-
-
Notifications
You must be signed in to change notification settings - Fork 30.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) #115623
gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) #115623
Conversation
2346261
to
f05676e
Compare
Misc/NEWS.d/next/Security/2024-02-18-03-14-40.gh-issue-115398.tzvxH8.rst
Outdated
Show resolved
Hide resolved
d80dcc4
to
5f23237
Compare
Please do not use rebase and force push. It makes reviewing more difficult -- the reviewer needs to re-read all changes instead of only the difference since the last review. Use merge if you need, but this is only needed if there are conflicts with the main branch. At the end all commits will be squashed and merged as a single commits. |
5f23237
to
a62e863
Compare
@serhiy-storchaka that's what GitHub has "compare" buttons for, for every push done to the pull request branch: The e-mail that GitHub sends also contain these links.
That's sad. Merge commits should not be in pull requests and commit cuttings do have semantic value. I'll "go cry somewhere now". |
8c26bbe
to
439d970
Compare
439d970
to
850e46d
Compare
The "Compare" link shows a lot of unrelated changes. This is why it is better to use merge instead of rebase. |
@serhiy-storchaka only because I made a mistake in one of the rebases. It works perfectly if the merge base is the same and the person pushing does the right thing. |
For future, please don't use rebase. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Adding an optional data
arg to flush()
could be useful for performance: it would allow merging feed(data); flush()
into just flush(data)
, avoiding unnecessary reparsing (specifically, in the case where the original feed also tried to parse).
Another option would be to add a default-false flush
flag to feed()
. This would perhaps be a better API, as it will be very clear that the flush operation can cause the same effects and errors as a normal feed.
In both cases, the flush operation should be documented along the lines of "Try to parse all available data, possibly at a very high performance cost".
This is an interesting idea. The drawback is that it is more difficult to detect whether the new feature is supported or not: you cannot simply use |
@gpshead cherry-picked to all backports now:
|
…-52425) (GH-115623) (GH-116248) Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods: - `xml.etree.ElementTree.XMLParser.flush` - `xml.etree.ElementTree.XMLPullParser.flush` - `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled` - `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled` - `xml.sax.expatreader.ExpatParser.flush` Based on the "flush" idea from #115138 (comment) . - Please treat as a security fix related to CVE-2023-52425. (cherry picked from commit 6a95676) (cherry picked from commit 73807eb) (cherry picked from commit eda2963) --------- Includes code suggested-by: Snild Dolkow <[email protected]> and by core dev Serhiy Storchaka. Co-authored-by: Gregory P. Smith <[email protected]>
…52425) (pythonGH-115623) Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods: - `xml.etree.ElementTree.XMLParser.flush` - `xml.etree.ElementTree.XMLPullParser.flush` - `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled` - `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled` - `xml.sax.expatreader.ExpatParser.flush` Based on the "flush" idea from python#115138 (comment) . - Please treat as a security fix related to CVE-2023-52425. Includes code suggested-by: Snild Dolkow <[email protected]> and by core dev Serhiy Storchaka. (cherry picked from commit 6a95676)
…-52425) (GH-115623) (#116268) Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods: - `xml.etree.ElementTree.XMLParser.flush` - `xml.etree.ElementTree.XMLPullParser.flush` - `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled` - `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled` - `xml.sax.expatreader.ExpatParser.flush` Based on the "flush" idea from #115138 (comment) . - Please treat as a security fix related to CVE-2023-52425. (cherry picked from commit 6a95676) (cherry picked from commit 73807eb) (cherry picked from commit eda2963) --------- Includes code suggested-by: Snild Dolkow <[email protected]> and by core dev Serhiy Storchaka. Co-authored-by: Gregory P. Smith <[email protected]>
…-52425) (GH-115623) (GH-116270) Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods: - `xml.etree.ElementTree.XMLParser.flush` - `xml.etree.ElementTree.XMLPullParser.flush` - `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled` - `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled` - `xml.sax.expatreader.ExpatParser.flush` Based on the "flush" idea from #115138 (comment) . Includes code suggested-by: Snild Dolkow <[email protected]> and by core dev Serhiy Storchaka. Co-authored-by: Gregory P. Smith <[email protected]>
…52425) (GH-115623) (GH-116272) Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods: - `xml.etree.ElementTree.XMLParser.flush` - `xml.etree.ElementTree.XMLPullParser.flush` - `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled` - `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled` - `xml.sax.expatreader.ExpatParser.flush` Based on the "flush" idea from #115138 (comment) . Includes code suggested-by: Snild Dolkow <[email protected]> and by core dev Serhiy Storchaka. Co-authored-by: Gregory P. Smith <[email protected]>
…52425) (GH-115623) (GH-116275) Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods: - `xml.etree.ElementTree.XMLParser.flush` - `xml.etree.ElementTree.XMLPullParser.flush` - `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled` - `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled` - `xml.sax.expatreader.ExpatParser.flush` Based on the "flush" idea from #115138 (comment) . Includes code suggested-by: Snild Dolkow <[email protected]> and by core dev Serhiy Storchaka. Co-authored-by: Gregory P. Smith <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
…52425) (pythonGH-115623) Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods: - `xml.etree.ElementTree.XMLParser.flush` - `xml.etree.ElementTree.XMLPullParser.flush` - `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled` - `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled` - `xml.sax.expatreader.ExpatParser.flush` Based on the "flush" idea from python#115138 (comment) . ### Notes - Please treat as a security fix related to CVE-2023-52425. Includes code suggested-by: Snild Dolkow <[email protected]> and by core dev Serhiy Storchaka.
…nabled addition (pythonGH-116301) * Increment PyExpat_CAPI_MAGIC due to SetReparseDeferralEnabled addition. This is a followup to git commit 6a95676 from Github PR python#115623. * RESTify news API list.
…52425) (pythonGH-115623) Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods: - `xml.etree.ElementTree.XMLParser.flush` - `xml.etree.ElementTree.XMLPullParser.flush` - `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled` - `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled` - `xml.sax.expatreader.ExpatParser.flush` Based on the "flush" idea from python#115138 (comment) . ### Notes - Please treat as a security fix related to CVE-2023-52425. Includes code suggested-by: Snild Dolkow <[email protected]> and by core dev Serhiy Storchaka.
…nabled addition (pythonGH-116301) * Increment PyExpat_CAPI_MAGIC due to SetReparseDeferralEnabled addition. This is a followup to git commit 6a95676 from Github PR python#115623. * RESTify news API list.
Mission
Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods:
xml.etree.ElementTree.XMLParser.flush
xml.etree.ElementTree.XMLPullParser.flush
xml.parsers.expat.xmlparser.GetReparseDeferralEnabled
xml.parsers.expat.xmlparser.SetReparseDeferralEnabled
xml.sax.expatreader.ExpatParser.flush
Based on the "flush" idea from #115138 (comment) .
Notes
CC @serhiy-storchaka
XML_SetReparseDeferralEnabled
#115398