◐ Shell
reader mode source ↗
Skip to content

[3.13] gh-90949: expose Expat API to tune exponential expansion protections (GH-139368)#151151

Merged
StanFromIreland merged 1 commit into
python:3.13from
StanFromIreland:backport-c078637-3.13
Jun 9, 2026
Merged

[3.13] gh-90949: expose Expat API to tune exponential expansion protections (GH-139368)#151151
StanFromIreland merged 1 commit into
python:3.13from
StanFromIreland:backport-c078637-3.13

Conversation

@StanFromIreland

@StanFromIreland StanFromIreland commented Jun 9, 2026 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Member

Expose the XML Expat 2.7.2 APIs to tune protections against "billion laughs" 1 attacks.

The exposed APIs are available on Expat parsers, that is, parsers created by xml.parsers.expat.ParserCreate(), as:

  • parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold), and
  • parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor).

This completes the work in f04bea4, and improves the existing related documentation.

(cherry picked from commit 6661123)

@StanFromIreland @picnixz
[3.13] pythongh-90949: expose Expat API to tune exponential expansion… …
37af8f0 
… protections (pythonGH-139368) (python#150496)

Expose the XML Expat 2.7.2 APIs to tune protections against
"billion laughs" [1] attacks.

The exposed APIs are available on Expat parsers, that is,
parsers created by `xml.parsers.expat.ParserCreate()`, as:

- `parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold)`, and
- `parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor)`.

This completes the work in f04bea4,
and improves the existing related documentation.

[1]: https://en.wikipedia.org/wiki/Billion_laughs_attack
(cherry picked from commit 6661123)

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
This was referenced Jun 9, 2026
Open
Merged
@StanFromIreland StanFromIreland requested a review from picnixz June 9, 2026 12:49
@read-the-docs-community

read-the-docs-community Bot commented Jun 9, 2026

Copy link
Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #33057787 | 📁 Comparing 37af8f0 against main (9fdbade)

  🔍 Preview build  

456 files changed · ± 417 modified · - 39 deleted

± Modified

- Deleted

@StanFromIreland StanFromIreland changed the title [3.13] gh-90949: expose Expat API to tune exponential expansion protections (GH-139368) (#150496) Jun 9, 2026
@bedevere-app bedevere-app Bot mentioned this pull request Jun 9, 2026
Merged
@StanFromIreland StanFromIreland mentioned this pull request Jun 9, 2026
Merged
picnixz
picnixz approved these changes Jun 9, 2026
View reviewed changes

@picnixz picnixz left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hide comment

So only gen files and NEWS were manually changed? if so LGTM.

Hide details View details @StanFromIreland StanFromIreland merged commit 19bc391 into python:3.13 Jun 9, 2026
45 of 48 checks passed
@StanFromIreland StanFromIreland deleted the backport-c078637-3.13 branch June 9, 2026 14:23
@StanFromIreland StanFromIreland added the needs backport to 3.12 only security fixes label Jun 12, 2026
@miss-islington-app

miss-islington-app Bot commented Jun 12, 2026

Copy link
Copy Markdown

Thanks @StanFromIreland for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖

@miss-islington-app

miss-islington-app Bot commented Jun 12, 2026

Copy link
Copy Markdown

Sorry, @StanFromIreland, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 19bc39127e5c916c42c54487a1ae68be76582f50 3.12

@StanFromIreland

StanFromIreland commented Jun 12, 2026

Copy link
Copy Markdown
Member Author

Oh right, the NEWS files.

@StanFromIreland StanFromIreland removed the needs backport to 3.12 only security fixes label Jun 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@picnixz picnixz picnixz approved these changes

Assignees

@StanFromIreland StanFromIreland

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@StanFromIreland @picnixz