8000 gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) by hartwork · Pull Request #115623 · python/cpython · GitHub
[go: up one dir, main page]
Skip to content

gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) #115623

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 39 commits into from
Feb 29, 2024
Merged

gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) #115623

Changes from 1 commit
Commits
Show all changes
39 commits
Select commit Hold shift + click to select a range
7cebe78
pyexpat: Implement methods pyexpat.xmlparser.(Get|Set)ReparseDeferral…
hartwork Feb 17, 2024
c70fbae
etree: Implement method xml.etree.ElementTree.XMLParser.flush (Python…
hartwork Feb 17, 2024
dfca819
pyexpat: Make SetReparseDeferralEnabled available via PyExpat_CAPI
hartwork Feb 7, 2024
4baab67
etree: Implement method xml.etree.ElementTree.XMLParser.flush (C vers…
hartwork Feb 18, 2024
7928942
etree: Implement method xml.etree.ElementTree.XMLPullParser.flush
hartwork Feb 17, 2024
e5e4033
etree: Use XMLPullParser.flush to fix XMLPullParserTest for Expat 2.6.0
hartwork Feb 17, 2024
bc6e1a7
sax: Implement method xml.sax.expatreader.ExpatParser.flush
hartwork Feb 18, 2024
b737f03
sax: Test method xml.sax.expatreader.ExpatParser.flush
hartwork Feb 18, 2024
850e46d
Document new CVE-2023-52425 Expat API (reparse deferral)
hartwork Feb 18, 2024
7002024
_elementtree.c: Document how we know that reparse deferral is enabled
hartwork Feb 21, 2024
2132dfe
sax: Fix xml.sax.expatreader.ExpatParser.flush
hartwork Feb 21, 2024
3d02dfe
etree: Fix xml.etree.ElementTree.XMLParser.flush (Python version)
hartwork Feb 21, 2024
fdd2fac
etree: Fix typo "deferall"
hartwork Feb 21, 2024
dbbd98c
pyexpat: Cover (Get|Set)ReparseDeferralEnabled by tests
hartwork Feb 24, 2024
3b6ea39
sax: Extend xml.sax.expatreader.ExpatParser.flush test coverage
hartwork Feb 24, 2024
5c1cfb7
Doc/whatsnew/3.13.rst: Mention new Expat reparse deferral API
hartwork Feb 24, 2024
a9c666e
pyexpat: Document methods pyexpat.xmlparser.(Get|Set)ReparseDeferralE…
hartwork Feb 24, 2024
35099e3
etree: Document method xml.etree.ElementTree.XMLParser.flush 8000
hartwork Feb 24, 2024
1496e83
etree: Document method xml.etree.ElementTree.XMLPullParser.flush
hartwork Feb 24, 2024
a6927ff
etree: Make docs point to xml.etree.ElementTree.XMLPullParser.flush
hartwork Feb 24, 2024
c5b2159
pyexpat: Move security warning into SetReparseDeferralEnabled docs
hartwork Feb 24, 2024
082bcc1
pyexpat|etree: Mark new Expat API as added in 3.13 in docs
hartwork Feb 24, 2024
f0577e7
pyexpat|sax: Do not be silent about tests skipped for Expat <2.6.0
hartwork Feb 24, 2024
f589908
pyexpat: Simplify test ReparseDeferralTest.test_getter_setter_round_trip
hartwork Feb 24, 2024
4915045
Promote xml.parsers.expat.xmlparser instead of pyexpat.xmlparser
hartwork Feb 24, 2024
d0ed243
etree: Cover method xml.etree.ElementTree.XMLPullParser.flush
hartwork Feb 24, 2024
62e4fd7
pyexpat: Cut whitespace from ReparseDeferralTest.test_getter_setter_r…
hartwork Feb 24, 2024
b0058d5
pyexpat: Drop ReparseDeferralTest.test_getter_initial_value
hartwork Feb 24, 2024
1f70c09
pyexpat: Break a long line for PEP 8
hartwork Feb 24, 2024
a77de0f
Doc/whatsnew/3.13.rst: Do not create a link into undocumented class
hartwork Feb 24, 2024
2f07457
etree: Make XMLPullParserTest._feed only flush when needed
hartwork Feb 24, 2024
4b49de9
etree: Fix XMLPullParserTest.test_flush_[..] for C version
hartwork Feb 24, 2024
3c960a6
etree: Break a long line for PEP 8
hartwork Feb 24, 2024
4855bb9
etree: Make test_flush_reparse_deferral_disabled less exclusive
hartwork Feb 24, 2024
b6a84b2
etree|sax: Simplify .flush implementations
hartwork Feb 24, 2024
0faa19e
etree: Resolve "is_python" in favor of "ET is pyET"
hartwork Feb 24, 2024
40743a6
etree: Fix emphasis syntax for "immediate" in docs
hartwork Feb 24, 2024
a473299
pypexpat: Replace "none" with "NULL" to be correct
hartwork Feb 24, 2024
a6baa0b
pyexpat: Indent warning about xmlparser.SetReparseDeferralEnabled
hartwork Feb 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
etree: Document method xml.etree.ElementTree.XMLPullParser.flush
  • Loading branch information
@hartwork
hartwork committed Feb 24, 2024
commit 1496e8307d8a9ebf7ced30fbf4360d15738eb60b
9 changes: 9 additions & 0 deletions Doc/library/xml.etree.elementtree.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1458,6 +1458,15 @@ XMLPullParser Objects

Feed the given bytes data to the parser.

.. method:: flush()

Triggers parsing of any previously fed unparsed data, which can be
used to ensure more immediate feedback, in particular with Expat >=2.6.0.
The implementation of :meth:`flush` temporarily disables reparse deferral
with Expat (if currently enabled) and triggers a reparse.
Disabling reparse deferral has security consequences; please see
:meth:`xml.parsers.expat.xmlparser.SetReparseDeferralEnabled` for details.

.. method:: close()

Signal the parser that the data stream is terminated. Unlike
Expand Down
0