gh-90949: expose Expat API to tune exponential expansion protections by picnixz · Pull Request #139368 · python/cpython · GitHub

This is built on top of #139366.

Issue: Expose Expat XML attack protection APIs #90949

📚 Documentation preview 📚: https://cpython-previews--139368.org.readthedocs.build/

@picnixz already in pretty good shape 👍

I've updated the PR from the web UI but I'll do the rest tomorrow.

@picnixz I like this new version! 👍

One question: There were changes in here to the previous related news file. This is what it reads on main today:

# cat Misc/NEWS.d/next/Library/2025-09-22-14-40-11.gh-issue-90949.UM35nb.rst
Add :meth:`~xml.parsers.expat.xmlparser.SetAllocTrackerActivationThreshold`
and :meth:`~xml.parsers.expat.xmlparser.SetAllocTrackerMaximumAmplification`
to :ref:`xmlparser <xmlparser-objects>` objects to prevent use of
disproportional amounts of dynamic memory from within an Expat parser.
Patch by Bénédikt Tran.

From what we discussed here, this should probably says things about tuning also?
Should you or me create a follow-up pull request to adjust that after this?

I'll amend the NEWS as part of this PR.

Since this is built on top of many other PRs, I'll just wait for the others to be backported first.

Thanks @picnixz for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10.
🐍🍒⛏🤖

Thanks @picnixz for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

Thanks @picnixz for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖

Thanks @picnixz for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

Thanks @picnixz for the PR 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

Sorry, @picnixz, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 666112376d574c7802646ee1df6244062671cd61 3.10

Sorry, @picnixz, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 666112376d574c7802646ee1df6244062671cd61 3.11

Sorry, @picnixz, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 666112376d574c7802646ee1df6244062671cd61 3.12

Sorry, @picnixz, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 666112376d574c7802646ee1df6244062671cd61 3.13

Sorry, @picnixz, I could not cleanly backport this to 3.14 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 666112376d574c7802646ee1df6244062671cd61 3.14

@StanFromIreland I see that the backports here totally failed and then it passed under my radar. Could you backport this PR (and any other PRs that need to be backported with it, including docs changes) to 3.14 so that you're no more blocked? I'm sorry to dump my work on you but I won't be available otherwise for that today :(

It's fine, I've put it on my list, I'll get to it soon-ish.

I'm not quite sure how to go about backporting this, I think we'll need to remove it from here?

Yeah, you can drop this part in older branches but we still want the versionadded:: next in the docs directly. What's New can be omitted. You can add the explicit Python version when it was added though (3.14.x) and not just 3.14 (don't know if :: next handles it...)

… protections (pythonGH-139368) Expose the XML Expat 2.7.2 APIs to tune protections against "billion laughs" [1] attacks. The exposed APIs are available on Expat parsers, that is, parsers created by `xml.parsers.expat.ParserCreate()`, as: - `parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold)`, and - `parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor)`. This completes the work in f04bea4, and improves the existing related documentation. [1]: https://en.wikipedia.org/wiki/Billion_laughs_attack (cherry picked from commit 6661123) Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

GH-150496 is a backport of this pull request to the 3.14 branch.

…ctions (GH-139368) (#150496) Expose the XML Expat 2.7.2 APIs to tune protections against "billion laughs" [1] attacks. The exposed APIs are available on Expat parsers, that is, parsers created by `xml.parsers.expat.ParserCreate()`, as: - `parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold)`, and - `parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor)`. This completes the work in f04bea4, and improves the existing related documentation. [1]: https://en.wikipedia.org/wiki/Billion_laughs_attack (cherry picked from commit 6661123) Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

GH-151151 is a backport of this pull request to the 3.13 branch.

…ctions (GH-139368) Expose the XML Expat 2.7.2 APIs to tune protections against "billion laughs" [1] attacks. The exposed APIs are available on Expat parsers, that is, parsers created by `xml.parsers.expat.ParserCreate()`, as: - `parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold)`, and - `parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor)`. This completes the work in f04bea4, and improves the existing related documentation. [1]: https://en.wikipedia.org/wiki/Billion_laughs_attack (cherry picked from commit 6661123) Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

GH-151401 is a backport of this pull request to the 3.12 branch.

…ctions (GH-139368) (#151401) Expose the XML Expat 2.7.2 APIs to tune protections against "billion laughs" [1] attacks. The exposed APIs are available on Expat parsers, that is, parsers created by `xml.parsers.expat.ParserCreate()`, as: - `parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold)`, and - `parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor)`. This completes the work in f04bea4, and improves the existing related documentation. [1]: https://en.wikipedia.org/wiki/Billion_laughs_attack (cherry picked from commit 6661123) (cherry picked from commit 19bc391) Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

…ctions (GH-139368) (GH-151401) (#155346) * [3.11] gh-90949: expose Expat API to tune exponential expansion protections (GH-139368) (GH-151401) Expose the XML Expat 2.7.2 APIs to tune protections against "billion laughs" [1] attacks. The exposed APIs are available on Expat parsers, that is, parsers created by `xml.parsers.expat.ParserCreate()`, as: - `parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold)`, and - `parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor)`. This completes the work in f04bea4, and improves the existing related documentation. [1]: https://en.wikipedia.org/wiki/Billion_laughs_attack (cherry picked from commit 6661123) (cherry picked from commit 19bc391) (cherry picked from commit db195e3) Co-authored-by: Stan Ulbrych <stan@python.org> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com> * Fix capi member access --------- Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

…ctions (GH-139368) (#151401) (#155414) Expose the XML Expat 2.7.2 APIs to tune protections against "billion laughs" [1] attacks. The exposed APIs are available on Expat parsers, that is, parsers created by `xml.parsers.expat.ParserCreate()`, as: - `parser.SetBillionLaughsAttackProtectionActivationThreshold(threshold)`, and - `parser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor)`. This completes the work in f04bea4, and improves the existing related documentation. [1]: https://en.wikipedia.org/wiki/Billion_laughs_attack (cherry picked from commit 6661123) (cherry picked from commit 19bc391) (cherry picked from commit db195e3) Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com> Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

expose Expat mitigation API to prevent exponential expansions

bba2678

picnixz requested a review from AA-Turner as a code owner September 26, 2025 16:38

bedevere-app Bot added the awaiting core review label Sep 26, 2025

bedevere-app Bot mentioned this pull request Sep 26, 2025

Expose Expat XML attack protection APIs #90949

Closed

hartwork suggested changes Sep 26, 2025

View reviewed changes

Comment thread Misc/NEWS.d/next/Library/2025-09-26-18-04-28.gh-issue-90949.YHjSzX.rst Outdated

picnixz added 3 commits September 26, 2025 20:22

Merge branch 'main' into feat/xml/1e9-lolz-api-90949

363bcbc

Update pyexpat.c

501ef0e

Update pyexpat.c

197dfa7

picnixz commented Sep 26, 2025

View reviewed changes

gpshead reviewed Sep 27, 2025

View reviewed changes

Comment thread Doc/library/pyexpat.rst

Comment thread Doc/library/pyexpat.rst Outdated

Comment thread Doc/library/pyexpat.rst Outdated

address reviews

9734458

picnixz requested review from gpshead and hartwork September 27, 2025 08:19

picnixz changed the title gh-90949: expose Expat mitigation API to prevent exponential expansions gh-90949: expose Expat API to prevent exponential expansions Sep 27, 2025

clinic and comments

6c2eab7

hartwork approved these changes Sep 27, 2025

View reviewed changes

gpshead approved these changes Sep 27, 2025

View reviewed changes

bedevere-app Bot added awaiting merge and removed awaiting core review labels Sep 27, 2025

update NEWS

3ec2ebd

picnixz enabled auto-merge (squash) September 28, 2025 07:58

picnixz changed the title gh-90949: expose Expat API to prevent exponential expansions gh-90949: expose Expat API to tune exponential expansion protections Sep 28, 2025

picnixz merged commit 6661123 into python:main Sep 28, 2025
45 checks passed

bedevere-app Bot removed the awaiting merge label Sep 28, 2025

picnixz deleted the feat/xml/1e9-lolz-api-90949 branch September 28, 2025 08:37

This was referenced Oct 4, 2025

gh-90949: Fix an "unused function" compiler warning introduced in GH-139234 #139558

Merged

gh-139400: Make sure that parent parsers outlive their subparsers in pyexpat #139403

Merged

picnixz mentioned this pull request Oct 26, 2025

[3.14] gh-90949: add Expat API to prevent XML deadly allocations (CVE-2025-59375) (GH-139234) #139359

Merged

StanFromIreland added the needs backport to 3.14 bugs and security fixes label May 24, 2026

miss-islington-app Bot assigned picnixz May 24, 2026

StanFromIreland reviewed May 25, 2026

View reviewed changes

bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label May 26, 2026

coderabbitai Bot mentioned this pull request Jun 3, 2026

feat: add docx redline script with style tracking arthrod/html-to-docx2#470

Merged

StanFromIreland removed the needs backport to 3.13 bugs and security fixes label Jun 9, 2026

bedevere-app Bot removed the needs backport to 3.12 only security fixes label Jun 12, 2026

StanFromIreland removed needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes labels Aug 9, 2026

+                disproportional amounts of dynamic memory usage from within an Expat parser.
                 (Contributed by Bénédikt Tran in :gh:`90949`.)
+              * Add :meth:`~xml.parsers.expat.xmlparser.SetBillionLaughsAttackProtectionActivationThreshold`

gh-90949: expose Expat API to tune exponential expansion protections by picnixz · Pull Request #139368 · python/cpython · GitHub

Uh oh!

Uh oh!

gh-90949: expose Expat API to tune exponential expansion protections - #139368

gh-90949: expose Expat API to tune exponential expansion protections#139368picnixz merged 7 commits intopython:mainpython/cpython:mainfrom picnixz:feat/xml/1e9-lolz-api-90949picnixz/cpython:feat/xml/1e9-lolz-api-90949Copy head branch name to clipboard

Conversation

picnixz commented Sep 26, 2025 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hartwork left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

picnixz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hartwork left a comment

Choose a reason for hiding this comment

Uh oh!

picnixz commented Sep 27, 2025

Uh oh!

Uh oh!

picnixz commented Sep 28, 2025

Uh oh!

miss-islington-app Bot commented May 24, 2026

Uh oh!

miss-islington-app Bot commented May 24, 2026

Uh oh!

miss-islington-app Bot commented May 24, 2026

Uh oh!

miss-islington-app Bot commented May 24, 2026

Uh oh!

miss-islington-app Bot commented May 24, 2026

Uh oh!

miss-islington-app Bot commented May 24, 2026

Uh oh!

miss-islington-app Bot commented May 24, 2026

Uh oh!

miss-islington-app Bot commented May 24, 2026

Uh oh!

miss-islington-app Bot commented May 24, 2026

Uh oh!

miss-islington-app Bot commented May 24, 2026

Uh oh!

picnixz commented May 24, 2026

Uh oh!

StanFromIreland commented May 24, 2026

Uh oh!

StanFromIreland May 25, 2026

Choose a reason for hiding this comment

Uh oh!

picnixz May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bedevere-app Bot commented May 26, 2026

Uh oh!

bedevere-app Bot commented Jun 9, 2026

Uh oh!

bedevere-app Bot commented Jun 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

gh-90949: expose Expat API to tune exponential expansion protections#139368
picnixz merged 7 commits into
python:mainfrom
picnixz:feat/xml/1e9-lolz-api-90949

picnixz commented Sep 26, 2025 •
edited by github-actions Bot
Loading

picnixz May 25, 2026 •
edited
Loading