diff options
| author | Sebastian Pipping <sebastian@pipping.org> | 2024-03-06 23:02:55 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-03-06 23:02:55 (GMT) |
| commit | 516a6d4237fe3b9fb02a800b81a0a3153f78685e (patch) | |
| tree | 9e637d9356b69ab3f919e785ea499e8e12823f66 /Python/pythonrun.c | |
| parent | b612ec6b19e9957c79b842ac62ef479fb088899f (diff) | |
| download | cpython-516a6d4237fe3b9fb02a800b81a0a3153f78685e.zip cpython-516a6d4237fe3b9fb02a800b81a0a3153f78685e.tar.gz cpython-516a6d4237fe3b9fb02a800b81a0a3153f78685e.tar.bz2 | |
[3.10] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) (GH-116270)
Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods:
- `xml.etree.ElementTree.XMLParser.flush`
- `xml.etree.ElementTree.XMLPullParser.flush`
- `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled`
- `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled`
- `xml.sax.expatreader.ExpatParser.flush`
Based on the "flush" idea from https://github.com/python/cpython/pull/115138#issuecomment-1932444270 .
Includes code suggested-by: Snild Dolkow <snild@sony.com>
and by core dev Serhiy Storchaka.
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Diffstat (limited to 'Python/pythonrun.c')
0 files changed, 0 insertions, 0 deletions