GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-126037: fix UAF in `xml.etree.ElementTree.Element.find*` when concurrent mutations happen by picnixz · Pull Request #127964 · python/cpython

Conversation

@picnixz

@picnixz picnixz commented Dec 15, 2024 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member
  • Issue: UAF: xml.etree.ElementTree.Element.find* when concurrent mutations happen #126037

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
picnixz added 2 commits December 15, 2024 15:02
@picnixz
handle mutations in Element.find* methods
1091470
@picnixz
blurb
3584ca9
@bedevere-app bedevere-app Bot mentioned this pull request Dec 15, 2024
UAF: xml.etree.ElementTree.Element.find* when concurrent mutations happen #126037
Closed
@bedevere-app bedevere-app Bot added the awaiting review label Dec 15, 2024
@picnixz picnixz added topic-XML needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes labels Dec 15, 2024
@picnixz
picnixz requested a review from serhiy-storchaka December 15, 2024 14:16
@picnixz picnixz changed the title gh-126037: fix crashes in xml.etree.ElementTree.Element.find* with tag's custom str.__eq__ gh-126037: fix crashes in xml.etree.ElementTree.Element.find* when concurrent mutations happen Dec 17, 2024
@picnixz
Merge branch 'main' into fix/xml/evil-find-126037
911d872
vstinner
vstinner reviewed Feb 4, 2025
View reviewed changes
Comment thread Lib/test/test_xml_etree.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
@picnixz
Merge branch 'main' into fix/xml/evil-find-126037
9f16796
vstinner
vstinner approved these changes Mar 31, 2025
View reviewed changes

@vstinner vstinner left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread Misc/NEWS.d/next/Library/2024-12-15-15-07-22.gh-issue-126037.OyA7JP.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting review labels Mar 31, 2025
picnixz added 3 commits March 31, 2025 11:37
@picnixz
Update 2024-12-15-15-07-22.gh-issue-126037.OyA7JP.rst
efb8967
@picnixz
Update 2024-12-15-15-07-22.gh-issue-126037.OyA7JP.rst
a91fb70
@picnixz
Merge branch 'main' into fix/xml/evil-find-126037
1a51fd3
@picnixz
picnixz merged commit c57623c into python:main Mar 31, 2025
@miss-islington-app

miss-islington-app Bot commented Mar 31, 2025

Copy link
Copy Markdown

Thanks @picnixz for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12, 3.13.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@picnixz
picnixz deleted the fix/xml/evil-find-126037 branch March 31, 2025 10:26
@bedevere-app bedevere-app Bot removed the awaiting merge label Mar 31, 2025
@miss-islington-app

miss-islington-app Bot commented Mar 31, 2025

Copy link
Copy Markdown

Sorry, @picnixz, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c57623c221d46daeaedfbf2b32d041fde0c882de 3.13
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app miss-islington-app Bot assigned picnixz Mar 31, 2025
@miss-islington-app

miss-islington-app Bot commented Mar 31, 2025

Copy link
Copy Markdown

Sorry, @picnixz, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c57623c221d46daeaedfbf2b32d041fde0c882de 3.12
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
picnixz added a commit to picnixz/cpython that referenced this pull request Mar 31, 2025
@picnixz
pythongh-126037: fix UAF in xml.etree.ElementTree.Element.find* whe…
73fb894 
…n concurrent mutations happen (python#127964)

We fix a use-after-free in the `find`, `findtext` and `findall` methods of `xml.etree.ElementTree.Element`
objects that can be triggered when the tag to find implements an `__eq__` method that mutates the
element being queried.
@bedevere-app

bedevere-app Bot commented Mar 31, 2025

Copy link
Copy Markdown

GH-131931 is a backport of this pull request to the 3.13 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.13 only security fixes label Mar 31, 2025
@bedevere-app

bedevere-app Bot commented Mar 31, 2025

Copy link
Copy Markdown

GH-131932 is a backport of this pull request to the 3.12 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Mar 31, 2025
@picnixz picnixz changed the title gh-126037: fix crashes in xml.etree.ElementTree.Element.find* when concurrent mutations happen gh-126037: fix UAF in xml.etree.ElementTree.Element.find* when concurrent mutations happen Mar 31, 2025
picnixz added a commit that referenced this pull request Mar 31, 2025
@picnixz
[3.12] gh-126037: fix UAF in xml.etree.ElementTree.Element.find* wh…
f1689b6 
…en concurrent mutations happen (#127964) (#131932)

gh-126037: fix UAF in `xml.etree.ElementTree.Element.find*` when concurrent mutations happen (#127964)

We fix a use-after-free in the `find`, `findtext` and `findall` methods of `xml.etree.ElementTree.Element`
objects that can be triggered when the tag to find implements an `__eq__` method that mutates the
element being queried.

(cherry picked from commit c57623c)
picnixz added a commit that referenced this pull request Mar 31, 2025
@picnixz
[3.13] gh-126037: fix UAF in xml.etree.ElementTree.Element.find* wh…
588bb6d 
…en current mutations happen (#127964) (#131931)

gh-126037: fix UAF in `xml.etree.ElementTree.Element.find*` when concurrent mutations happen (#127964)

We fix a use-after-free in the `find`, `findtext` and `findall` methods of `xml.etree.ElementTree.Element`
objects that can be triggered when the tag to find implements an `__eq__` method that mutates the
element being queried.

(cherry picked from commit c57623c)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vstinner vstinner vstinner approved these changes
@serhiy-storchaka serhiy-storchaka Awaiting requested review from serhiy-storchaka

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@picnixz picnixz

Labels

topic-XML

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@picnixz @vstinner
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.