Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Commit dafb4f0

Browse filesBrowse files
[3.9] Fix tests for XMLPullParser with Expat 2.6.0 (GH-115133) (GH-115535)
Feeding the parser by too small chunks defers parsing to prevent CVE-2023-52425. Future versions of Expat may be more reactive. (cherry picked from commit 4a08e7b) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
1 parent c23f749 commit dafb4f0
Copy full SHA for dafb4f0

File tree

2 files changed

+40
-22
lines changed
Filter options

2 files changed

+40
-22
lines changed

‎Lib/test/test_xml_etree.py

Copy file name to clipboardExpand all lines: Lib/test/test_xml_etree.py
+38-22Lines changed: 38 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
import operator
1414
import os
1515
import pickle
16+
import pyexpat
1617
import sys
1718
import textwrap
1819
import types
@@ -102,6 +103,12 @@
102103
<document>&entity;</document>
103104
"""
104105

106+
107+
fails_with_expat_2_6_0 = (unittest.expectedFailure
108+
if pyexpat.version_info >= (2, 6, 0) else
109+
lambda test: test)
110+
111+
105112
def checkwarnings(*filters, quiet=False):
106113
def decorator(test):
107114
def newtest(*args, **kwargs):
@@ -1391,28 +1398,37 @@ def assert_event_tags(self, parser, expected, max_events=None):
13911398
self.assertEqual([(action, elem.tag) for action, elem in events],
13921399
expected)
13931400

1394-
def test_simple_xml(self):
1395-
for chunk_size in (None, 1, 5):
1396-
with self.subTest(chunk_size=chunk_size):
1397-
parser = ET.XMLPullParser()
1398-
self.assert_event_tags(parser, [])
1399-
self._feed(parser, "<!-- comment -->\n", chunk_size)
1400-
self.assert_event_tags(parser, [])
1401-
self._feed(parser,
1402-
"<root>\n <element key='value'>text</element",
1403-
chunk_size)
1404-
self.assert_event_tags(parser, [])
1405-
self._feed(parser, ">\n", chunk_size)
1406-
self.assert_event_tags(parser, [('end', 'element')])
1407-
self._feed(parser, "<element>text</element>tail\n", chunk_size)
1408-
self._feed(parser, "<empty-element/>\n", chunk_size)
1409-
self.assert_event_tags(parser, [
1410-
('end', 'element'),
1411-
('end', 'empty-element'),
1412-
])
1413-
self._feed(parser, "</root>\n", chunk_size)
1414-
self.assert_event_tags(parser, [('end', 'root')])
1415-
self.assertIsNone(parser.close())
1401+
def test_simple_xml(self, chunk_size=None):
1402+
parser = ET.XMLPullParser()
1403+
self.assert_event_tags(parser, [])
1404+
self._feed(parser, "<!-- comment -->\n", chunk_size)
1405+
self.assert_event_tags(parser, [])
1406+
self._feed(parser,
1407+
"<root>\n <element key='value'>text</element",
1408+
chunk_size)
1409+
self.assert_event_tags(parser, [])
1410+
self._feed(parser, ">\n", chunk_size)
1411+
self.assert_event_tags(parser, [('end', 'element')])
1412+
self._feed(parser, "<element>text</element>tail\n", chunk_size)
1413+
self._feed(parser, "<empty-element/>\n", chunk_size)
1414+
self.assert_event_tags(parser, [
1415+
('end', 'element'),
1416+
('end', 'empty-element'),
1417+
])
1418+
self._feed(parser, "</root>\n", chunk_size)
1419+
self.assert_event_tags(parser, [('end', 'root')])
1420+
self.assertIsNone(parser.close())
1421+
1422+
@fails_with_expat_2_6_0
1423+
def test_simple_xml_chunk_1(self):
1424+
self.test_simple_xml(chunk_size=1)
1425+
1426+
@fails_with_expat_2_6_0
1427+
def test_simple_xml_chunk_5(self):
1428+
self.test_simple_xml(chunk_size=5)
1429+
1430+
def test_simple_xml_chunk_22(self):
1431+
self.test_simple_xml(chunk_size=22)
14161432

14171433
def test_feed_while_iterating(self):
14181434
parser = ET.XMLPullParser()
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Fix tests for :class:`~xml.etree.ElementTree.XMLPullParser` with Expat
2+
2.6.0.

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.