mirror of
https://github.com/python/cpython.git
synced 2025-12-31 04:23:37 +00:00
6a95676bb5
Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods: - `xml.etree.ElementTree.XMLParser.flush` - `xml.etree.ElementTree.XMLPullParser.flush` - `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled` - `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled` - `xml.sax.expatreader.ExpatParser.flush` Based on the "flush" idea from https://github.com/python/cpython/pull/115138#issuecomment-1932444270 . ### Notes - Please treat as a security fix related to CVE-2023-52425. Includes code suggested-by: Snild Dolkow <snild@sony.com> and by core dev Serhiy Storchaka.
8 lines
351 B
ReStructuredText
8 lines
351 B
ReStructuredText
Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding
|
|
five new methods:
|
|
|
|
* ``xml.etree.ElementTree.XMLParser.flush``
|
|
* ``xml.etree.ElementTree.XMLPullParser.flush``
|
|
* ``xml.parsers.expat.xmlparser.GetReparseDeferralEnabled``
|
|
* ``xml.parsers.expat.xmlparser.SetReparseDeferralEnabled``
|
|
* ``xml.sax.expatreader.ExpatParser.flush``
|