diff options
| author | Sebastian Pipping <sebastian@pipping.org> | 2024-02-29 22:52:50 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-02-29 22:52:50 (GMT) |
| commit | 6a95676bb526261434dd068d6c49927c44d24a9b (patch) | |
| tree | e610bee9b3ca230b4e157745ebbe38c8a9923f89 /Lib/xml/sax | |
| parent | d01886c5c9e3a62921b304ba7e5145daaa56d3cf (diff) | |
| download | cpython-6a95676bb526261434dd068d6c49927c44d24a9b.zip cpython-6a95676bb526261434dd068d6c49927c44d24a9b.tar.gz cpython-6a95676bb526261434dd068d6c49927c44d24a9b.tar.bz2 | |
gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623)
Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods:
- `xml.etree.ElementTree.XMLParser.flush`
- `xml.etree.ElementTree.XMLPullParser.flush`
- `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled`
- `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled`
- `xml.sax.expatreader.ExpatParser.flush`
Based on the "flush" idea from https://github.com/python/cpython/pull/115138#issuecomment-1932444270 .
### Notes
- Please treat as a security fix related to CVE-2023-52425.
Includes code suggested-by: Snild Dolkow <snild@sony.com>
and by core dev Serhiy Storchaka.
Diffstat (limited to 'Lib/xml/sax')
| -rw-r--r-- | Lib/xml/sax/expatreader.py | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/Lib/xml/sax/expatreader.py b/Lib/xml/sax/expatreader.py index b9ad526..ba3c1e9 100644 --- a/Lib/xml/sax/expatreader.py +++ b/Lib/xml/sax/expatreader.py @@ -214,6 +214,20 @@ class ExpatParser(xmlreader.IncrementalParser, xmlreader.Locator): # FIXME: when to invoke error()? self._err_handler.fatalError(exc) + def flush(self): + if self._parser is None: + return + + was_enabled = self._parser.GetReparseDeferralEnabled() + try: + self._parser.SetReparseDeferralEnabled(False) + self._parser.Parse(b"", False) + except expat.error as e: + exc = SAXParseException(expat.ErrorString(e.code), e, self) + self._err_handler.fatalError(exc) + finally: + self._parser.SetReparseDeferralEnabled(was_enabled) + def _close_source(self): source = self._source try: |