (pythonGH-116301)

* Increment PyExpat_CAPI_MAGIC due to SetReparseDeferralEnabled addition.

This is a followup to git commit
6a95676 from Github PR python#115623.

* RESTify news API list.
@encukou

encukou commented Mar 6, 2024

Copy link
Copy Markdown
Member

This looks unnecessary: There's an extra size field that's also checked. See #115623 (comment) .
@gpshead, were you aware of that discussion?

hartwork reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

hartwork added a commit to hartwork/cpython that referenced this pull request Mar 6, 2024
@hartwork
Revert "pythongh-115398: Increment PyExpat_CAPI_MAGIC for SetReparseD…
f4eca41
…eferralEnabled addition (pythonGH-116301)"

This reverts part of commit eda2963.
@hartwork hartwork mentioned this pull request Mar 6, 2024
gh-115398: Revert PyExpat_CAPI_MAGIC version bump #116411
Merged
@hartwork

hartwork commented Mar 6, 2024

Copy link
Copy Markdown
Contributor

It's also hurting, so I have created pull request #116411 now to revert the bump.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

gpshead pushed a commit that referenced this pull request Mar 6, 2024
@hartwork
gh-115398: Revert PyExpat_CAPI_MAGIC version bump (GH-116411)
8a8e920
Revert "gh-115398: Increment PyExpat_CAPI_MAGIC for SetReparseDeferralEnabled addition (GH-116301)"

This reverts part of commit eda2963.  Why? this comment buried in an earlier code review explains:

I checked again how that value is used in practice, it's here:

https://github.com/python/cpython/blob/0c80da4c14d904a367968955544dd6ae58c8101c/Modules/_elementtree.c#L4363-L4372

Based on that code my understanding is that loading bigger structs from the future is considered okay unless `PyExpat_CAPI_MAGIC` differs, which implies that (1) magic needs to stay the same to support loading the future from the past and (2) that `PyExpat_CAPI_MAGIC` should only ever change for changes that do not increase size (but keep it constant).

To summarize, that supports your argument.
I checked branches 3.8, 3.9, 3.10, 3.11, 3.12 now and they all have the same comparison code there so reverting that magic string bump will support seamless backporting.
@gpshead

gpshead commented Mar 6, 2024

Copy link
Copy Markdown
Member Author

I hadn't seen the earlier review comment, I just looked at the history of the magic and saw it was bumped up to 1.1 during a bugfix release 6+ years ago. I trust y'all's analysis. revert merged.

hartwork reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@gpshead
gpshead deleted the fixup/gh115398/details branch March 6, 2024 17:58
adorilson pushed a commit to adorilson/cpython that referenced this pull request Mar 25, 2024
@gpshead @adorilson
pythongh-115398: Increment PyExpat_CAPI_MAGIC for SetReparseDeferralE…
6b5cf8d
…nabled addition (pythonGH-116301)

* Increment PyExpat_CAPI_MAGIC due to SetReparseDeferralEnabled addition.

This is a followup to git commit
6a95676 from Github PR python#115623.

* RESTify news API list.
adorilson pushed a commit to adorilson/cpython that referenced this pull request Mar 25, 2024
@hartwork @adorilson
pythongh-115398: Revert PyExpat_CAPI_MAGIC version bump (pythonGH-1…
4e6040f
…16411)

Revert "pythongh-115398: Increment PyExpat_CAPI_MAGIC for SetReparseDeferralEnabled addition (pythonGH-116301)"

This reverts part of commit eda2963.  Why? this comment buried in an earlier code review explains:

I checked again how that value is used in practice, it's here:

https://github.com/python/cpython/blob/0c80da4c14d904a367968955544dd6ae58c8101c/Modules/_elementtree.c#L4363-L4372

Based on that code my understanding is that loading bigger structs from the future is considered okay unless `PyExpat_CAPI_MAGIC` differs, which implies that (1) magic needs to stay the same to support loading the future from the past and (2) that `PyExpat_CAPI_MAGIC` should only ever change for changes that do not increase size (but keep it constant).

To summarize, that supports your argument.
I checked branches 3.8, 3.9, 3.10, 3.11, 3.12 now and they all have the same comparison code there so reverting that magic string bump will support seamless backporting.
diegorusso pushed a commit to diegorusso/cpython that referenced this pull request Apr 17, 2024
@gpshead @diegorusso
pythongh-115398: Increment PyExpat_CAPI_MAGIC for SetReparseDeferralE…
45eb588
…nabled addition (pythonGH-116301)

* Increment PyExpat_CAPI_MAGIC due to SetReparseDeferralEnabled addition.

This is a followup to git commit
6a95676 from Github PR python#115623.

* RESTify news API list.
diegorusso pushed a commit to diegorusso/cpython that referenced this pull request Apr 17, 2024
@hartwork @diegorusso
pythongh-115398: Revert PyExpat_CAPI_MAGIC version bump (pythonGH-1…
6ce8614
…16411)

Revert "pythongh-115398: Increment PyExpat_CAPI_MAGIC for SetReparseDeferralEnabled addition (pythonGH-116301)"

This reverts part of commit eda2963.  Why? this comment buried in an earlier code review explains:

I checked again how that value is used in practice, it's here:

https://github.com/python/cpython/blob/0c80da4c14d904a367968955544dd6ae58c8101c/Modules/_elementtree.c#L4363-L4372

Based on that code my understanding is that loading bigger structs from the future is considered okay unless `PyExpat_CAPI_MAGIC` differs, which implies that (1) magic needs to stay the same to support loading the future from the past and (2) that `PyExpat_CAPI_MAGIC` should only ever change for changes that do not increase size (but keep it constant).

To summarize, that supports your argument.
I checked branches 3.8, 3.9, 3.10, 3.11, 3.12 now and they all have the same comparison code there so reverting that magic string bump will support seamless backporting.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@gpshead gpshead

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@gpshead @encukou @hartwork
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.