diff options
| author | Sebastian Pipping <sebastian@pipping.org> | 2024-03-06 23:03:44 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-03-06 23:03:44 (GMT) |
| commit | 854f6452947d9c6124f8f30f0423e8766dab972f (patch) | |
| tree | 836918181c1d570ac2d18223df57c7f7f691c321 /Python/pythonrun.c | |
| parent | 4d58a1d8fb27048c11bcbda3da1bebf78f979335 (diff) | |
| download | cpython-854f6452947d9c6124f8f30f0423e8766dab972f.zip cpython-854f6452947d9c6124f8f30f0423e8766dab972f.tar.gz cpython-854f6452947d9c6124f8f30f0423e8766dab972f.tar.bz2 | |
[3.8] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) (GH-116275)
Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods:
- `xml.etree.ElementTree.XMLParser.flush`
- `xml.etree.ElementTree.XMLPullParser.flush`
- `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled`
- `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled`
- `xml.sax.expatreader.ExpatParser.flush`
Based on the "flush" idea from https://github.com/python/cpython/pull/115138#issuecomment-1932444270 .
Includes code suggested-by: Snild Dolkow <snild@sony.com>
and by core dev Serhiy Storchaka.
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Diffstat (limited to 'Python/pythonrun.c')
0 files changed, 0 insertions, 0 deletions