FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

gh-136073: Fix expandvars() in Tools/freeze/checkextensions.py by serhiy-storchaka · Pull Request #136093 · python/cpython · GitHub

Repository navigation

gh-136073: Fix expandvars() in Tools/freeze/checkextensions.py - #136093

Open
serhiy-storchaka wants to merge 3 commits into
python:mainfrom
serhiy-storchaka:tool-freeze-checkextensions-expandvars
Open

serhiy-storchaka wants to merge 3 commits into
python:mainfrom
serhiy-storchaka:tool-freeze-checkextensions-expandvars

Conversation

serhiy-storchaka commented Jun 29, 2025 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Member
  • Fix potential infinite recursion and/or memory consumption.
  • Fix a bug when reference can cross boundaries of substitutions, e.g. expandvars('$a)', {'a': '$(b', 'b': 'c'}).
  • Fix potential quadratic complexity.

* Fix potential infinite recursion and/or memory consumption.
* Fix a bug when reference can cross boundaries of substitutions, e.g.
  expandvars('$a)', {'a': '$(b', 'b': 'c'}).
* Fix potential quadratic complexity.

kexinoh commented Dec 22, 2025

Copy link
Copy Markdown

I just realized that the newly discovered code still has some issues, such as when constructing the following example as input:

def generate_bomb_vars(depth):
    vars_dict = {'v0': 'X'}
    for i in range(1, depth + 1):
        vars_dict[f'v{i}'] = f'$(v{i-1})$(v{i-1})'
    target_str = f'$(v{depth})'
    return target_str, vars_dict

Copy link
Copy Markdown
Member Author

The new version is optimized, it returns the result much faster for depth=20 and depth=30. But note that for depth=30 the result takes 1 GiB, and for depth=60 it requires the amount of memory larger than the mainstream computers support. The code will produce the result as fast as it can, but it cannot do anything if the result cannot fit in a memory.

This is similar to a billion laughs attack. The only way to treat it is to impose an artificial application specific limit on the result size. If this was a code facing an external world, it would be an issue. But this is an internal function in an internal tool. It is only used with data generated by other parts of the tool.

Copy link
Copy Markdown

This PR is stale because it has been open for 30 days with no activity.

github-actions Bot added the stale Stale PR or inactive for long period of time. label Apr 26, 2026
serhiy-storchaka added the needs backport to 3.15 bugs and security fixes label May 30, 2026
github-actions Bot removed the stale Stale PR or inactive for long period of time. label Jun 1, 2026

github-actions Bot commented Sep 3, 2026

Copy link
Copy Markdown

This PR is stale because it has been open for 90 days with no activity.

github-actions Bot added the stale Stale PR or inactive for long period of time. label Sep 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

awaiting core review needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes skip news stale Stale PR or inactive for long period of time.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants


Back | FazBrowse Home | New Git URL