diff options
| -rw-r--r-- | Lib/test/test_xml_etree.py | 8 | ||||
| -rw-r--r-- | Misc/NEWS | 2 | ||||
| -rw-r--r-- | Modules/_elementtree.c | 19 |
3 files changed, 25 insertions, 4 deletions
diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py index 44e3142..bc1dd14 100644 --- a/Lib/test/test_xml_etree.py +++ b/Lib/test/test_xml_etree.py @@ -18,7 +18,7 @@ import weakref from itertools import product from test import support -from test.support import TESTFN, findfile, import_fresh_module, gc_collect +from test.support import TESTFN, findfile, import_fresh_module, gc_collect, swap_attr # pyET is the pure-Python implementation. # @@ -1860,6 +1860,12 @@ class BadElementTest(ElementTestCase, unittest.TestCase): e.extend([ET.Element('bar')]) self.assertRaises(ValueError, e.remove, X('baz')) + def test_recursive_repr(self): + # Issue #25455 + e = ET.Element('foo') + with swap_attr(e, 'tag', e): + with self.assertRaises(RuntimeError): + repr(e) # Should not crash class MutatingElementPath(str): def __new__(cls, elem, *args): @@ -143,6 +143,8 @@ Core and Builtins Library ------- +- Issue #25455: Fixed a crash in repr of ElementTree.Element with recursive tag. + - Issue #26556: Update expat to 2.1.1, fixes CVE-2015-1283. - Fix TLS stripping vulnerability in smptlib, CVE-2016-0772. Reported by Team diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c index 0f1d6a1..85ffca2 100644 --- a/Modules/_elementtree.c +++ b/Modules/_elementtree.c @@ -1582,10 +1582,23 @@ _elementtree_Element_remove_impl(ElementObject *self, PyObject *subelement) static PyObject* element_repr(ElementObject* self) { - if (self->tag) - return PyUnicode_FromFormat("<Element %R at %p>", self->tag, self); - else + int status; + + if (self->tag == NULL) return PyUnicode_FromFormat("<Element at %p>", self); + + status = Py_ReprEnter((PyObject *)self); + if (status == 0) { + PyObject *res; + res = PyUnicode_FromFormat("<Element %R at %p>", self->tag, self); + Py_ReprLeave((PyObject *)self); + return res; + } + if (status > 0) + PyErr_Format(PyExc_RuntimeError, + "reentrant call inside %s.__repr__", + Py_TYPE(self)->tp_name); + return NULL; } /*[clinic input] |