GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-90949: amend GH-139234 in prevision of future mitigation API by picnixz · Pull Request #139366 · python/cpython

Conversation

@picnixz

@picnixz picnixz commented Sep 26, 2025 •
edited by github-actions Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

There were some typos that slipped under both @hartwork's and my radar and some functions that could be made more generic and used by the next PR.

  • Issue: Expose Expat XML attack protection APIs #90949

📚 Documentation preview 📚: https://cpython-previews--139366.org.readthedocs.build/

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
picnixz added 2 commits September 26, 2025 18:15
@picnixz
simplify XML exception creation
8fa6bd1
@picnixz
make some changes for the next PR
52402c3
@picnixz
picnixz requested a review from AA-Turner as a code owner September 26, 2025 16:22
@picnixz picnixz added the skip news label Sep 26, 2025
@bedevere-app bedevere-app Bot added the awaiting core review label Sep 26, 2025
@bedevere-app bedevere-app Bot mentioned this pull request Sep 26, 2025
Expose Expat XML attack protection APIs #90949
Closed
This was referenced Sep 26, 2025
[3.14] gh-90949: add Expat API to prevent XML deadly allocations (CVE-2025-59375) (GH-139234) #139359
Merged
[3.13] gh-90949: add Expat API to prevent XML deadly allocations (CVE-2025-59375) (GH-139234) #139367
Merged
hartwork
hartwork approved these changes Sep 26, 2025
View reviewed changes

@hartwork hartwork left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@picnixz looks alright with me 👍

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@picnixz

picnixz commented Sep 26, 2025

Copy link
Copy Markdown
Member Author

Oh thank you for the review. I pinged you on the wrong PR but you saw this one. Thanks!
hartwork reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@picnixz
fix typo
ba8651e
@picnixz
picnixz enabled auto-merge (squash) September 26, 2025 16:36
@picnixz

picnixz commented Sep 26, 2025

Copy link
Copy Markdown
Member Author

Once this lands, we can backport this into the backports (just mention that it was also cherry-picked for another commit).
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@picnixz picnixz mentioned this pull request Sep 26, 2025
gh-90949: expose Expat API to tune exponential expansion protections #139368
Merged
@hartwork

hartwork commented Sep 26, 2025

Copy link
Copy Markdown
Contributor

Once this lands, we can backport this into the backports (just mention that it was also cherry-picked for another commit).

@picnixz sounds like you have plain git cherry-pick on top the existing branch in mind rather than cherry-picker. Is that what you meant?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@picnixz

picnixz commented Sep 26, 2025 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member Author

sounds like you have plain git cherry-pick on top the existing branch in mind rather than cherry-picker

yes, I don't know if cherry-picker can do multiple cherry-picks actually
hartwork reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@picnixz

picnixz commented Sep 26, 2025

Copy link
Copy Markdown
Member Author

Mmh, TSAN is taking an incredibly long time.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@picnixz
picnixz merged commit 68a1778 into python:main Sep 26, 2025
4 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting core review label Sep 26, 2025
@picnixz
picnixz deleted the feat/xml/post-139234 branch September 26, 2025 18:16
hartwork pushed a commit to hartwork/cpython that referenced this pull request Sep 26, 2025
@picnixz @hartwork
pythongh-90949: amend pythonGH-139234 in prevision of future mitigati…
b235056 
…on API (python#139366)

Fix some typos left in f04bea4,
and simplify some internal functions to ease maintenance of future
mitigation APIs.

(cherry picked from commit 68a1778)
picnixz added a commit to picnixz/cpython that referenced this pull request Sep 28, 2025
@picnixz
pythongh-90949: amend pythonGH-139234 in prevision of future mitigati…
b52fc88 
…on API (python#139366)

Fix some typos left in f04bea4,
and simplify some internal functions to ease maintenance of future
mitigation APIs.
hartwork pushed a commit to hartwork/cpython that referenced this pull request Oct 2, 2025
@picnixz @hartwork
pythongh-90949: amend pythonGH-139234 in prevision of future mitigati…
a5d026a 
…on API (python#139366)

Fix some typos left in f04bea4,
and simplify some internal functions to ease maintenance of future
mitigation APIs.

(cherry picked from commit 68a1778)
hartwork pushed a commit to hartwork/cpython that referenced this pull request Oct 2, 2025
@picnixz @hartwork
pythongh-90949: amend pythonGH-139234 in prevision of future mitigati…
5680561 
…on API (python#139366)

Fix some typos left in f04bea4,
and simplify some internal functions to ease maintenance of future
mitigation APIs.

(cherry picked from commit 68a1778)
hartwork pushed a commit to hartwork/cpython that referenced this pull request Oct 3, 2025
@picnixz @hartwork
pythongh-90949: amend pythonGH-139234 in prevision of future mitigati…
6ae7665 
…on API (python#139366)

Fix some typos left in f04bea4,
and simplify some internal functions to ease maintenance of future
mitigation APIs.

(cherry picked from commit 68a1778)
@hartwork hartwork mentioned this pull request Oct 5, 2025
gh-139400: Make sure that parent parsers outlive their subparsers in pyexpat #139403
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@AA-Turner AA-Turner Awaiting requested review from AA-Turner AA-Turner is a code owner
1 more reviewer
@hartwork hartwork hartwork approved these changes
Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

skip news

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@picnixz @hartwork
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.