Please expose Expat >=2.6.0 API function XML_SetReparseDeferralEnabled #115398
Description
Feature or enhancement
Proposal:
Hello CPython team! 👋
Expat 2.6.0 introduced a new function XML_SetReparseDeferralEnabled that currently neither xml.parsers.expat.XMLParserType of pyexpat nor xml.etree.ElementTree.XMLParser of ElementTree give access to it, so when some Python-based library or application finds themselves in a situation where toggling reparse deferral is beneficial or needed for their scenario in the future, they will not be able to do so with ease or at all.
Please note that this is a sibling ticket to #90949 in some sense and implementations could be combined or done in one go, potentially.
Also please note that…
- for
xml.etree.ElementTree.XMLParsera new methoddef flush(self):could be a reasonable API addition based on the idea gh-115133: test_xml_etree.py: Fix for Expat >=2.6.0 with reparse deferral (fixes #115133) #115138 (comment) ; - the same seems to apply to
xml.sax.xmlreader.IncrementalParser.
I cannot provide a pull request on the topic economically myself unfortunately, but I am happy to support any related efforts (including voice calls on the topic as needed). Thanks in advance!
Best, Sebastian
Has this already been discussed elsewhere?
This is a minor feature, which does not need previous discussion elsewhere
Links to previous discussion of this feature:
No response
Linked PRs
- gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) #115623
- [3.12] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) #116248
- [3.11] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) #116268
- [3.10] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) #116270
- [3.9] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) #116272
- [3.8] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) #116275
- gh-115398: Suggest use of
hasattrwith checking for 3.13 Expat API availability #116278 - gh-115398: Increment PyExpat_CAPI_MAGIC for SetReparseDeferralEnabled addition #116301
- gh-115398: Revert
PyExpat_CAPI_MAGICversion bump #116411
Activity
gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (…
pythongh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-…
pythongh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-…
pythongh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-…
pythongh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-…
pythongh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-…
gh-115398: Increment PyExpat_CAPI_MAGIC for SetReparseDeferralEnabled…
pythongh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-…
pythongh-115398: Increment PyExpat_CAPI_MAGIC for SetReparseDeferralE…
Revert "pythongh-115398: Increment PyExpat_CAPI_MAGIC for SetReparseD…
gh-115398: Revert `PyExpat_CAPI_MAGIC` version bump (GH-116411)
gh-115398: Suggest use of `hasattr` with checking for 3.13 Expat API …
pythongh-115398: Suggest use of `hasattr` with checking for 3.13 Expa…
28 remaining items
[3.9] gh-117187: Fix XML tests for vanilla Expat <2.6.0 (GH-117203) (G…
[3.8] gh-117187: Fix XML tests for vanilla Expat <2.6.0 (GH-117203) (#…
Squashed commit of the following:
Squashed commit of the following:
main/python3: upgrade to 3.11.9
pythongh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-…
pythongh-115398: Increment PyExpat_CAPI_MAGIC for SetReparseDeferralE…
pythongh-115398: Revert `PyExpat_CAPI_MAGIC` version bump (pythonGH-1…
pythongh-115398: Suggest use of `hasattr` with checking for 3.13 Expa…
pythongh-117187: Fix XML tests for vanilla Expat <2.6.0 (pythonGH-117203
hroncok commentedon Apr 18, 2024
Python built
--with-system-expatwith expat >= 2.6 will require expat >= 2.6 on runtime as well. If you updated to expat >= 2.6 and built Python with this fix, do not allow your users to update Python independently without updating expat as well, or they will getundefined symbol: XML_SetReparseDeferralEnabledfrom pyexpat (e.g. when using the venv module).https://lists.fedoraproject.org/archives/list/python-devel@lists.fedoraproject.org/thread/7XHGWHBQDNFKNGSZTP44SSD6PQKZPG6C/
cc @mgorny @danigm @mcepl @mitya57 @asottile
danigm commentedon Apr 18, 2024
@hroncok Thanks for the heads up. As far as I know this shouldn't be a problem for Tumbleweed because how it's updated, but for Leap is something to keep in mind.
python3: update expat dependency
ReimarBauer commentedon Aug 30, 2024
On MSS it was reported 2.6.1 works with python 3.11.8 and 2.6.2 doesn't.
jamesdalg commentedon Sep 1, 2025
This is still a recurring issue, years on.