[3.14] gh-90949: expose Expat API to tune exponential expansion protections (GH-139368)#150496
[3.14] gh-90949: expose Expat API to tune exponential expansion protections (GH-139368)#150496StanFromIreland wants to merge 2 commits into
Conversation
… protections (pythonGH-139368) Expose the XML Expat 2.7.2 APIs to tune protections against "billion laughs" [1] attacks. The exposed APIs are available on Expat parsers, that is, parsers created by `xml.parsers.expat.ParserCreate()`, as: - `parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold)`, and - `parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor)`. This completes the work in f04bea4, and improves the existing related documentation. [1]: https://en.wikipedia.org/wiki/Billion_laughs_attack (cherry picked from commit 6661123) Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
Documentation build overview
390 files changed ·
|
| self.assert_root_parser_failure(setter, 123.45) | ||
|
|
||
|
|
||
| @unittest.skipIf(expat.version_info < (2, 4, 0), "requires Expat >= 2.4.0") |
There was a problem hiding this comment.
I think we had a recent issue where this check was not sufficient and tests needed to be disabled in another way using hasattr() checks. Can you check how it's currently done on main please?
There was a problem hiding this comment.
It's identical on main?
cpython/Lib/test/test_pyexpat.py
Lines 1265 to 1266 in d8ff4f8
There was a problem hiding this comment.
Ah indeed, but the problem was for the other API:
@unittest.skipIf(not hasattr(expat.XMLParserType,
"SetAllocTrackerMaximumAmplification"),
"requires Python compiled with Expat >= 2.7.2")
So I think the version check for billion laughs is also wrong and should be changed to the same as for SetAllocTrackerMaximumAmplification. But let's address this separately later in a follow-up PR (so as to ease backports)
|
LGTM but I'd appreciate if @hartwork could have a quick glance just for wordings. I hope every backport has been merged properly (if we are matching against 3.15 then it should good). It's just that I remember that the work was split across multiple PRs... |
@StanFromIreland I have just had a quick look through the lense of… # diff -u1 <(git diff 666112376d574c7802646ee1df6244062671cd61{^,}) <(git diff upstream-readonly/3.14...StanFromIreland/backport-6661123-3.14) | ydiff …and I see:
Are these intended or accidental? |
I think I updated these at some points but I don't remember in which direction. I would say: pick the style that we currently have on main, it doesn't matter. I just don't want to have docs that are different across versions. |
|
@picnixz +1 from me for being in line with |
3 participants
Expose the XML Expat 2.7.2 APIs to tune protections against "billion laughs" 1 attacks.
The exposed APIs are available on Expat parsers, that is, parsers created by
xml.parsers.expat.ParserCreate(), as:parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold), andparser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor).This completes the work in f04bea4, and improves the existing related documentation.