mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-19 00:00:48 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8
cpython/Modules/expat
History
Sebastian Pipping 0a01ed6c2a
[3.12] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) (GH-116248) 
Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods:

- `xml.etree.ElementTree.XMLParser.flush`
- `xml.etree.ElementTree.XMLPullParser.flush`
- `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled`
- `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled`
- `xml.sax.expatreader.ExpatParser.flush`

Based on the "flush" idea from https://github.com/python/cpython/pull/115138#issuecomment-1932444270 .

- Please treat as a security fix related to CVE-2023-52425.

(cherry picked from commit 6a95676bb5)
(cherry picked from commit 73807eb634)
(cherry picked from commit eda2963378)

---------

Includes code suggested-by: Snild Dolkow <snild@sony.com>
and by core dev Serhiy Storchaka.
Co-authored-by: Gregory P. Smith <greg@krypto.org>
2024-03-06 22:01:45 +00:00
..
ascii.h
asciitab.h
COPYING gh-97005: Update libexpat from 2.4.7 to 2.4.9 (gh-97006) 2022-09-22 21:25:05 +09:00
expat.h [3.12] gh-115399: Upgrade bundled libexpat to 2.6.0 (GH-115431) (#115469) 2024-02-14 14:14:34 -08:00
expat_config.h [3.12] gh-115399: Upgrade bundled libexpat to 2.6.0 (GH-115431) (#115469) 2024-02-14 14:14:34 -08:00
expat_external.h
iasciitab.h
internal.h [3.12] gh-115399: Upgrade bundled libexpat to 2.6.0 (GH-115431) (#115469) 2024-02-14 14:14:34 -08:00
latin1tab.h
nametab.h
pyexpatns.h [3.12] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) (GH-116248) 2024-03-06 22:01:45 +00:00
siphash.h [3.12] gh-115399: Upgrade bundled libexpat to 2.6.0 (GH-115431) (#115469) 2024-02-14 14:14:34 -08:00
utf8tab.h
winconfig.h [3.12] gh-115399: Upgrade bundled libexpat to 2.6.0 (GH-115431) (#115469) 2024-02-14 14:14:34 -08:00
xmlparse.c [3.12] gh-115399: Upgrade bundled libexpat to 2.6.0 (GH-115431) (#115469) 2024-02-14 14:14:34 -08:00
xmlrole.c [3.12] gh-115399: Upgrade bundled libexpat to 2.6.0 (GH-115431) (#115469) 2024-02-14 14:14:34 -08:00
xmlrole.h [3.12] gh-115399: Upgrade bundled libexpat to 2.6.0 (GH-115431) (#115469) 2024-02-14 14:14:34 -08:00
xmltok.c [3.12] gh-115399: Upgrade bundled libexpat to 2.6.0 (GH-115431) (#115469) 2024-02-14 14:14:34 -08:00
xmltok.h [3.12] gh-115399: Upgrade bundled libexpat to 2.6.0 (GH-115431) (#115469) 2024-02-14 14:14:34 -08:00
xmltok_impl.c [3.12] gh-115399: Upgrade bundled libexpat to 2.6.0 (GH-115431) (#115469) 2024-02-14 14:14:34 -08:00
xmltok_impl.h gh-98739: Update libexpat from 2.4.9 to 2.5.0 (#98742) 2022-10-27 13:45:12 -07:00
xmltok_ns.c bpo-46400: Update libexpat from 2.4.1 to 2.4.4 (GH-31022) 2022-02-13 00:29:41 +09:00