GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — gh-142754: Ensure that Element & Attr instances have the ownerDocument attribute by encukou · Pull Request #142794 · python/cpython

Conversation

encukou commented Dec 16, 2025 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

Element uses __slots__, which means that the ownerDocument
attribute is not inherited from the superclass.
All other slots (except _localName) are set in __init__; not
including ownerDocument was apparently an oversight.

Note that creating Element directly is not supported; you're supposed
to use Document APIs. AFAICS, all supported ways of creating elements do
set ownerDocument.
However, many projects ignore the documentation, and a security fix that
relies on ownerDocument can break them.

Issue: Regression due to removal of quadratic behavior in node ID cache clearing (GH-142145) #142754

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

encukou added 2 commits

December 16, 2025 11:47


          gh-: Ensure that Elements have the ownerDocument attribute

edfe801

Element uses __slots__, which means that the attribute is not inherited
from the superclass.
All other slots (except _localName) are set in __init__; not including
ownerDocument was an oversight.

Note that creating Element directly is not supported; you're supposed
to use Document APIs. All supported ways of creating elements do set
ownerDocument.
However, many projects ignore the documentation.


          blurb

008c30b

bedevere-app Bot mentioned this pull request

Dec 16, 2025

Regression due to removal of quadratic behavior in node ID cache clearing (GH-142145) #142754

Closed

bedevere-app Bot added the awaiting core review label

Dec 16, 2025


          Do the same for Attr

0970bc3

encukou changed the title ~~gh-142754: Ensure that Elements have the ownerDocument attribute~~ gh-142754: Ensure that Element & Attr instances have the ownerDocument attribute

Dec 16, 2025

hugovk commented Dec 16, 2025

Copy link

Copy Markdown

Member

Here's a test case:

    def testSetAttributeNodeWithoutOwnerDocument(self):
        elem = Element("test")
        attr = Attr("id")
        attr.value = "test-id"

        elem.setAttributeNode(attr)

        self.assertEqual(elem.getAttribute("id"), "test-id")

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

hugovk approved these changes

Dec 16, 2025

View reviewed changes

bedevere-app Bot added awaiting merge and removed awaiting core review labels

Dec 16, 2025


          Add test

encukou added needs backport to 3.13

only security fixes

needs backport to 3.14 bugs and security fixes labels

Dec 16, 2025

hugovk enabled auto-merge (squash)

December 16, 2025 11:59

hugovk merged commit 1cc7551 into python:main

Dec 16, 2025

50 checks passed

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot commented Dec 16, 2025

Copy link

Copy Markdown

Thanks @encukou for the PR, and @hugovk for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the awaiting merge label

Dec 16, 2025

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

Dec 16, 2025


          pythongh-142754: Ensure that Element & Attr instances have the ownerD…

484fe63

…ocument attribute (pythonGH-142794)

(cherry picked from commit 1cc7551)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

Dec 16, 2025


          pythongh-142754: Ensure that Element & Attr instances have the ownerD…

a22a03a

…ocument attribute (pythonGH-142794)

(cherry picked from commit 1cc7551)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>

bedevere-app Bot commented Dec 16, 2025

Copy link

Copy Markdown

GH-142818 is a backport of this pull request to the 3.14 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label

Dec 16, 2025

bedevere-app Bot commented Dec 16, 2025

Copy link

Copy Markdown

GH-142819 is a backport of this pull request to the 3.13 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.13 only security fixes label

Dec 16, 2025

hugovk commented Dec 16, 2025

Copy link

Copy Markdown

Member

Thanks for the fix!

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

jacobtylerwalls commented Dec 16, 2025

Copy link

Copy Markdown

Contributor

Lovely. Does this also close #67624?

encukou reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

encukou mentioned this pull request

Dec 16, 2025

xml.dom.minidom.Element.ownerDocument is hidden #67624

Closed

frenzymadness mentioned this pull request

Dec 17, 2025

[3.12] gh-142145: Remove quadratic behavior in node ID cache clearing (GH-142146) #142211

Merged

gpshead pushed a commit that referenced this pull request

Dec 20, 2025


          [3.14] gh-142754: Ensure that Element & Attr instances have the owner…

4424d1b

…Document attribute (GH-142794) (#142818)

gh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (GH-142794)
(cherry picked from commit 1cc7551)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>

gpshead pushed a commit that referenced this pull request

Dec 20, 2025


          [3.13] gh-142754: Ensure that Element & Attr instances have the owner…

86747f1

…Document attribute (GH-142794) (#142819)

gh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (GH-142794)
(cherry picked from commit 1cc7551)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>

gpshead pushed a commit to miss-islington/cpython that referenced this pull request

Dec 21, 2025


          [3.14] pythongh-142754: Ensure that Element & Attr instances have the…

1ff4985

… ownerDocument attribute (pythonGH-142794) (python#142818)

pythongh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (pythonGH-142794)
(cherry picked from commit 1cc7551)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>

Yhg1s pushed a commit that referenced this pull request

Dec 22, 2025


          [3.12] gh-142145: Remove quadratic behavior in node ID cache clearing (…

9c9dda6

…GH-142146) (#142211)

* gh-142145: Remove quadratic behavior in node ID cache clearing (GH-142146)
* gh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (GH-142794)
(cherry picked from commit 1cc7551)
(cherry picked from commit 08d8e18)
(cherry picked from commit 8d2d7bb)

Co-authored-by: Jacob Walls <[email protected]>
Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>

gpshead pushed a commit to miss-islington/cpython that referenced this pull request

Dec 22, 2025


          [3.14] pythongh-142754: Ensure that Element & Attr instances have the…

861ec63

… ownerDocument attribute (pythonGH-142794) (python#142818)

pythongh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (pythonGH-142794)
(cherry picked from commit 1cc7551)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>

gpshead pushed a commit to miss-islington/cpython that referenced this pull request

Dec 22, 2025


          [3.14] pythongh-142754: Ensure that Element & Attr instances have the…

335454d

… ownerDocument attribute (pythonGH-142794) (python#142818)

pythongh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (pythonGH-142794)
(cherry picked from commit 1cc7551)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>

frenzymadness mentioned this pull request

Jan 6, 2026

00471: CVE-2025-12084 fedora-python/cpython#133

Merged

hroncok pushed a commit to fedora-python/cpython that referenced this pull request

Jan 7, 2026


          00471: CVE-2025-12084

8490a12

* pythongh-142145: Remove quadratic behavior in node ID cache clearing (pythonGH-142146)
* pythongh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (pythonGH-142794)
(cherry picked from commit 1cc7551)
(cherry picked from commit 08d8e18)
(cherry picked from commit 8d2d7bb)

Co-authored-by: Jacob Walls <[email protected]>
Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>

frenzymadness pushed a commit to frenzymadness/cpython that referenced this pull request

Jan 8, 2026


          00471: CVE-2025-12084

b975e05

* pythongh-142145: Remove quadratic behavior in node ID cache clearing (pythonGH-142146)
* pythongh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (pythonGH-142794)
(cherry picked from commit 1cc7551)
(cherry picked from commit 08d8e18)
(cherry picked from commit 8d2d7bb)

Co-authored-by: Jacob Walls <[email protected]>
Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>

frenzymadness pushed a commit to fedora-python/cpython that referenced this pull request

Jan 12, 2026


          00471: CVE-2025-12084

01d4fc8

* pythongh-142145: Remove quadratic behavior in node ID cache clearing (pythonGH-142146)
* pythongh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (pythonGH-142794)
(cherry picked from commit 1cc7551)
(cherry picked from commit 08d8e18)
(cherry picked from commit 8d2d7bb)

Co-authored-by: Jacob Walls <[email protected]>
Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>

encukou deleted the fix-142754 branch

January 13, 2026 14:47

frenzymadness pushed a commit to frenzymadness/cpython that referenced this pull request

Jan 14, 2026


          00471: CVE-2025-12084

14f98d8

* pythongh-142145: Remove quadratic behavior in node ID cache clearing (pythonGH-142146)
* pythongh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (pythonGH-142794)
(cherry picked from commit 1cc7551)
(cherry picked from commit 08d8e18)
(cherry picked from commit 8d2d7bb)

Co-authored-by: Jacob Walls <[email protected]>
Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>

pablogsal pushed a commit that referenced this pull request

Jan 25, 2026


          [3.10] gh-142145: Remove quadratic behavior in node ID cache clearing (…

c97e875

…GH-142146) (#142213)

* gh-142145: Remove quadratic behavior in node ID cache clearing (GH-142146)

* Remove quadratic behavior in node ID cache clearing

Co-authored-by: Jacob Walls <[email protected]>

* Add news fragment

---------
(cherry picked from commit 08d8e18)

Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Jacob Walls <[email protected]>

* [3.14] gh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (GH-142794) (#142818)

gh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (GH-142794)
(cherry picked from commit 1cc7551)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>

* gh-142145: relax the no-longer-quadratic test timing (GH-143030)

* gh-142145: relax the no-longer-quadratic test timing

* require cpu resource
(cherry picked from commit 8d2d7bb)

Co-authored-by: Gregory P. Smith <[email protected]>

* merge NEWS entries into one

---------

Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Jacob Walls <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>

pablogsal pushed a commit that referenced this pull request

Jan 25, 2026


          [3.11] gh-142145: Remove quadratic behavior in node ID cache clearing (…

a46c10e

…GH-142146) (#142212)

* gh-142145: Remove quadratic behavior in node ID cache clearing (GH-142146)

* Remove quadratic behavior in node ID cache clearing

Co-authored-by: Jacob Walls <[email protected]>

* Add news fragment

---------
(cherry picked from commit 08d8e18)

Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Jacob Walls <[email protected]>

* [3.14] gh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (GH-142794) (#142818)

gh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (GH-142794)
(cherry picked from commit 1cc7551)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>

* gh-142145: relax the no-longer-quadratic test timing (GH-143030)

* gh-142145: relax the no-longer-quadratic test timing

* require cpu resource
(cherry picked from commit 8d2d7bb)

Co-authored-by: Gregory P. Smith <[email protected]>

* merge NEWS entries into one

---------

Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Jacob Walls <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>

frenzymadness added a commit to fedora-python/cpython that referenced this pull request

Mar 6, 2026


          00471: CVE-2025-12084

3b576cc

* pythongh-142145: Remove quadratic behavior in node ID cache clearing (pythonGH-142146)
* pythongh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (pythonGH-142794)
(cherry picked from commit 1cc7551)
(cherry picked from commit 08d8e18)
(cherry picked from commit 8d2d7bb)

Co-authored-by: Jacob Walls <[email protected]>
Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authoded-by: Lumír Balhar <[email protected]>

hroncok pushed a commit to fedora-python/cpython that referenced this pull request

Mar 26, 2026


          00471: CVE-2025-12084

dfdd855

* pythongh-142145: Remove quadratic behavior in node ID cache clearing (pythonGH-142146)
* pythongh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (pythonGH-142794)
(cherry picked from commit 1cc7551)
(cherry picked from commit 08d8e18)
(cherry picked from commit 8d2d7bb)

Co-authored-by: Jacob Walls <[email protected]>
Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>

hroncok pushed a commit to fedora-python/cpython that referenced this pull request

Mar 26, 2026


          00471: CVE-2025-12084

9170c74

* pythongh-142145: Remove quadratic behavior in node ID cache clearing (pythonGH-142146)
* pythongh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (pythonGH-142794)
(cherry picked from commit 1cc7551)
(cherry picked from commit 08d8e18)
(cherry picked from commit 8d2d7bb)

Co-authored-by: Jacob Walls <[email protected]>
Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authoded-by: Lumír Balhar <[email protected]>

icanhasmath pushed a commit to ActiveState/cpython that referenced this pull request

Oct 28, 2026


          [3.10] pythongh-142145: Remove quadratic behavior in node ID cache cl…

a608df2

…earing (pythonGH-142146) (python#142213)

* pythongh-142145: Remove quadratic behavior in node ID cache clearing (pythonGH-142146)

* Remove quadratic behavior in node ID cache clearing

Co-authored-by: Jacob Walls <[email protected]>

* Add news fragment

---------
(cherry picked from commit 08d8e18)

Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Jacob Walls <[email protected]>

* [3.14] pythongh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (pythonGH-142794) (python#142818)

pythongh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (pythonGH-142794)
(cherry picked from commit 1cc7551)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>

* pythongh-142145: relax the no-longer-quadratic test timing (pythonGH-143030)

* pythongh-142145: relax the no-longer-quadratic test timing

* require cpu resource
(cherry picked from commit 8d2d7bb)

Co-authored-by: Gregory P. Smith <[email protected]>

* merge NEWS entries into one

---------

Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Jacob Walls <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
(cherry picked from commit c97e875)

Reviewers

hugovk

hugovk approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

encukou commented Dec 16, 2025 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hugovk commented Dec 16, 2025

Uh oh!

Uh oh!

miss-islington-app Bot commented Dec 16, 2025

Uh oh!

bedevere-app Bot commented Dec 16, 2025

Uh oh!

bedevere-app Bot commented Dec 16, 2025

Uh oh!

hugovk commented Dec 16, 2025

Uh oh!

jacobtylerwalls commented Dec 16, 2025

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

encukou commented Dec 16, 2025 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.