Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Commit 366f315

Browse filesBrowse files
[3.8] gh-115133: Fix tests for XMLPullParser with Expat 2.6.0 (GH-115164) (GH-115536)
Feeding the parser by too small chunks defers parsing to prevent CVE-2023-52425. Future versions of Expat may be more reactive. (cherry picked from commit 4a08e7b) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
1 parent a21c0c7 commit 366f315
Copy full SHA for 366f315

File tree

2 files changed

+40
-22
lines changed
Filter options

2 files changed

+40
-22
lines changed

‎Lib/test/test_xml_etree.py

Copy file name to clipboardExpand all lines: Lib/test/test_xml_etree.py
+38-22Lines changed: 38 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
import operator
1515
import os
1616
import pickle
17+
import pyexpat
1718
import sys
1819
import textwrap
1920
import types
@@ -103,6 +104,12 @@
103104
<document>&entity;</document>
104105
"""
105106

107+
108+
fails_with_expat_2_6_0 = (unittest.expectedFailure
109+
if pyexpat.version_info >= (2, 6, 0) else
110+
lambda test: test)
111+
112+
106113
def checkwarnings(*filters, quiet=False):
107114
def decorator(test):
108115
def newtest(*args, **kwargs):
@@ -1266,28 +1273,37 @@ def assert_event_tags(self, parser, expected, max_events=None):
12661273
self.assertEqual([(action, elem.tag) for action, elem in events],
12671274
expected)
12681275

1269-
def test_simple_xml(self):
1270-
for chunk_size in (None, 1, 5):
1271-
with self.subTest(chunk_size=chunk_size):
1272-
parser = ET.XMLPullParser()
1273-
self.assert_event_tags(parser, [])
1274-
self._feed(parser, "<!-- comment -->\n", chunk_size)
1275-
self.assert_event_tags(parser, [])
1276-
self._feed(parser,
1277-
"<root>\n <element key='value'>text</element",
1278-
chunk_size)
1279-
self.assert_event_tags(parser, [])
1280-
self._feed(parser, ">\n", chunk_size)
1281-
self.assert_event_tags(parser, [('end', 'element')])
1282-
self._feed(parser, "<element>text</element>tail\n", chunk_size)
1283-
self._feed(parser, "<empty-element/>\n", chunk_size)
1284-
self.assert_event_tags(parser, [
1285-
('end', 'element'),
1286-
('end', 'empty-element'),
1287-
])
1288-
self._feed(parser, "</root>\n", chunk_size)
1289-
self.assert_event_tags(parser, [('end', 'root')])
1290-
self.assertIsNone(parser.close())
1276+
def test_simple_xml(self, chunk_size=None):
1277+
parser = ET.XMLPullParser()
1278+
self.assert_event_tags(parser, [])
1279+
self._feed(parser, "<!-- comment -->\n", chunk_size)
1280+
self.assert_event_tags(parser, [])
1281+
self._feed(parser,
1282+
"<root>\n <element key='value'>text</element",
1283+
chunk_size)
1284+
self.assert_event_tags(parser, [])
1285+
self._feed(parser, ">\n", chunk_size)
1286+
self.assert_event_tags(parser, [('end', 'element')])
1287+
self._feed(parser, "<element>text</element>tail\n", chunk_size)
1288+
self._feed(parser, "<empty-element/>\n", chunk_size)
1289+
self.assert_event_tags(parser, [
1290+
('end', 'element'),
1291+
('end', 'empty-element'),
1292+
])
1293+
self._feed(parser, "</root>\n", chunk_size)
1294+
self.assert_event_tags(parser, [('end', 'root')])
1295+
self.assertIsNone(parser.close())
1296+
1297+
@fails_with_expat_2_6_0
1298+
def test_simple_xml_chunk_1(self):
1299+
self.test_simple_xml(chunk_size=1)
1300+
1301+
@fails_with_expat_2_6_0
1302+
def test_simple_xml_chunk_5(self):
1303+
self.test_simple_xml(chunk_size=5)
1304+
1305+
def test_simple_xml_chunk_22(self):
1306+
self.test_simple_xml(chunk_size=22)
12911307

12921308
def test_feed_while_iterating(self):
12931309
parser = ET.XMLPullParser()
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Fix tests for :class:`~xml.etree.ElementTree.XMLPullParser` with Expat
2+
2.6.0.

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.