GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — [3.12] gh-90949: expose Expat API to tune exponential expansion protections (GH-139368) by StanFromIreland · Pull Request #151401 · python/cpython

Conversation

StanFromIreland commented Jun 12, 2026 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

Expose the XML Expat 2.7.2 APIs to tune protections against "billion laughs" [1] attacks.

The exposed APIs are available on Expat parsers, that is, parsers created by xml.parsers.expat.ParserCreate(), as:

parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold), and
parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor).

This completes the work in f04bea4, and improves the existing related documentation.

[1]: https://en.wikipedia.org/wiki/Billion_laughs_attack (cherry picked from commit 6661123) (cherry picked from commit 19bc391)

Issue: Expose Expat XML attack protection APIs #90949

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          [3.12] pythongh-90949: expose Expat API to tune exponential expansion…

ed5f55e

… protections (pythonGH-139368)

Expose the XML Expat 2.7.2 APIs to tune protections against
"billion laughs" [1] attacks.

The exposed APIs are available on Expat parsers, that is,
parsers created by `xml.parsers.expat.ParserCreate()`, as:

- `parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold)`, and
- `parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor)`.

This completes the work in f04bea4,
and improves the existing related documentation.

[1]: https://en.wikipedia.org/wiki/Billion_laughs_attack
(cherry picked from commit 6661123)
(cherry picked from commit 19bc391)

Co-authored-by: Stan Ulbrych <[email protected]>
Co-authored-by: Bénédikt Tran <[email protected]>

StanFromIreland requested a review from picnixz

June 12, 2026 13:18

bedevere-app Bot added the awaiting core review label

Jun 12, 2026

This was referenced Jun 12, 2026

Expose Expat XML attack protection APIs #90949

Closed

gh-90949: expose Expat API to tune exponential expansion protections #139368

Merged

read-the-docs-community Bot commented Jun 12, 2026

Copy link

Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #33112421 | 📁 Comparing ed5f55e against main (6b217ea)

🔍 Preview build

539 files changed · + 3 added · ± 480 modified · - 56 deleted

+ Added

± Modified

- Deleted

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

StanFromIreland mentioned this pull request

Jun 25, 2026

[CVE-2026-7210] Insufficient entropy in pyexpat with protection against hash flooding #149018

Closed

picnixz approved these changes

Jul 4, 2026

View reviewed changes

picnixz left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. But I can't merge it anyway.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

bedevere-app Bot added awaiting merge and removed awaiting core review labels

Jul 4, 2026

picnixz commented Jul 4, 2026

Copy link

Copy Markdown

Member

Why was it a manual backport btw?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

StanFromIreland commented Jul 4, 2026

Copy link

Copy Markdown

Member Author

I don't remember any more, it has been a while. Possibly the generated clinic or test decorators.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Yhg1s merged commit db195e3 into python:3.12

Aug 4, 2026

30 checks passed

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the awaiting merge label

Aug 4, 2026

StanFromIreland deleted the backport-19bc391-3.12 branch

August 7, 2026 14:01

StanFromIreland added the needs backport to 3.11 only security fixes label

Aug 7, 2026

miss-islington-app Bot commented Aug 7, 2026

Copy link

Copy Markdown

Thanks @StanFromIreland for the PR, and @Yhg1s for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot commented Aug 7, 2026

Copy link

Copy Markdown

Sorry, @StanFromIreland and @Yhg1s, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker db195e38a499c837b3ea2cf0aa1c9383e76ddc80 3.11

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot assigned Yhg1s

Aug 7, 2026

bedevere-app Bot commented Aug 7, 2026

Copy link

Copy Markdown

GH-155346 is a backport of this pull request to the 3.11 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.11 only security fixes label

Aug 7, 2026

bedevere-app Bot commented Aug 9, 2026

Copy link

Copy Markdown

GH-155414 is a backport of this pull request to the 3.10 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

pablogsal pushed a commit that referenced this pull request

Aug 9, 2026


          [3.11] gh-90949: expose Expat API to tune exponential expansion prote…

3c1801a

…ctions (GH-139368) (GH-151401) (#155346)

* [3.11] gh-90949: expose Expat API to tune exponential expansion protections (GH-139368) (GH-151401)

Expose the XML Expat 2.7.2 APIs to tune protections against
"billion laughs" [1] attacks.

The exposed APIs are available on Expat parsers, that is,
parsers created by `xml.parsers.expat.ParserCreate()`, as:

- `parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold)`, and
- `parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor)`.

This completes the work in f04bea4,
and improves the existing related documentation.

[1]: https://en.wikipedia.org/wiki/Billion_laughs_attack
(cherry picked from commit 6661123)
(cherry picked from commit 19bc391)
(cherry picked from commit db195e3)

Co-authored-by: Stan Ulbrych <[email protected]>
Co-authored-by: Bénédikt Tran <[email protected]>

* Fix capi member access

---------

Co-authored-by: Bénédikt Tran <[email protected]>

pablogsal pushed a commit that referenced this pull request

Aug 10, 2026


          [3.10] gh-90949: expose Expat API to tune exponential expansion prote…

14c3f89

…ctions (GH-139368) (#151401) (#155414)

Expose the XML Expat 2.7.2 APIs to tune protections against
"billion laughs" [1] attacks.

The exposed APIs are available on Expat parsers, that is,
parsers created by `xml.parsers.expat.ParserCreate()`, as:

- `parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold)`, and
- `parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor)`.

This completes the work in f04bea4,
and improves the existing related documentation.

[1]: https://en.wikipedia.org/wiki/Billion_laughs_attack
(cherry picked from commit 6661123)
(cherry picked from commit 19bc391)


(cherry picked from commit db195e3)

Co-authored-by: Bénédikt Tran <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>

coderabbitai Bot mentioned this pull request

Aug 19, 2026

feat: pivot brand to a terminal/ASCII aesthetic KSEGIT/QuickPdfOcr#32

Merged

Reviewers

picnixz

picnixz approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

Yhg1s

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

StanFromIreland commented Jun 12, 2026 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

read-the-docs-community Bot commented Jun 12, 2026

Documentation build overview

Uh oh!

picnixz left a comment

Choose a reason for hiding this comment

Uh oh!

picnixz commented Jul 4, 2026

Uh oh!

StanFromIreland commented Jul 4, 2026

Uh oh!

Uh oh!

miss-islington-app Bot commented Aug 7, 2026

Uh oh!

miss-islington-app Bot commented Aug 7, 2026

Uh oh!

bedevere-app Bot commented Aug 7, 2026

Uh oh!

bedevere-app Bot commented Aug 9, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

StanFromIreland commented Jun 12, 2026 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.