GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — gh-90949: expose Expat API to tune exponential expansion protections by picnixz · Pull Request #139368 · python/cpython

Conversation

picnixz commented Sep 26, 2025 •

edited by github-actions Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

This is built on top of #139366.

cc @hartwork

Issue: Expose Expat XML attack protection APIs #90949

📚 Documentation preview 📚: https://cpython-previews--139368.org.readthedocs.build/

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

hartwork reacted with heart emoji

All reactions

❤️ 1 reaction


          expose Expat mitigation API to prevent exponential expansions

bba2678

picnixz requested a review from AA-Turner as a code owner

September 26, 2025 16:38

bedevere-app Bot added the awaiting core review label

Sep 26, 2025

bedevere-app Bot mentioned this pull request

Sep 26, 2025

Expose Expat XML attack protection APIs #90949

Closed

hartwork suggested changes

Sep 26, 2025

View reviewed changes

hartwork left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@picnixz already in pretty good shape 👍

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

Misc/NEWS.d/next/Library/2025-09-26-18-04-28.gh-issue-90949.YHjSzX.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.

picnixz added 3 commits

September 26, 2025 20:22


          Merge branch 'main' into feat/xml/1e9-lolz-api-90949

363bcbc


          Update pyexpat.c

501ef0e


          Update pyexpat.c

197dfa7

picnixz commented

Sep 26, 2025

View reviewed changes

picnixz left a comment

Copy link

Copy Markdown

Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've updated the PR from the web UI but I'll do the rest tomorrow.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

gpshead reviewed

Sep 27, 2025

View reviewed changes

Comment thread

Doc/library/pyexpat.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

Doc/library/pyexpat.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

Doc/library/pyexpat.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.


          address reviews

picnixz requested review from gpshead and hartwork

September 27, 2025 08:19

picnixz changed the title ~~gh-90949: expose Expat mitigation API to prevent exponential expansions~~ gh-90949: expose Expat API to prevent exponential expansions

Sep 27, 2025


          clinic and comments

6c2eab7

hartwork approved these changes

Sep 27, 2025

View reviewed changes

hartwork left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@picnixz I like this new version! 👍

One question: There were changes in here to the previous related news file. This is what it reads on main today:

# cat Misc/NEWS.d/next/Library/2025-09-22-14-40-11.gh-issue-90949.UM35nb.rst
Add :meth:`~xml.parsers.expat.xmlparser.SetAllocTrackerActivationThreshold`
and :meth:`~xml.parsers.expat.xmlparser.SetAllocTrackerMaximumAmplification`
to :ref:`xmlparser <xmlparser-objects>` objects to prevent use of
disproportional amounts of dynamic memory from within an Expat parser.
Patch by Bénédikt Tran.

From what we discussed here, this should probably says things about tuning also?
Should you or me create a follow-up pull request to adjust that after this?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

picnixz commented Sep 27, 2025

Copy link

Copy Markdown

Member Author

I'll amend the NEWS as part of this PR.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

gpshead approved these changes

Sep 27, 2025

View reviewed changes

bedevere-app Bot added awaiting merge and removed awaiting core review labels

Sep 27, 2025


          update NEWS

3ec2ebd

picnixz enabled auto-merge (squash)

September 28, 2025 07:58

picnixz changed the title ~~gh-90949: expose Expat API to prevent exponential expansions~~ gh-90949: expose Expat API to tune exponential expansion protections

Sep 28, 2025

picnixz merged commit 6661123 into python:main

Sep 28, 2025

4 checks passed

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the awaiting merge label

Sep 28, 2025

picnixz deleted the feat/xml/1e9-lolz-api-90949 branch

September 28, 2025 08:37

picnixz commented Sep 28, 2025

Copy link

Copy Markdown

Member Author

Since this is built on top of many other PRs, I'll just wait for the others to be backported first.

hartwork reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

This was referenced Oct 4, 2025

gh-90949: Fix an "unused function" compiler warning introduced in GH-139234 #139558

Merged

gh-139400: Make sure that parent parsers outlive their subparsers in pyexpat #139403

Merged

picnixz mentioned this pull request

Oct 26, 2025

[3.14] gh-90949: add Expat API to prevent XML deadly allocations (CVE-2025-59375) (GH-139234) #139359

Merged

StanFromIreland added the needs backport to 3.14 bugs and security fixes label

May 24, 2026

There was an error while loading. Please reload this page.

miss-islington-app Bot commented May 24, 2026

Copy link

Copy Markdown

Sorry, @picnixz, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 666112376d574c7802646ee1df6244062671cd61 3.10

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot assigned picnixz

May 24, 2026

miss-islington-app Bot commented May 24, 2026

Copy link

Copy Markdown

Sorry, @picnixz, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 666112376d574c7802646ee1df6244062671cd61 3.11

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot commented May 24, 2026

Copy link

Copy Markdown

Sorry, @picnixz, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 666112376d574c7802646ee1df6244062671cd61 3.12

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot commented May 24, 2026

Copy link

Copy Markdown

Sorry, @picnixz, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 666112376d574c7802646ee1df6244062671cd61 3.13

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot commented May 24, 2026

Copy link

Copy Markdown

Sorry, @picnixz, I could not cleanly backport this to 3.14 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 666112376d574c7802646ee1df6244062671cd61 3.14

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

picnixz commented May 24, 2026

Copy link

Copy Markdown

Member Author

@StanFromIreland I see that the backports here totally failed and then it passed under my radar. Could you backport this PR (and any other PRs that need to be backported with it, including docs changes) to 3.14 so that you're no more blocked? I'm sorry to dump my work on you but I won't be available otherwise for that today :(

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

StanFromIreland commented May 24, 2026

Copy link

Copy Markdown

Member

It's fine, I've put it on my list, I'll get to it soon-ish.

hartwork reacted with hooray emoji

All reactions

🎉 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

StanFromIreland reviewed

May 25, 2026

View reviewed changes

Comment thread

Doc/whatsnew/3.15.rst

		disproportional amounts of dynamic memory usage from within an Expat parser.
		(Contributed by Bénédikt Tran in :gh:`90949`.)

		* Add :meth:`~xml.parsers.expat.xmlparser.SetBillionLaughsAttackProtectionActivationThreshold`

StanFromIreland May 25, 2026

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not quite sure how to go about backporting this, I think we'll need to remove it from here?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

picnixz May 25, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, you can drop this part in older branches but we still want the versionadded:: next in the docs directly. What's New can be omitted. You can add the explicit Python version when it was added though (3.14.x) and not just 3.14 (don't know if :: next handles it...)

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

StanFromIreland pushed a commit to StanFromIreland/cpython that referenced this pull request

May 26, 2026


          [3.14] pythongh-90949: expose Expat API to tune exponential expansion…

… protections (pythonGH-139368)

Expose the XML Expat 2.7.2 APIs to tune protections against
"billion laughs" [1] attacks.

The exposed APIs are available on Expat parsers, that is,
parsers created by `xml.parsers.expat.ParserCreate()`, as:

- `parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold)`, and
- `parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor)`.

This completes the work in f04bea4,
and improves the existing related documentation.

[1]: https://en.wikipedia.org/wiki/Billion_laughs_attack
(cherry picked from commit 6661123)

Co-authored-by: Bénédikt Tran <[email protected]>

bedevere-app Bot commented May 26, 2026

Copy link

Copy Markdown

GH-150496 is a backport of this pull request to the 3.14 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label

May 26, 2026

coderabbitai Bot mentioned this pull request

Jun 3, 2026

feat: add docx redline script with style tracking arthrod/html-to-docx2#470

Merged

StanFromIreland added a commit that referenced this pull request

Jun 9, 2026


          [3.14] gh-90949: expose Expat API to tune exponential expansion prote…

c078637

…ctions (GH-139368) (#150496)

Expose the XML Expat 2.7.2 APIs to tune protections against
"billion laughs" [1] attacks.

The exposed APIs are available on Expat parsers, that is,
parsers created by `xml.parsers.expat.ParserCreate()`, as:

- `parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold)`, and
- `parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor)`.

This completes the work in f04bea4,
and improves the existing related documentation.

[1]: https://en.wikipedia.org/wiki/Billion_laughs_attack
(cherry picked from commit 6661123)

Co-authored-by: Bénédikt Tran <[email protected]>

StanFromIreland removed the needs backport to 3.13 only security fixes label

Jun 9, 2026

bedevere-app Bot commented Jun 9, 2026

Copy link

Copy Markdown

GH-151151 is a backport of this pull request to the 3.13 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

StanFromIreland added a commit that referenced this pull request

Jun 9, 2026


          [3.13] gh-90949: expose Expat API to tune exponential expansion prote…

19bc391

…ctions (GH-139368)

Expose the XML Expat 2.7.2 APIs to tune protections against
"billion laughs" [1] attacks.

The exposed APIs are available on Expat parsers, that is,
parsers created by `xml.parsers.expat.ParserCreate()`, as:

- `parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold)`, and
- `parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor)`.

This completes the work in f04bea4,
and improves the existing related documentation.

[1]: https://en.wikipedia.org/wiki/Billion_laughs_attack
(cherry picked from commit 6661123)

Co-authored-by: Bénédikt Tran <[email protected]>

bedevere-app Bot commented Jun 12, 2026

Copy link

Copy Markdown

GH-151401 is a backport of this pull request to the 3.12 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.12 only security fixes label

Jun 12, 2026

Yhg1s pushed a commit that referenced this pull request

Aug 4, 2026


          [3.12] gh-90949: expose Expat API to tune exponential expansion prote…

db195e3

…ctions (GH-139368) (#151401)

Expose the XML Expat 2.7.2 APIs to tune protections against
"billion laughs" [1] attacks.

The exposed APIs are available on Expat parsers, that is,
parsers created by `xml.parsers.expat.ParserCreate()`, as:

- `parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold)`, and
- `parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor)`.

This completes the work in f04bea4,
and improves the existing related documentation.

[1]: https://en.wikipedia.org/wiki/Billion_laughs_attack
(cherry picked from commit 6661123)
(cherry picked from commit 19bc391)

Co-authored-by: Bénédikt Tran <[email protected]>

StanFromIreland removed needs backport to 3.10 needs backport to 3.11 only security fixes labels

Aug 9, 2026

pablogsal pushed a commit that referenced this pull request

Aug 9, 2026


          [3.11] gh-90949: expose Expat API to tune exponential expansion prote…

3c1801a

…ctions (GH-139368) (GH-151401) (#155346)

* [3.11] gh-90949: expose Expat API to tune exponential expansion protections (GH-139368) (GH-151401)

Expose the XML Expat 2.7.2 APIs to tune protections against
"billion laughs" [1] attacks.

The exposed APIs are available on Expat parsers, that is,
parsers created by `xml.parsers.expat.ParserCreate()`, as:

- `parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold)`, and
- `parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor)`.

This completes the work in f04bea4,
and improves the existing related documentation.

[1]: https://en.wikipedia.org/wiki/Billion_laughs_attack
(cherry picked from commit 6661123)
(cherry picked from commit 19bc391)
(cherry picked from commit db195e3)

Co-authored-by: Stan Ulbrych <[email protected]>
Co-authored-by: Bénédikt Tran <[email protected]>

* Fix capi member access

---------

Co-authored-by: Bénédikt Tran <[email protected]>

pablogsal pushed a commit that referenced this pull request

Aug 10, 2026


          [3.10] gh-90949: expose Expat API to tune exponential expansion prote…

14c3f89

…ctions (GH-139368) (#151401) (#155414)

Expose the XML Expat 2.7.2 APIs to tune protections against
"billion laughs" [1] attacks.

The exposed APIs are available on Expat parsers, that is,
parsers created by `xml.parsers.expat.ParserCreate()`, as:

- `parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold)`, and
- `parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor)`.

This completes the work in f04bea4,
and improves the existing related documentation.

[1]: https://en.wikipedia.org/wiki/Billion_laughs_attack
(cherry picked from commit 6661123)
(cherry picked from commit 19bc391)


(cherry picked from commit db195e3)

Co-authored-by: Bénédikt Tran <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>

Reviewers

StanFromIreland

StanFromIreland left review comments

gpshead

gpshead approved these changes

AA-Turner

Awaiting requested review from AA-Turner

AA-Turner is a code owner

+1 more reviewer

hartwork

hartwork approved these changes

Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

picnixz

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

picnixz commented Sep 26, 2025 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hartwork left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

picnixz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hartwork left a comment

Choose a reason for hiding this comment

Uh oh!

picnixz commented Sep 27, 2025

Uh oh!

Uh oh!

picnixz commented Sep 28, 2025

Uh oh!

miss-islington-app Bot commented May 24, 2026

Uh oh!

miss-islington-app Bot commented May 24, 2026

Uh oh!

miss-islington-app Bot commented May 24, 2026

Uh oh!

miss-islington-app Bot commented May 24, 2026

Uh oh!

miss-islington-app Bot commented May 24, 2026

Uh oh!

miss-islington-app Bot commented May 24, 2026

Uh oh!

miss-islington-app Bot commented May 24, 2026

Uh oh!

miss-islington-app Bot commented May 24, 2026

Uh oh!

miss-islington-app Bot commented May 24, 2026

Uh oh!

miss-islington-app Bot commented May 24, 2026

Uh oh!

picnixz commented May 24, 2026

Uh oh!

StanFromIreland commented May 24, 2026

Uh oh!

StanFromIreland May 25, 2026

Choose a reason for hiding this comment

Uh oh!

picnixz May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bedevere-app Bot commented May 26, 2026

Uh oh!

bedevere-app Bot commented Jun 9, 2026

Uh oh!

bedevere-app Bot commented Jun 12, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

picnixz commented Sep 26, 2025 •

edited by github-actions Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

picnixz May 25, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.