Skip to content

gh-90949: expose Expat API to tune exponential expansion protections #139368

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
picnixz merged 7 commits into from
Sep 28, 2025
Merged

gh-90949: expose Expat API to tune exponential expansion protections #139368

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
bba2678
expose Expat mitigation API to prevent exponential expansions
picnixz Sep 26, 2025
363bcbc
Merge branch 'main' into feat/xml/1e9-lolz-api-90949
picnixz Sep 26, 2025
501ef0e
Update pyexpat.c
picnixz Sep 26, 2025
197dfa7
Update pyexpat.c
picnixz Sep 26, 2025
9734458
address reviews
picnixz Sep 27, 2025
6c2eab7
clinic and comments
picnixz Sep 27, 2025
3ec2ebd
update NEWS
picnixz Sep 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Update pyexpat.c
  • Loading branch information
@picnixz
picnixz authored Sep 26, 2025
commit 197dfa7e82c08edccf998edea05ed5c05922b2b4
5 changes: 3 additions & 2 deletions Modules/pyexpat.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1218,7 +1218,7 @@ set_maximum_amplification(xmlparseobject *self,
}
#endif

#if XML_COMBINED_VERSION >= 20402
#if XML_COMBINED_VERSION >= 20400
/*[clinic input]
@permit_long_summary
@permit_long_docstring_body
Expand Down Expand Up @@ -1246,7 +1246,7 @@ pyexpat_xmlparser_SetBillionLaughsAttackProtectionActivationThreshold_impl(xmlpa
}
#endif

#if XML_COMBINED_VERSION >= 20402
#if XML_COMBINED_VERSION >= 20400
/*[clinic input]
@permit_long_summary
@permit_long_docstring_body
Expand Down Expand Up @@ -2382,6 +2382,7 @@ pyexpat_exec(PyObject *mod)
capi->SetAllocTrackerActivationThreshold = NULL;
capi->SetAllocTrackerMaximumAmplification = NULL;
#endif

/* export using capsule */
PyObject *capi_object = PyCapsule_New(capi, PyExpat_CAPSULE_NAME,
pyexpat_capsule_destructor);
Expand Down
Loading