GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-61441: XML entity expansion limitation by tiran · Pull Request #9265 · python/cpython

Conversation

@tiran

@tiran tiran commented Sep 13, 2018 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

Modelled after https://github.com/GNOME/libxml2/blob/v2.9.8/parser.c#L99

Signed-off-by: Christian Heimes [email protected]

https://bugs.python.org/issue17239

  • Issue: XML vulnerabilities in Python #61441

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@tiran tiran added type-security A security issue DO-NOT-MERGE labels Sep 13, 2018
@the-knights-who-say-ni the-knights-who-say-ni added the CLA signed label Sep 13, 2018
@bedevere-bot bedevere-bot added the awaiting merge label Sep 13, 2018
@vstinner

vstinner commented Sep 13, 2018

Copy link
Copy Markdown
Member

I would prefer to see this change made in expat upstream. We should vendor an unmodified version of expat.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@tiran

tiran commented Sep 13, 2018

Copy link
Copy Markdown
Member Author

That's the plan.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@vstinner vstinner changed the title bpo-17239: XML entity expansion limitation [WIP] bpo-17239: XML entity expansion limitation Sep 13, 2018
@tiran
tiran force-pushed the bpo17239-expat-limit branch from a172a25 to 053db1d Compare September 14, 2018 17:17
@zooba

zooba commented Sep 17, 2018

Copy link
Copy Markdown
Member

Since we ship the vendored one as part of the Windows release, I'd be happy to have this merged for 3.7.1 while we wait for the patch to go upstream.

This is not our public API, so even if they upstream a different version of it, that won't affect us.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@tiran
tiran force-pushed the bpo17239-expat-limit branch 4 times, most recently from 6a51752 to 2cffc90 Compare September 20, 2018 11:30
@tiran
bpo-17239: XML entity expansion limitation
504e092 
Modelled after https://github.com/GNOME/libxml2/blob/v2.9.8/parser.c#L99

Signed-off-by: Christian Heimes <[email protected]>
@tiran
tiran force-pushed the bpo17239-expat-limit branch from 2cffc90 to 504e092 Compare September 23, 2018 11:54
@matrixise

matrixise commented Sep 10, 2019

Copy link
Copy Markdown
Member

@tiran maybe we could close this issue, +- 1y and I suppose expat has been updated.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@arhadthedev

arhadthedev commented Mar 30, 2022

Copy link
Copy Markdown
Member

@tiran Is the PR still relevant?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@ezio-melotti ezio-melotti removed the CLA signed label Jul 13, 2022
@iritkatriel iritkatriel removed the awaiting merge label Feb 21, 2023
disconnect3d
disconnect3d reviewed Mar 13, 2023
View reviewed changes
Comment thread Modules/expat/xmlparse.c
typedef struct {
ENTITY *first_entity;
unsigned int entitiesNestingLevel;
size_t nestedEntitiesExpansionSize; /* in bytes, not XML_Cha) */

@disconnect3d disconnect3d Mar 13, 2023

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
size_t nestedEntitiesExpansionSize; /* in bytes, not XML_Cha) */
size_t nestedEntitiesExpansionSize; /* in bytes, not XML_Char */

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
arhadthedev reacted with thumbs up emoji
All reactions
  • 👍 1 reaction
@erlend-aasland erlend-aasland changed the title [WIP] bpo-17239: XML entity expansion limitation gh-61441: XML entity expansion limitation Jan 4, 2024
@erlend-aasland
erlend-aasland marked this pull request as draft January 4, 2024 10:14
@github-actions

github-actions Bot commented Dec 15, 2024

Copy link
Copy Markdown

This PR is stale because it has been open for 30 days with no activity.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@github-actions github-actions Bot added the stale Stale PR or inactive for long period of time. label Dec 15, 2024
@gpshead

gpshead commented May 24, 2025

Copy link
Copy Markdown
Member

closing as external entity expansion was disabled in sax other PRs (see issue)
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@gpshead gpshead closed this May 24, 2025
@gpshead gpshead mentioned this pull request Apr 10, 2022
XML vulnerabilities in Python #61441
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@disconnect3d disconnect3d disconnect3d left review comments
Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

DO-NOT-MERGE stale Stale PR or inactive for long period of time. type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

11 participants

@tiran @vstinner @zooba @matrixise @arhadthedev @gpshead @disconnect3d @iritkatriel @the-knights-who-say-ni @ezio-melotti @bedevere-bot
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.