diff options
| author | Sebastian Pipping <sebastian@pipping.org> | 2024-03-06 23:03:30 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-03-06 23:03:30 (GMT) |
| commit | 200762426b4b9878c33cdef620aa1a51631dd5df (patch) | |
| tree | e4983a43dc9a152eaf65b7f3528808be2ca4ae5c /Python/pythonrun.c | |
| parent | 468ba95c797623ab4f4ff95ac342ded9e9a74e97 (diff) | |
| download | cpython-200762426b4b9878c33cdef620aa1a51631dd5df.zip cpython-200762426b4b9878c33cdef620aa1a51631dd5df.tar.gz cpython-200762426b4b9878c33cdef620aa1a51631dd5df.tar.bz2 | |
[3.9] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) (GH-116272)
Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods:
- `xml.etree.ElementTree.XMLParser.flush`
- `xml.etree.ElementTree.XMLPullParser.flush`
- `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled`
- `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled`
- `xml.sax.expatreader.ExpatParser.flush`
Based on the "flush" idea from https://github.com/python/cpython/pull/115138#issuecomment-1932444270 .
Includes code suggested-by: Snild Dolkow <snild@sony.com>
and by core dev Serhiy Storchaka.
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Diffstat (limited to 'Python/pythonrun.c')
0 files changed, 0 insertions, 0 deletions