FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

[3.14] gh-90949: add Expat API to prevent XML deadly allocations (CVE-2025-59375) (GH-139234) by picnixz · Pull Request #139359 · python/cpython · GitHub

/ cpython Public

[3.14] gh-90949: add Expat API to prevent XML deadly allocations (CVE-2025-59375) (GH-139234) - #139359

Merged
picnixz merged 9 commits into
python:3.14from
picnixz:backport-f04bea4-3.14
Nov 2, 2025
ConversationCommits (9)ChecksFiles changed
Merged

[3.14] gh-90949: add Expat API to prevent XML deadly allocations (CVE-2025-59375) (GH-139234)#139359
picnixz merged 9 commits into
python:3.14from
picnixz:backport-f04bea4-3.14

Conversation

picnixz commented Sep 26, 2025 •
edited
Loading

Copy link
Copy Markdown
Member

Expose the XML Expat 2.7.2 mitigation APIs to disallow use of disproportional amounts of dynamic memory from within an Expat parser (see CVE-2025-59375 for instance).

The exposed APIs are available on Expat parsers, that is, parsers created by xml.parsers.expat.ParserCreate(), as:

  • parser.SetAllocTrackerActivationThreshold(threshold), and
  • parser.SetAllocTrackerMaximumAmplification(max_factor).

(cherry picked from commits f04bea4 and 68a1778)

📚 Documentation preview 📚: https://cpython-previews--139359.org.readthedocs.build/

This was referenced Sep 26, 2025
Closed
Merged
picnixz force-pushed the backport-f04bea4-3.14 branch from 2c87b60 to 1f60895 Compare September 26, 2025 14:43
picnixz marked this pull request as ready for review September 26, 2025 14:44
picnixz force-pushed the backport-f04bea4-3.14 branch from 1f60895 to f2030ab Compare September 26, 2025 15:15
[3.14] pythongh-90949: add Expat API to prevent XML deadly allocations (
3c430ec 
CVE-2025-59375) (pythonGH-139234)

Expose the XML Expat 2.7.2 mitigation APIs to disallow use of
disproportional amounts of dynamic memory from within an Expat
parser (see CVE-2025-59375 for instance).

The exposed APIs are available on Expat parsers, that is,
parsers created by `xml.parsers.expat.ParserCreate()`, as:

- `parser.SetAllocTrackerActivationThreshold(threshold)`, and
- `parser.SetAllocTrackerMaximumAmplification(max_factor)`.

(cherry picked from commit f04bea4)

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
picnixz force-pushed the backport-f04bea4-3.14 branch from f2030ab to 3c430ec Compare September 26, 2025 15:15

picnixz commented Sep 26, 2025

Copy link
Copy Markdown
Member Author

I'll wait until gh-139366 is merged to ease future backports

picnixz marked this pull request as draft September 26, 2025 16:23

This comment was marked as resolved.

Sign in to view
Merge branch '3.14' into backport-f04bea4-3.14
ced3c5d
pythongh-90949: amend pythonGH-139234 in prevision of future mitigati…
b52fc88 
…on API (python#139366)

Fix some typos left in f04bea4,
and simplify some internal functions to ease maintenance of future
mitigation APIs.
picnixz marked this pull request as ready for review September 28, 2025 11:25

hartwork commented Sep 28, 2025

Copy link
Copy Markdown
Contributor

I'll wait until gh-139366 is merged to ease future backports

@picnixz if I'm not mistaken, it's both merged and cherry-picked to this PR (as the third commit) by now. What would be the next steps for this pull request?

picnixz commented Sep 28, 2025

Copy link
Copy Markdown
Member Author

A core developer needs to review it, and the release manager needs to approve it because we're in RC3 phase. I really want at least two core devs to check this PR to be sure I didn't mess the backports. I didn't backport the docs changes that will be added in the next one (the one for billion laughs).

picnixz requested a review from gpshead September 28, 2025 14:11

hartwork commented Sep 28, 2025

Copy link
Copy Markdown
Contributor

@picnixz so the plan is to first get review from Gregory and only then Hugo, I see 👍

picnixz commented Sep 28, 2025

Copy link
Copy Markdown
Member Author

I would be happy if you could also review it as you're an expert here as well :')

hartwork approved these changes Sep 28, 2025
View reviewed changes

hartwork left a comment •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

I would be happy if you could also review it as you're an expert here as well :')

@picnixz done, looks good 👍

My method of review has been comparing (1) the diff of #139234 against main with (2) the diff in here. What I found was no difference but:

  • Doc/whatsnew/3.15.rst on main side but not 3.14 (as expected)
  • @permit_long_* on main side but not 3.14 (as expected)

The tools I used for this were git rebase -i, git diff and Meld.

So if #139234 was alright (which I believe) then very likely this is, too 👍

picnixz commented Sep 28, 2025 •
edited
Loading

Copy link
Copy Markdown
Member Author

Thank you for the review. I'll let Gregory have a look and then Hugo can hit merge I think (only he can merge during RC phase).

For the other branches, I would suggest you continue your branch for 3.13 with the latest stuff (or try to directly cherry-pick this specific PR with a new one). I think we should be able to backport this PR to 3.13 directly without too many conflicts (I hope).

hartwork mentioned this pull request Sep 28, 2025
Merged

gpshead commented Sep 29, 2025

Copy link
Copy Markdown
Member

FWIW when to merge this is up to the release manager (hugovk). As we're treating it as a security mitigation feature similar to past such things and adding it to older releases as well, that suggests letting this wait for 3.14.1 is fine.

picnixz commented Sep 30, 2025

Copy link
Copy Markdown
Member Author

Note for the RM: we have a UAF in all branches, independently of Expat version: See #139400. So I would prefer that this one is not backported until we fix it. On 3.14 we don't see the crash, but on 3.13 (and probably on older branches), we will also see it. I believe we are able not to crash by chance due to some magic in incremental GC.

hartwork commented Sep 30, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note for the RM: we have a UAF in all branches, independently of Expat version: See #139400.

…and a WIP candidate fix at #139403.

On 3.14 we don't see the crash, but on 3.13 (and probably on older branches), we will also see it. I believe we are able not to crash by chance due to some magic in incremental GC.

@picnixz In my tests on another notebook I saw two other branches affected directly and once we add del parent_parser all branches are. I'm with you that changes in the garbage collector could take part in 3.14 and main behaving slightly differently.

picnixz commented Oct 7, 2025

Copy link
Copy Markdown
Member Author

We will merge this one in 3.14.1 (3.14 is now ongoing its release process). To have a good synchronization, we'll also delay 3.10 to 3.13 backports for their next release cycle.

picnixz self-assigned this Oct 7, 2025
This was referenced Oct 7, 2025
Merged
Merged
Merged

picnixz commented Oct 26, 2025

Copy link
Copy Markdown
Member Author

I'm going to work on merging the deadly allocation PR now. Sorry for the delay but I got very busy with my new work & IRL

picnixz commented Oct 26, 2025

Copy link
Copy Markdown
Member Author

Ok, so here's the plan:

@hartwork Can you check your existing PRs please? I think it'd be fine to actually merge the 3.10-3.14 ones and their backports as we have roughly 2 months until the next release.

hartwork commented Oct 26, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

I will keep those slight wording mistakes because it would complicate the backport

@picnixz yes please, a backport is not the place to fix up on the original as far as I am concerned.

@hartwork Can you check your existing PRs please?

I believe I got them all into mergable shape and they just need a re-trigger of CI — the read-the-docs one is flaky — to be green and ready. I am missing something? Anything in particular that you'd want me to check or re-check for?

I think it'd be fine to actually merge the 3.10-3.14 ones and their backports as we have roughly 2 months until the next release.

Cool!

hartwork commented Oct 26, 2025

Copy link
Copy Markdown
Contributor

I'm going to work on merging the deadly allocation PR now. Sorry for the delay but I got very busy with my new work & IRL

@picnixz thank you! 🙏

hartwork commented Oct 26, 2025

Copy link
Copy Markdown
Contributor

@hartwork Can you check your existing PRs please?

@picnixz they all end in commit "Drop workaround for 139400 as no-longer-needed" and their commits tell the same story. I'm happy to fix anything that needs fixing, but I believe they're all ready and have been.

picnixz commented Nov 2, 2025

Copy link
Copy Markdown
Member Author

Perfect, I'm going to merge them all and then we'll move on to adding the other API (with the docs amendments)

picnixz enabled auto-merge (squash) November 2, 2025 09:08
picnixz merged commit bf2865f into python:3.14 Nov 2, 2025
47 checks passed
picnixz deleted the backport-f04bea4-3.14 branch July 5, 2026 10:18
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

gpshead gpshead approved these changes
+1 more reviewer
hartwork hartwork approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

picnixz

Labels

topic-XML

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

Back | FazBrowse Home | New Git URL