GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — [3.14] gh-90949: expose Expat API to tune exponential expansion protections (GH-139368) by StanFromIreland · Pull Request #150496 · python/cpython

Conversation

StanFromIreland commented May 26, 2026 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

Expose the XML Expat 2.7.2 APIs to tune protections against "billion laughs" 1 attacks.

The exposed APIs are available on Expat parsers, that is, parsers created by xml.parsers.expat.ParserCreate(), as:

parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold), and
parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor).

This completes the work in f04bea4, and improves the existing related documentation.

Issue: Expose Expat XML attack protection APIs #90949

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          [3.14] pythongh-90949: expose Expat API to tune exponential expansion…

… protections (pythonGH-139368)

Expose the XML Expat 2.7.2 APIs to tune protections against
"billion laughs" [1] attacks.

The exposed APIs are available on Expat parsers, that is,
parsers created by `xml.parsers.expat.ParserCreate()`, as:

- `parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold)`, and
- `parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor)`.

This completes the work in f04bea4,
and improves the existing related documentation.

[1]: https://en.wikipedia.org/wiki/Billion_laughs_attack
(cherry picked from commit 6661123)

Co-authored-by: Bénédikt Tran <[email protected]>

StanFromIreland requested a review from picnixz

May 26, 2026 20:44

This was referenced May 26, 2026

Expose Expat XML attack protection APIs #90949

Closed

gh-90949: expose Expat API to tune exponential expansion protections #139368

Merged

bedevere-app Bot added the awaiting core review label

May 26, 2026

read-the-docs-community Bot commented May 26, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #33057152 | 📁 Comparing a35a24a against main (8ab7b43)

🔍 Preview build

393 files changed · ± 376 modified · - 17 deleted

± Modified

- Deleted

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

picnixz reviewed

May 26, 2026

View reviewed changes

Comment thread

Lib/test/test_pyexpat.py

		self.assert_root_parser_failure(setter, 123.45)


		@unittest.skipIf(expat.version_info < (2, 4, 0), "requires Expat >= 2.4.0")

picnixz May 26, 2026

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we had a recent issue where this check was not sufficient and tests needed to be disabled in another way using hasattr() checks. Can you check how it's currently done on main please?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

StanFromIreland May 27, 2026

Copy link

Copy Markdown

Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's identical on main?

cpython/Lib/test/test_pyexpat.py

Lines 1265 to 1266 in d8ff4f8

	@unittest.skipIf(expat.version_info < (2, 4, 0), "requires Expat >= 2.4.0")
	class ExpansionProtectionTest(AttackProtectionTestBase, unittest.TestCase):

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

picnixz May 27, 2026

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah indeed, but the problem was for the other API:

@unittest.skipIf(not hasattr(expat.XMLParserType,
                             "SetAllocTrackerMaximumAmplification"),
                 "requires Python compiled with Expat >= 2.7.2")

So I think the version check for billion laughs is also wrong and should be changed to the same as for SetAllocTrackerMaximumAmplification. But let's address this separately later in a follow-up PR (so as to ease backports)

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

StanFromIreland reacted with thumbs up emoji

All reactions

👍 1 reaction

picnixz reviewed

May 26, 2026

View reviewed changes

Comment thread

Modules/pyexpat.c Resolved

Uh oh!

There was an error while loading. Please reload this page.

picnixz reviewed

May 26, 2026

View reviewed changes

Comment thread

Modules/pyexpat.c Resolved

Uh oh!

There was an error while loading. Please reload this page.

StanFromIreland marked this pull request as draft

May 26, 2026 21:49

bedevere-app Bot removed the awaiting core review label

May 26, 2026


          Fix some extraneous whitespace

1493ed4

StanFromIreland marked this pull request as ready for review

May 27, 2026 15:20

bedevere-app Bot added the awaiting core review label

May 27, 2026

StanFromIreland requested a review from picnixz

May 27, 2026 15:20

picnixz commented May 27, 2026

Copy link

Copy Markdown

Member

LGTM but I'd appreciate if @hartwork could have a quick glance just for wordings. I hope every backport has been merged properly (if we are matching against 3.15 then it should good). It's just that I remember that the work was split across multiple PRs...

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

hartwork commented May 28, 2026

Copy link

Copy Markdown

Contributor

LGTM but I'd appreciate if @hartwork could have a quick glance just for wordings. I hope every backport has been merged properly (if we are matching against 3.15 then it should good). It's just that I remember that the work was split across multiple PRs...

@StanFromIreland I have just had a quick look through the lense of…

# diff -u1 <(git diff 666112376d574c7802646ee1df6244062671cd61{^,}) <(git diff upstream-readonly/3.14...StanFromIreland/backport-6661123-3.14) | ydiff

…and I see:

differences in @unittest.skipIf machinery
differences in float style "100.0" versus int style "100" in documentation

Are these intended or accidental?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

picnixz commented May 28, 2026

Copy link

Copy Markdown

Member

differences in float style "100.0" versus int style "100" in documentation

I think I updated these at some points but I don't remember in which direction. I would say: pick the style that we currently have on main, it doesn't matter. I just don't want to have docs that are different across versions.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

hartwork commented May 28, 2026

Copy link

Copy Markdown

Contributor

@picnixz +1 from me for being in line with main 👍

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

coderabbitai Bot mentioned this pull request

Jun 3, 2026

feat: add docx redline script with style tracking arthrod/html-to-docx2#470

Merged

picnixz reviewed

Jun 9, 2026

View reviewed changes

Comment thread

Modules/pyexpat.c Resolved

Uh oh!

There was an error while loading. Please reload this page.


          Whoops, re-indent after a previous un-indent

6f53983

StanFromIreland requested a review from picnixz

June 9, 2026 11:49

picnixz reviewed

Jun 9, 2026

View reviewed changes

Comment thread

Modules/pyexpat.c Outdated

Comment on lines +2406 to +2407

		capi->SetAllocTrackerActivationThreshold = NULL;
		capi->SetAllocTrackerMaximumAmplification = NULL;

picnixz Jun 9, 2026

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the else is the wrong here actually, it's SetBillionLaughsAttackProtectionActivationThreshold

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

hartwork reacted with thumbs up emoji

All reactions

👍 1 reaction

StanFromIreland Jun 9, 2026

Copy link

Copy Markdown

Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's the same on main:

cpython/Modules/pyexpat.c

Lines 2548 to 2554 in 9fdbade

	#if XML_COMBINED_VERSION >= 20400
	capi->SetBillionLaughsAttackProtectionActivationThreshold = XML_SetBillionLaughsAttackProtectionActivationThreshold;
	capi->SetBillionLaughsAttackProtectionMaximumAmplification = XML_SetBillionLaughsAttackProtectionMaximumAmplification;
	#else
	capi->SetAllocTrackerActivationThreshold = NULL;
	capi->SetAllocTrackerMaximumAmplification = NULL;
	#endif

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

StanFromIreland Jun 9, 2026

Copy link

Copy Markdown

Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wrote #151147 for main/3.15, for here:

Suggested change

	capi->SetAllocTrackerActivationThreshold = NULL;
	capi->SetAllocTrackerMaximumAmplification = NULL;
	capi->SetBillionLaughsAttackProtectionActivationThreshold = NULL;
	capi->SetBillionLaughsAttackProtectionMaximumAmplification = NULL;

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

hartwork reacted with thumbs up emoji

All reactions

👍 1 reaction

picnixz Jun 9, 2026

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh!

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          Apply suggestion from @StanFromIreland

a35a24a

StanFromIreland requested a review from picnixz

June 9, 2026 12:04

picnixz approved these changes

Jun 9, 2026

View reviewed changes

picnixz left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now I think we're good. If docs need to be amended we'll do it but C should be ok.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

bedevere-app Bot added awaiting merge and removed awaiting core review labels

Jun 9, 2026

StanFromIreland commented Jun 9, 2026

Copy link

Copy Markdown

Member Author

Fuzzer failures are unrelated (ast and plistlib).

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

StanFromIreland merged commit c078637 into python:3.14

Jun 9, 2026

52 of 55 checks passed

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the awaiting merge label

Jun 9, 2026

StanFromIreland deleted the backport-6661123-3.14 branch

June 9, 2026 12:42

StanFromIreland added the needs backport to 3.13 only security fixes label

Jun 9, 2026

miss-islington-app Bot commented Jun 9, 2026

Copy link

Copy Markdown

Thanks @StanFromIreland for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot commented Jun 9, 2026

Copy link

Copy Markdown

Sorry, @StanFromIreland, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c078637e8642783d90b33c6b983fa15ff29c24d6 3.13

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot assigned StanFromIreland

Jun 9, 2026

hugovk mentioned this pull request

Jun 9, 2026

[3.14] gh-149018: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (GH-149023) #149646

Merged

StanFromIreland removed the needs backport to 3.13 only security fixes label

Jun 9, 2026

bedevere-app Bot commented Jun 9, 2026

Copy link

Copy Markdown

GH-151151 is a backport of this pull request to the 3.13 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Reviewers

picnixz

picnixz approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

StanFromIreland

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

Conversation

StanFromIreland commented May 26, 2026 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

read-the-docs-community Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation build overview

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

picnixz commented May 27, 2026

Uh oh!

hartwork commented May 28, 2026

Uh oh!

picnixz commented May 28, 2026

Uh oh!

hartwork commented May 28, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

picnixz left a comment

Choose a reason for hiding this comment

Uh oh!

StanFromIreland commented Jun 9, 2026

Uh oh!

Uh oh!

miss-islington-app Bot commented Jun 9, 2026

Uh oh!

miss-islington-app Bot commented Jun 9, 2026

Uh oh!

bedevere-app Bot commented Jun 9, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

StanFromIreland commented May 26, 2026 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

read-the-docs-community Bot commented May 26, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.