gh-136061: IDLE - modernize idlelib code in editor.Editor.load_extension methodname processing by johnzhou721 · Pull Request #134874 · python/cpython · GitHub

A DOS by Quadratic complexity issue is fixed in idlelib. Part of (but does not fix) #134873.

Issue: A Series of Simple DOS Vulnerabilities #134873

Issue: IDLE: Performance issue processing config-extensions.def #136061

I believe that the 6 lines from 1205 to 1210 can be replaced by 2 lines -- an re.match and an f-string. I will submit an alternate proposal later. I believe that the input vevent name should have either no <>s or 2 of each, with maybe the latter for back compatibility (I will test). But I will may stick with the more general code to not break buggy extensions.

Assuming this is the fix that we go with, let's add a test case.

@terryjreedy so should I leave the code for now, or should I go ahead and replace with the re.match thing you are going to propose? @ZeroIntensity so do you mean that active voice is preferred in release notes? I can replace this specific case with the change that you are suggesting, but I'm asking for advice in this aspect for future News.

Yes, I think it can be. Will fix.

…

Message ID: ***@***.***>

@johnzhou721
I would greatly appreciate it if you could kindly address the issue located at

cpython/Lib/idlelib/editor.py

Lines 1373 to 1378 in 5ab66a8

    
           while True: 
        
               chars = chars[:-1] 
        
               ncharsdeleted = ncharsdeleted + 1 
        
               have = len(chars.expandtabs(tabwidth)) 
        
               if have <= want or chars[-1] not in " \t": 
        
                   break

. I sincerely apologize for overlooking this in my previous message.

As an example, I successfully utilized Gemini 2.5 Pro to generate a reasonable fix for this problem. Could you give it a try?

@kexinoh Yes, I would give it a try once I have time; however, I am working on something else right now -- is it acceptable if I delay this by about a day or so?

(if anyone else has a fix ready before I get to this, feel free to make a pr onto the branch of my pr and I'll merge it into my PR)

…dziqkQ.rst Co-authored-by: Peter Bierma <zintensitydev@gmail.com>

@kexinoh I have a small amount of time not enough to work on anything else before I end my day so I attempted the issue you pointed out -- but can't test though.

Assuming this is the fix that we go with, let's add a test case.

Where? How? For what? Thanks! @ZeroIntensity

Where? How? For what?

We need a test case in test_idlelib that results in DOS/extreme slowness off main. Basically, just do something to prove that this PR fixes it (probably just testing with large amounts of data).

Can the PR title be changed to be more useful? Every PR is a change. Good titles say «Add thing to spam» or «Fix eggs with ham»

This PR is stale because it has been open for 30 days with no activity.

This PR is stale because it has been open for 90 days with no activity.

Thanks @johnzhou721 for the PR, and @zware for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14, 3.15.
🐍🍒⛏🤖

GH-156911 is a backport of this pull request to the 3.15 branch.

GH-156912 is a backport of this pull request to the 3.14 branch.

GH-156913 is a backport of this pull request to the 3.13 branch.

…methodname processing (pythonGH-134874)

… methodname processing (GH-134874) (#156911) gh-136061: Simplify idlelib.editor.EditorWindow.load_extension methodname processing (GH-134874) (cherry picked from commit 0625799) Co-authored-by: John <johnzhou721@gmail.com>

fix a dos

e5f4260

johnzhou721 requested a review from terryjreedy as a code owner May 29, 2025 03:23

bedevere-app Bot added the awaiting review label May 29, 2025

bedevere-app Bot mentioned this pull request May 29, 2025

A Series of Simple DOS Vulnerabilities #134873

Closed

📜🤖 Added by blurb_it.

aa5b5a8

terryjreedy added this to IDLE Issues May 29, 2025

terryjreedy moved this to In Progress in IDLE Issues May 29, 2025

terryjreedy self-assigned this May 29, 2025

ZeroIntensity reviewed May 29, 2025

View reviewed changes

Comment thread Misc/NEWS.d/next/Security/2025-05-29-03-24-18.gh-issue-134873.dziqkQ.rst Outdated

ZeroIntensity added type-security A security issue needs backport to 3.9 needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes labels May 29, 2025

zware reviewed May 29, 2025

View reviewed changes

Comment thread Lib/idlelib/editor.py

Update Misc/NEWS.d/next/Security/2025-05-29-03-24-18.gh-issue-134873.…

edfa904

…dziqkQ.rst Co-authored-by: Peter Bierma <zintensitydev@gmail.com>

johnzhou721 added 2 commits May 29, 2025 22:31

another dos and also simplify

2090baf

grumble

d2838a5

johnzhou721 requested review from ZeroIntensity and zware May 30, 2025 04:06

merwok reviewed Oct 31, 2025

View reviewed changes

Comment thread Lib/idlelib/editor.py

merwok reviewed Oct 31, 2025

View reviewed changes

Comment thread Lib/idlelib/News3.txt

johnzhou721 changed the title gh-136061: IDLE - update code in editor.Editor.load_extension gh-136061: IDLE - modernize idlelib code in editor.Editor.load_extension methodname processing Nov 4, 2025

johnzhou721 added 3 commits November 4, 2025 17:05

Merge branch 'main' into idledos

6961dd5

Use a new 3.15 section

c0ff375

add blanklines

a54f475

github-actions Bot added the stale Stale PR or inactive for long period of time. label Apr 25, 2026

serhiy-storchaka added the needs backport to 3.15 bugs and security fixes label May 30, 2026

github-actions Bot removed the stale Stale PR or inactive for long period of time. label May 31, 2026

github-actions Bot added the stale Stale PR or inactive for long period of time. label Sep 3, 2026

Merge branch 'main' into idledos

b25a3f9

zware enabled auto-merge (squash) September 3, 2026 20:43

zware approved these changes Sep 3, 2026

View reviewed changes

bedevere-app Bot added awaiting merge and removed awaiting change review labels Sep 3, 2026

zware merged commit 0625799 into python:main Sep 3, 2026
51 of 52 checks passed

github-project-automation Bot moved this from In Progress to Done in IDLE Issues Sep 3, 2026

bedevere-app Bot removed the awaiting merge label Sep 3, 2026

bedevere-app Bot removed the needs backport to 3.15 bugs and security fixes label Sep 3, 2026

bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Sep 3, 2026

bedevere-app Bot removed the needs backport to 3.13 only security fixes label Sep 3, 2026

clin1234 pushed a commit to clin1234/cpython that referenced this pull request Sep 12, 2026

pythongh-136061 : Simplify idlelib.editor.EditorWindow.load_extension …

8041d09

…methodname processing (pythonGH-134874)

gh-136061: IDLE - modernize idlelib code in editor.Editor.load_extension methodname processing by johnzhou721 · Pull Request #134874 · python/cpython · GitHub

Repository navigation

gh-136061: IDLE - modernize idlelib code in editor.Editor.load_extension methodname processing - #134874

gh-136061: IDLE - modernize idlelib code in editor.Editor.load_extension methodname processing#134874zware merged 39 commits intopython:mainpython/cpython:mainfrom johnzhou721:idledosjohnzhou721/cpython:idledosCopy head branch name to clipboard

Conversation

johnzhou721 commented May 29, 2025 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

terryjreedy commented May 29, 2025

Uh oh!

ZeroIntensity left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

johnzhou721 commented May 29, 2025 via email

Uh oh!

Uh oh!

johnzhou721 commented May 29, 2025 via email

Uh oh!

kexinoh commented May 30, 2025

Uh oh!

johnzhou721 commented May 30, 2025

Uh oh!

johnzhou721 commented May 30, 2025

Uh oh!

johnzhou721 commented May 30, 2025

Uh oh!

ZeroIntensity commented May 30, 2025

Uh oh!

Uh oh!

Uh oh!

merwok commented Nov 4, 2025

Uh oh!

github-actions Bot commented Apr 25, 2026

Uh oh!

github-actions Bot commented Sep 3, 2026

Uh oh!

Uh oh!

miss-islington-app Bot commented Sep 3, 2026

Uh oh!

bedevere-app Bot commented Sep 3, 2026

Uh oh!

bedevere-app Bot commented Sep 3, 2026

Uh oh!

bedevere-app Bot commented Sep 3, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

gh-136061: IDLE - modernize idlelib code in editor.Editor.load_extension methodname processing#134874
zware merged 39 commits into
python:mainfrom
johnzhou721:idledos

johnzhou721 commented May 29, 2025 •
edited by bedevere-app Bot
Loading