GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — bpo-17239: Disable external entities in SAX parser by tiran · Pull Request #9217 · python/cpython

Conversation

@tiran

@tiran tiran commented Sep 12, 2018 •
edited by bedevere-bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

The SAX parser no longer processes general external entities by default
to increase security. Before, the parser created network connections
to fetch remote files or loaded local files from the file system for DTD
and entities.

Signed-off-by: Christian Heimes [email protected]

https://bugs.python.org/issue17239

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@tiran tiran added needs backport to 3.6 type-security A security issue labels Sep 12, 2018
@tiran
tiran requested a review from zooba September 12, 2018 16:26
@the-knights-who-say-ni the-knights-who-say-ni added the CLA signed label Sep 12, 2018
@bedevere-bot bedevere-bot added the awaiting merge label Sep 12, 2018
@tiran
tiran force-pushed the bpo17239-sax-ges branch from 686acbb to 3314077 Compare September 12, 2018 16:32
@csabella

csabella commented Sep 12, 2018

Copy link
Copy Markdown
Contributor

Since default functionality is changing, should this be included in the What's New in 3.8 page?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
vstinner
vstinner approved these changes Sep 13, 2018
View reviewed changes

@vstinner vstinner left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Since there is a way to enable it in Python 3.7 and older, it's fine to change the default.

Should we change the default in Python 3.7 and older? I'm not sure about that.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread Doc/library/xml.rst Outdated

@vstinner vstinner Sep 13, 2018

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe elaborate on "no longer" (just mention Python 3.8?).

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread Misc/NEWS.d/next/Security/2018-09-11-18-30-55.bpo-17239.kOpwK2.rst Outdated

@vstinner vstinner Sep 13, 2018

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suggest "The XML save parser". It's not obvious that sax is related to XML if you are not used to XML.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
zooba
zooba approved these changes Sep 17, 2018
View reviewed changes

@zooba zooba left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed with both Cheryl and Victor's suggestions.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@tiran
tiran force-pushed the bpo17239-sax-ges branch 2 times, most recently from 15bf855 to dd8ee7e Compare September 17, 2018 21:34
@tiran

tiran commented Sep 17, 2018

Copy link
Copy Markdown
Member Author

@csabella @vstinner @zooba I have updated the PR.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@zooba

zooba commented Sep 17, 2018

Copy link
Copy Markdown
Member

LGTM
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
vstinner
vstinner approved these changes Sep 17, 2018
View reviewed changes

@vstinner vstinner left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, but maybe remove version numbers until they are really fixed?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread Doc/library/xml.rst Outdated

@vstinner vstinner Sep 17, 2018

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You might only list 3.8.0, but complete this table once we fixed other branches.

I'm not sure about backporting this backward incompatible change to other branches, but if we do it, we should also fix 3.4 and 3.5, no?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@tiran
tiran force-pushed the bpo17239-sax-ges branch 3 times, most recently from d8125c2 to 55db8ce Compare September 22, 2018 05:57
@tiran
bpo-17239: Disable external entities in SAX parser
0c8828c 
The xml.sax and xml.dom.minidom parsers no longer processes external
entities to increase security. Before, the parser created network
connections to fetch remote files or loaded local files from the file
system for DTD and entities.

Signed-off-by: Christian Heimes <[email protected]>
@tiran
tiran force-pushed the bpo17239-sax-ges branch from 55db8ce to 0c8828c Compare September 23, 2018 07:21
@tiran tiran added the 🤖 automerge label Sep 23, 2018
@miss-islington

miss-islington commented Sep 23, 2018

Copy link
Copy Markdown
Contributor

@tiran: Status check is done, and it's a success ✅ .
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington
miss-islington merged commit 17b1d5d into python:master Sep 23, 2018
@miss-islington

miss-islington commented Sep 23, 2018

Copy link
Copy Markdown
Contributor

Thanks @tiran for the PR 🌮🎉.. I'm working now to backport this PR to: 2.7, 3.6, 3.7.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot removed the awaiting merge label Sep 23, 2018
@miss-islington

miss-islington commented Sep 23, 2018

Copy link
Copy Markdown
Contributor

Sorry, @tiran, I could not cleanly backport this to 3.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 17b1d5d4e36aa57a9b25a0e694affbd1ee637e45 3.7
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington miss-islington self-assigned this Sep 23, 2018
@miss-islington

miss-islington commented Sep 23, 2018

Copy link
Copy Markdown
Contributor

Sorry, @tiran, I could not cleanly backport this to 3.6 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 17b1d5d4e36aa57a9b25a0e694affbd1ee637e45 3.6
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington

miss-islington commented Sep 23, 2018

Copy link
Copy Markdown
Contributor

Sorry, @tiran, I could not cleanly backport this to 2.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 17b1d5d4e36aa57a9b25a0e694affbd1ee637e45 2.7
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot removed the needs backport to 3.7 label Sep 23, 2018
@bedevere-bot

bedevere-bot commented Sep 23, 2018

Copy link
Copy Markdown

GH-9511 is a backport of this pull request to the 3.7 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
tiran added a commit to tiran/cpython that referenced this pull request Sep 23, 2018
@tiran
[3.7] bpo-17239: Disable external entities in SAX parser (pythonGH-9217)
018fd09 
The SAX parser no longer processes general external entities by default
to increase security. Before, the parser created network connections
to fetch remote files or loaded local files from the file system for DTD
and entities.

Signed-off-by: Christian Heimes <[email protected]>

https://bugs.python.org/issue17239.
(cherry picked from commit 17b1d5d)

Co-authored-by: Christian Heimes <[email protected]>
tiran added a commit to tiran/cpython that referenced this pull request Sep 23, 2018
@tiran
[3.6] bpo-17239: Disable external entities in SAX parser (pythonGH-9217)
31a4f24 
The SAX parser no longer processes general external entities by default
to increase security. Before, the parser created network connections
to fetch remote files or loaded local files from the file system for DTD
and entities.

Signed-off-by: Christian Heimes <[email protected]>

https://bugs.python.org/issue17239.
(cherry picked from commit 17b1d5d)

Co-authored-by: Christian Heimes <[email protected]>
@bedevere-bot

bedevere-bot commented Sep 23, 2018

Copy link
Copy Markdown

GH-9512 is a backport of this pull request to the 3.6 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot removed the needs backport to 3.6 label Sep 23, 2018
miss-islington pushed a commit that referenced this pull request Sep 24, 2018
@tiran @miss-islington
[3.6] bpo-17239: Disable external entities in SAX parser (GH-9217) (G…
582d188 
…H-9512)

The SAX parser no longer processes general external entities by default
to increase security. Before, the parser created network connections
to fetch remote files or loaded local files from the file system for DTD
and entities.

Signed-off-by: Christian Heimes <[email protected]>

https://bugs.python.org/issue17239.
(cherry picked from commit 17b1d5d)

Co-authored-by: Christian Heimes <[email protected]>



https://bugs.python.org/issue17239
miss-islington pushed a commit that referenced this pull request Sep 24, 2018
@tiran @miss-islington
[3.7] bpo-17239: Disable external entities in SAX parser (GH-9217) (G…
394e55a 
…H-9511)

The SAX parser no longer processes general external entities by default
to increase security. Before, the parser created network connections
to fetch remote files or loaded local files from the file system for DTD
and entities.

Signed-off-by: Christian Heimes <[email protected]>

https://bugs.python.org/issue17239.
(cherry picked from commit 17b1d5d)

Co-authored-by: Christian Heimes <[email protected]>



https://bugs.python.org/issue17239
@gpshead gpshead mentioned this pull request Apr 10, 2022
XML vulnerabilities in Python #61441
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vstinner vstinner vstinner approved these changes
@zooba zooba zooba approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@miss-islington miss-islington

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

7 participants

@tiran @csabella @zooba @miss-islington @bedevere-bot @vstinner @the-knights-who-say-ni
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.