Uh oh!
There was an error while loading. Please reload this page.
gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) - #115623
Conversation
2346261 to
f05676eCompareUh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
d80dcc4 to
5f23237Compareserhiy-storchaka
commented
Feb 18, 2024
Please do not use rebase and force push. It makes reviewing more difficult -- the reviewer needs to re-read all changes instead of only the difference since the last review. Use merge if you need, but this is only needed if there are conflicts with the main branch. At the end all commits will be squashed and merged as a single commits. |
5f23237 to
a62e863Comparehartwork
commented
Feb 18, 2024
@serhiy-storchaka that's what GitHub has "compare" buttons for, for every push done to the pull request branch: The e-mail that GitHub sends also contain these links.
That's sad. Merge commits should not be in pull requests and commit cuttings do have semantic value. I'll "go cry somewhere now". |
8c26bbe to
439d970Compare439d970 to
850e46dCompareserhiy-storchaka
commented
Feb 18, 2024
The "Compare" link shows a lot of unrelated changes. This is why it is better to use merge instead of rebase. |
hartwork
commented
Feb 18, 2024
@serhiy-storchaka only because I made a mistake in one of the rebases. It works perfectly if the merge base is the same and the person pushing does the right thing. |
serhiy-storchaka
commented
Feb 19, 2024
For future, please don't use rebase. |
Uh oh!
There was an error while loading. Please reload this page.
Snild-Sony
left a comment
There was a problem hiding this comment.
Adding an optional data arg to flush() could be useful for performance: it would allow merging feed(data); flush() into just flush(data), avoiding unnecessary reparsing (specifically, in the case where the original feed also tried to parse).
Another option would be to add a default-false flush flag to feed(). This would perhaps be a better API, as it will be very clear that the flush operation can cause the same effects and errors as a normal feed.
In both cases, the flush operation should be documented along the lines of "Try to parse all available data, possibly at a very high performance cost".
Uh oh!
There was an error while loading. Please reload this page.
serhiy-storchaka
commented
Feb 19, 2024
This is an interesting idea. The drawback is that it is more difficult to detect whether the new feature is supported or not: you cannot simply use |
…-52425) (GH-115623) (GH-116248) Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods: - `xml.etree.ElementTree.XMLParser.flush` - `xml.etree.ElementTree.XMLPullParser.flush` - `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled` - `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled` - `xml.sax.expatreader.ExpatParser.flush` Based on the "flush" idea from #115138 (comment) . - Please treat as a security fix related to CVE-2023-52425. (cherry picked from commit 6a95676) (cherry picked from commit 73807eb) (cherry picked from commit eda2963) --------- Includes code suggested-by: Snild Dolkow <snild@sony.com> and by core dev Serhiy Storchaka. Co-authored-by: Gregory P. Smith <greg@krypto.org>
…52425) (pythonGH-115623) Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods: - `xml.etree.ElementTree.XMLParser.flush` - `xml.etree.ElementTree.XMLPullParser.flush` - `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled` - `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled` - `xml.sax.expatreader.ExpatParser.flush` Based on the "flush" idea from python#115138 (comment) . - Please treat as a security fix related to CVE-2023-52425. Includes code suggested-by: Snild Dolkow <snild@sony.com> and by core dev Serhiy Storchaka. (cherry picked from commit 6a95676)
…-52425) (GH-115623) (#116268) Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods: - `xml.etree.ElementTree.XMLParser.flush` - `xml.etree.ElementTree.XMLPullParser.flush` - `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled` - `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled` - `xml.sax.expatreader.ExpatParser.flush` Based on the "flush" idea from #115138 (comment) . - Please treat as a security fix related to CVE-2023-52425. (cherry picked from commit 6a95676) (cherry picked from commit 73807eb) (cherry picked from commit eda2963) --------- Includes code suggested-by: Snild Dolkow <snild@sony.com> and by core dev Serhiy Storchaka. Co-authored-by: Gregory P. Smith <greg@krypto.org>
…-52425) (GH-115623) (GH-116270) Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods: - `xml.etree.ElementTree.XMLParser.flush` - `xml.etree.ElementTree.XMLPullParser.flush` - `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled` - `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled` - `xml.sax.expatreader.ExpatParser.flush` Based on the "flush" idea from #115138 (comment) . Includes code suggested-by: Snild Dolkow <snild@sony.com> and by core dev Serhiy Storchaka. Co-authored-by: Gregory P. Smith <greg@krypto.org>
…52425) (GH-115623) (GH-116272) Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods: - `xml.etree.ElementTree.XMLParser.flush` - `xml.etree.ElementTree.XMLPullParser.flush` - `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled` - `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled` - `xml.sax.expatreader.ExpatParser.flush` Based on the "flush" idea from #115138 (comment) . Includes code suggested-by: Snild Dolkow <snild@sony.com> and by core dev Serhiy Storchaka. Co-authored-by: Gregory P. Smith <greg@krypto.org>
…52425) (GH-115623) (GH-116275) Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods: - `xml.etree.ElementTree.XMLParser.flush` - `xml.etree.ElementTree.XMLPullParser.flush` - `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled` - `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled` - `xml.sax.expatreader.ExpatParser.flush` Based on the "flush" idea from #115138 (comment) . Includes code suggested-by: Snild Dolkow <snild@sony.com> and by core dev Serhiy Storchaka. Co-authored-by: Gregory P. Smith <greg@krypto.org>
bedevere-bot
commented
Mar 6, 2024
|
bedevere-bot
commented
Mar 6, 2024
|
bedevere-bot
commented
Mar 6, 2024
|
bedevere-bot
commented
Mar 6, 2024
|
bedevere-bot
commented
Mar 6, 2024
|
bedevere-bot
commented
Mar 6, 2024
|
bedevere-bot
commented
Mar 6, 2024
|
bedevere-bot
commented
Mar 6, 2024
|
bedevere-bot
commented
Mar 7, 2024
|
bedevere-bot
commented
Mar 7, 2024
|
bedevere-bot
commented
Mar 7, 2024
|
bedevere-bot
commented
Mar 7, 2024
|
bedevere-bot
commented
Mar 7, 2024
|
bedevere-bot
commented
Mar 7, 2024
|
bedevere-bot
commented
Mar 7, 2024
|
bedevere-bot
commented
Mar 7, 2024
|
…52425) (pythonGH-115623) Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods: - `xml.etree.ElementTree.XMLParser.flush` - `xml.etree.ElementTree.XMLPullParser.flush` - `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled` - `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled` - `xml.sax.expatreader.ExpatParser.flush` Based on the "flush" idea from python#115138 (comment) . ### Notes - Please treat as a security fix related to CVE-2023-52425. Includes code suggested-by: Snild Dolkow <snild@sony.com> and by core dev Serhiy Storchaka.
…nabled addition (pythonGH-116301) * Increment PyExpat_CAPI_MAGIC due to SetReparseDeferralEnabled addition. This is a followup to git commit 6a95676 from Github PR python#115623. * RESTify news API list.
…52425) (pythonGH-115623) Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods: - `xml.etree.ElementTree.XMLParser.flush` - `xml.etree.ElementTree.XMLPullParser.flush` - `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled` - `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled` - `xml.sax.expatreader.ExpatParser.flush` Based on the "flush" idea from python#115138 (comment) . ### Notes - Please treat as a security fix related to CVE-2023-52425. Includes code suggested-by: Snild Dolkow <snild@sony.com> and by core dev Serhiy Storchaka.
…nabled addition (pythonGH-116301) * Increment PyExpat_CAPI_MAGIC due to SetReparseDeferralEnabled addition. This is a followup to git commit 6a95676 from Github PR python#115623. * RESTify news API list.

Mission
Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods:
xml.etree.ElementTree.XMLParser.flushxml.etree.ElementTree.XMLPullParser.flushxml.parsers.expat.xmlparser.GetReparseDeferralEnabledxml.parsers.expat.xmlparser.SetReparseDeferralEnabledxml.sax.expatreader.ExpatParser.flushBased on the "flush" idea from #115138 (comment) .
Notes
CC @serhiy-storchaka
XML_SetReparseDeferralEnabled#115398