Skip to content

gh-90949: expose Expat API to tune exponential expansion protections#139368

Merged
picnixz merged 7 commits into
python:mainfrom
picnixz:feat/xml/1e9-lolz-api-90949
Sep 28, 2025
Merged

gh-90949: expose Expat API to tune exponential expansion protections#139368
picnixz merged 7 commits into
python:mainfrom
picnixz:feat/xml/1e9-lolz-api-90949

Conversation

@picnixz
Copy link
Copy Markdown
Member

@picnixz picnixz commented Sep 26, 2025 •
edited by github-actions Bot
Loading

@picnixz picnixz requested a review from AA-Turner as a code owner September 26, 2025 16:38
@bedevere-app bedevere-app Bot mentioned this pull request Sep 26, 2025
Open
hartwork
hartwork suggested changes Sep 26, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@hartwork hartwork left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@picnixz already in pretty good shape 👍

Comment thread Misc/NEWS.d/next/Library/2025-09-26-18-04-28.gh-issue-90949.YHjSzX.rst Outdated
picnixz
picnixz commented Sep 26, 2025
View reviewed changes
Copy link
Copy Markdown
Member Author

@picnixz picnixz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've updated the PR from the web UI but I'll do the rest tomorrow.

gpshead
gpshead reviewed Sep 27, 2025
View reviewed changes
Comment thread Doc/library/pyexpat.rst
Comment thread Doc/library/pyexpat.rst Outdated
Comment thread Doc/library/pyexpat.rst Outdated
@picnixz picnixz requested review from gpshead and hartwork September 27, 2025 08:19
@picnixz picnixz changed the title gh-90949: expose Expat mitigation API to prevent exponential expansions gh-90949: expose Expat API to prevent exponential expansions Sep 27, 2025
hartwork
hartwork approved these changes Sep 27, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@hartwork hartwork left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@picnixz I like this new version! 👍

One question: There were changes in here to the previous related news file. This is what it reads on main today:

# cat Misc/NEWS.d/next/Library/2025-09-22-14-40-11.gh-issue-90949.UM35nb.rst
Add :meth:`~xml.parsers.expat.xmlparser.SetAllocTrackerActivationThreshold`
and :meth:`~xml.parsers.expat.xmlparser.SetAllocTrackerMaximumAmplification`
to :ref:`xmlparser <xmlparser-objects>` objects to prevent use of
disproportional amounts of dynamic memory from within an Expat parser.
Patch by Bénédikt Tran.

From what we discussed here, this should probably says things about tuning also?
Should you or me create a follow-up pull request to adjust that after this?

@picnixz
Copy link
Copy Markdown
Member Author

picnixz commented Sep 27, 2025

I'll amend the NEWS as part of this PR.

@picnixz picnixz enabled auto-merge (squash) September 28, 2025 07:58
@picnixz picnixz changed the title gh-90949: expose Expat API to prevent exponential expansions gh-90949: expose Expat API to tune exponential expansion protections Sep 28, 2025
@picnixz picnixz merged commit 6661123 into python:main Sep 28, 2025
45 checks passed
@picnixz picnixz deleted the feat/xml/1e9-lolz-api-90949 branch September 28, 2025 08:37
@picnixz
Copy link
Copy Markdown
Member Author

picnixz commented Sep 28, 2025

Since this is built on top of many other PRs, I'll just wait for the others to be backported first.

This was referenced Oct 4, 2025
Merged
Merged
@picnixz picnixz mentioned this pull request Oct 26, 2025
Merged
@hartwork
Copy link
Copy Markdown
Contributor

hartwork commented Dec 17, 2025

Since this is built on top of many other PRs, I'll just wait for the others to be backported first.

@picnixz would the next step for #90949 be backporting this PR here to 3.10 to 3.14? If yes, should we include #139558 and #139800 and backport three in one? What do you think?

@StanFromIreland StanFromIreland added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels May 24, 2026
@miss-islington-app
Copy link
Copy Markdown

miss-islington-app Bot commented May 24, 2026

Thanks @picnixz for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10.
🐍🍒⛏🤖

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app Bot commented May 24, 2026

Thanks @picnixz for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app Bot commented May 24, 2026

Thanks @picnixz for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app Bot commented May 24, 2026

Thanks @picnixz for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app Bot commented May 24, 2026

Thanks @picnixz for the PR 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app Bot commented May 24, 2026

Sorry, @picnixz, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 666112376d574c7802646ee1df6244062671cd61 3.10

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app Bot commented May 24, 2026

Sorry, @picnixz, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 666112376d574c7802646ee1df6244062671cd61 3.11

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app Bot commented May 24, 2026

Sorry, @picnixz, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 666112376d574c7802646ee1df6244062671cd61 3.12

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app Bot commented May 24, 2026

Sorry, @picnixz, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 666112376d574c7802646ee1df6244062671cd61 3.13

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app Bot commented May 24, 2026

Sorry, @picnixz, I could not cleanly backport this to 3.14 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 666112376d574c7802646ee1df6244062671cd61 3.14

@picnixz
Copy link
Copy Markdown
Member Author

picnixz commented May 24, 2026

@StanFromIreland I see that the backports here totally failed and then it passed under my radar. Could you backport this PR (and any other PRs that need to be backported with it, including docs changes) to 3.14 so that you're no more blocked? I'm sorry to dump my work on you but I won't be available otherwise for that today :(

@StanFromIreland
Copy link
Copy Markdown
Member

StanFromIreland commented May 24, 2026

It's fine, I've put it on my list, I'll get to it soon-ish.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes

@AA-Turner AA-Turner Awaiting requested review from AA-Turner AA-Turner is a code owner

+1 more reviewer

@hartwork hartwork hartwork approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@picnixz picnixz

Labels

needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@picnixz @hartwork @StanFromIreland @gpshead