GeezerVison is showing github.com — [3.10] gh-90949: expose Expat API to tune exponential expansion protections (GH-139368) (#151401) by StanFromIreland · Pull Request #155414 · python/cpython
Conversation
StanFromIreland
commented
Aug 9, 2026
•
edited by bedevere-app
Bot
Loading
Uh oh!
There was an error while loading. Please reload this page.
Expose the XML Expat 2.7.2 APIs to tune protections against "billion laughs" [1] attacks.
The exposed APIs are available on Expat parsers, that is, parsers created by xml.parsers.expat.ParserCreate(), as:
parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold), andparser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor).
This completes the work in f04bea4, and improves the existing related documentation.
[1]: https://en.wikipedia.org/wiki/Billion_laughs_attack (cherry picked from commit 6661123) (cherry picked from commit 19bc391)
(cherry picked from commit db195e3)
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
… protections (pythonGH-139368) (python#151401)
Expose the XML Expat 2.7.2 APIs to tune protections against
"billion laughs" [1] attacks.
The exposed APIs are available on Expat parsers, that is,
parsers created by `xml.parsers.expat.ParserCreate()`, as:
- `parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold)`, and
- `parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor)`.
This completes the work in f04bea4,
and improves the existing related documentation.
[1]: https://en.wikipedia.org/wiki/Billion_laughs_attack
(cherry picked from commit 6661123)
(cherry picked from commit 19bc391)
Co-authored-by: Bénédikt Tran <[email protected]>
(cherry picked from commit db195e3)
This was referenced Aug 9, 2026
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
|
CC @python/windows-team any ideas as to why the Windows build failed?
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
|
Windows should pass now #153610 is merged.
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
StanFromIreland reacted with thumbs up emoji
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.