mirrors/cpython
0
0 Fork 0
mirror of https://github.com/python/cpython.git synced 2026-10-28 18:35:21 +08:00
Code Activity
134,018 Commits 6 Branches 685 Tags
main
Commit Graph
88 Commits
Author SHA1 Message Date
Stan UlbrychandPetr Viktorin 0071fb5111 gh-158876: Update bundled Expat to 2.9.0 (GH-158881) 
Co-authored-by: Petr Viktorin <encukou@gmail.com>
 2026-10-20 17:37:13 +00:00
Stan Ulbrych 5f1f21894f gh-157953: Update bundled Expat to 2.8.5 (#157957) 2026-09-23 14:46:18 +01:00
Stan Ulbrych 287b7cffb7 gh-156723: Update bundled libexpat to version 2.8.4 (#156724) 2026-08-31 19:16:07 +01:00
Stan Ulbrych 3d6a50598b gh-155558: Update bundled Expat to 2.8.3 (GH-155560) 2026-08-12 13:16:38 +02:00
Stan Ulbrych c22e9c9dae gh-152216: Update bundled expat to 2.8.2 (GH-152234) 
* Update bundled expat to 2.8.2
* `make regen-sbom`
* Update download URL
* Drop warnings (yay!)
 2026-07-10 11:40:12 -07:00
Stan Ulbrych f1a47e79fb gh-149698: Update bundled expat to 2.8.1 (GH-149699) 2026-05-14 01:21:03 +02:00
Stan Ulbrych 005555a3f0 gh-149017: Upgrade bundled Expat to 2.8.0 (#149020) 2026-04-27 21:22:35 +01:00
Stan Ulbrych e39d84a37d gh-146083: Upgrade bundled Expat to 2.7.5 (#146085) 2026-03-29 19:05:14 +02:00
Stan Ulbrych 51a408ed77 Add missing step to Modules/expat/refresh.sh instructions (GH-144719) 2026-02-12 09:55:26 +01:00
Stan UlbrychGregory P. SmithPetr Viktorin
 		d5cb9f6a9b gh-144363: Update bundled libexpat to 2.7.4 (#144365) 
* Update to 2.7.4

* update expat license copyright year to match and a pedantic #define

* include COPYING update in refresh.sh

* Update checksum for copying

---------

Co-authored-by: Gregory P. Smith <greg@krypto.org>
Co-authored-by: Petr Viktorin <encukou@gmail.com>
 2026-02-05 13:58:18 +01:00
Stan Ulbrych 48d0d0dd97 gh-139312: Update bundled libexpat to 2.7.3 (GH-139319) 
+ Blurb
+ Update sbom.spdx.json
 2025-09-26 19:44:36 -07:00
Bénédikt Tran f04bea44c3 gh-90949: add Expat API to prevent XML deadly allocations (CVE-2025-59375) (#139234) 
Expose the XML Expat 2.7.2 mitigation APIs to disallow use of
disproportional amounts of dynamic memory from within an Expat
parser (see CVE-2025-59375 for instance).

The exposed APIs are available on Expat parsers, that is,
parsers created by `xml.parsers.expat.ParserCreate()`, as:

- `parser.SetAllocTrackerActivationThreshold(threshold)`, and
- `parser.SetAllocTrackerMaximumAmplification(max_factor)`.
 2025-09-26 14:13:56 +00:00
Stan Ulbrych 70ad1b30df gh-138998: expat/refresh.sh: Fail if Step 3 is not completed (GH-139049) 2025-09-18 12:47:42 +02:00
Stan Ulbrych 64c876dd68 gh-138998: Upgrade vendored expat to 2.7.2 (#138999) 2025-09-17 13:46:35 +03:00
Gregory P. Smith c0de650024 gh-131809: Upgrade vendored expat to 2.7.1 (#132192) 2025-04-07 23:42:00 +03:00
Petr Viktorin 51d309988b gh-131261: expat/refresh.sh: Expand list of manual steps (GH-131359) 2025-03-18 13:17:43 +01:00
Gregory P. Smith bb0268f60d gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (#131272) 2025-03-17 14:55:02 +01:00
Seth Michael Larson 3c99969094 gh-126623: Update libexpat to 2.6.4, make future updates easier (GH-126792) 
Update libexpat to 2.6.4, make future updates easier.
 2024-11-13 18:31:20 +00:00
Seth Michael Larson 40bdb0deee gh-123678: Upgrade libexpat 2.6.3 (#123689) 
Upgrade libexpat 2.6.3
 2024-09-04 12:57:16 -07:00
Seth Michael Larson c9829eec08 gh-116741: Upgrade libexpat to 2.6.2 (#117296) 
Upgrade libexpat to 2.6.2
 2024-04-22 18:15:08 -07:00
Sebastian Pipping 6a95676bb5 gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) 
Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods:

- `xml.etree.ElementTree.XMLParser.flush`
- `xml.etree.ElementTree.XMLPullParser.flush`
- `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled`
- `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled`
- `xml.sax.expatreader.ExpatParser.flush`

Based on the "flush" idea from https://github.com/python/cpython/pull/115138#issuecomment-1932444270 .

### Notes

- Please treat as a security fix related to CVE-2023-52425.

Includes code suggested-by: Snild Dolkow <snild@sony.com>
and by core dev Serhiy Storchaka.
 2024-02-29 14:52:50 -08:00
Seth Michael Larson 4b2d1786cc gh-115399: Upgrade bundled libexpat to 2.6.0 (#115431) 2024-02-14 16:29:06 +00:00
Shaun WalbridgeandShaun Walbridge 3e07f827b3 gh-98739: Update libexpat from 2.4.9 to 2.5.0 (#98742) 
* Update libexpat from 2.4.9 to 2.5.0 to address CVE-2022-43680.

Co-authored-by: Shaun Walbridge <shaun.walbridge@gmail.com>
 2022-10-27 13:45:12 -07:00
Dong-hee NaandGregory P. Smith [Google] 10e3d398c3 gh-97005: Update libexpat from 2.4.7 to 2.4.9 (gh-97006) 
Co-authored-by: Gregory P. Smith [Google] <greg@krypto.org>
 2022-09-22 21:25:05 +09:00
Steve Dower 176835c3d5 bpo-46932: Update bundled libexpat to 2.4.7 (GH-31736) 2022-03-07 21:46:18 +00:00
Dong-hee Na 1935e1cc28 bpo-46794: Bump up the libexpat version into 2.4.6 (GH-31487) 2022-02-23 10:40:30 +09:00
Yilei "Dolee" Yang 6312c1052c bpo-46784: Add newly exported expat symbols to the namespace. (GH-31397) 
The libexpat 2.4.1 upgrade from  introduced the following new exported symbols:

* `testingAccountingGetCountBytesDirect`
* `testingAccountingGetCountBytesIndirect`
* `unsignedCharToPrintable`
* `XML_SetBillionLaughsAttackProtectionActivationThreshold`
* `XML_SetBillionLaughsAttackProtectionMaximumAmplification`

We need to adjust [Modules/expat/pyexpatns.h](https://github.com/python/cpython/blob/master/Modules/expat/pyexpatns.h)

(The newer libexpat upgrade  has no new symbols).

Automerge-Triggered-By: GH:gpshead
 2022-02-18 14:33:06 -08:00
Cyril Jouve 8aaaf7e182 bpo-46400: Update libexpat from 2.4.1 to 2.4.4 (GH-31022) 2022-02-13 00:29:41 +09:00
Christian Heimes ec93721e00 bpo-45570: Simplify setup macros for pyexpat (GH-29159) 
* ``HAVE_EXPAT_CONFIG_H`` is not used by our code and not used by
  system-wide expat header files
* ``USE_PYEXPAT_CAPI`` is no longer used by our code
* ``XML_POOR_ENTROPY`` should be defined in expat_config.h

Signed-off-by: Christian Heimes <christian@python.org>
 2021-10-22 09:28:23 -07:00
Dong-hee Na d413c50363 no-issue: Make silence about warning '_POSIX_C_SOURCE redefined' (GH-28948) 2021-10-15 00:59:56 +09:00
Christian Clauss dd02a696e5 Fix typos in the Modules directory (GH-28761) 2021-10-07 01:34:42 -07:00
Victor StinnerandŁukasz Langa 3fc5d84046 bpo-44394: Update libexpat copy to 2.4.1 (GH-26945) 
Update the vendored copy of libexpat to 2.4.1 (from 2.2.8) to get the
fix for the CVE-2013-0340 "Billion Laughs" vulnerability. This copy
is most used on Windows and macOS.

Co-authored-by: Łukasz Langa <lukasz@langa.pl>
 2021-08-29 16:08:24 +02:00
Pablo Galindo be93f81e58 Fix compiler warning in the xml module (GH-26245) 
The newest version of gcc complains about passing un-initialized arrays
as constant pointers:

```
/Modules/expat/xmltok_ns.c: In function ‘findEncodingNS’:
/Modules/expat/xmltok.h:272:10: warning: ‘buf’ may be used uninitialized [-Wmaybe-uninitialized]
  272 |   (((enc)->utf8Convert)(enc, fromP, fromLim, toP, toLim))
      |   ~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/Modules/expat/xmltok_ns.c:95:3: note: in expansion of macro ‘XmlUtf8Convert’
   95 |   XmlUtf8Convert(enc, &ptr, end, &p, p + ENCODING_MAX - 1);
      |   ^~~~~~~~~~~~~~
/Modules/expat/xmltok.h:272:10: note: by argument 5 of type ‘const char *’ to ‘enum XML_Convert_Result(const ENCODING *, const char **, const char *, char **, const char *)’ {aka ‘enum XML_Convert_Result(const struct encoding *, const char **, const char *, char **, const char *)’}
  272 |   (((enc)->utf8Convert)(enc, fromP, fromLim, toP, toLim))
      |   ~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/Modules/expat/xmltok_ns.c:95:3: note: in expansion of macro ‘XmlUtf8Convert’
   95 |   XmlUtf8Convert(enc, &ptr, end, &p, p + ENCODING_MAX - 1);
      |   ^~~~~~~~~~~~~~
In file included from /Modules/expat/xmltok.c:1657:
/Modules/expat/xmltok_ns.c:92:8: note: ‘buf’ declared here
   92 |   char buf[ENCODING_MAX];

```
 2021-05-19 19:05:40 +01:00
Pablo Galindo 8177404d52 bpo-37731: Reorder includes in xmltok.c to avoid redefinition of _POSIX_C_SOURCE (GH-16733) 2019-10-12 20:14:11 +01:00
Benjamin Peterson 52b9408038 closes bpo-38174: Update vendored expat library to 2.2.8. (GH-16346) 
Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes.
 2019-09-25 21:33:58 -07:00
Min ho Kim 39d87b5471 Fix typos mostly in comments, docs and test names (GH-15209) 2019-08-30 16:21:19 -04:00
Min ho KimandTerry Jan Reedy c4cacc8c5e Fix typos in comments, docs and test names (#15018) 
* Fix typos in comments, docs and test names

* Update test_pyparse.py

account for change in string length

* Apply suggestion: splitable -> splittable

Co-Authored-By: Terry Jan Reedy <tjreedy@udel.edu>

* Apply suggestion: splitable -> splittable

Co-Authored-By: Terry Jan Reedy <tjreedy@udel.edu>

* Apply suggestion: Dealloccte -> Deallocate

Co-Authored-By: Terry Jan Reedy <tjreedy@udel.edu>

* Update posixmodule checksum.

* Reverse idlelib changes.
 2019-07-30 18:16:13 -04:00
Benjamin Peterson 2cd07920bb Put pyexpatns.h include back. bpo-37437 (GH-14539) 2019-07-01 22:07:44 -07:00
Benjamin Peterson 3b03b09fc9 closes bpo-37437: Update vendorized expat to 2.2.7. (GH-14436) 2019-06-27 20:54:44 -07:00
Victor Stinner b6ef6f69a9 bpo-31374: expat doesn't include <pyconfig.h> on Windows (GH-11079) 2018-12-10 16:06:18 +01:00
Victor Stinner cf247359d5 bpo-31374: Include pyconfig.h earlier in expat (GH-11064) 
Include <pyconfig.h> ealier in Modules/expat/xmltok.c to define
properly _POSIX_C_SOURCE. Python defines _POSIX_C_SOURCE as 200809L,
whereas <features.h> (included indirectly by <string.h>) defines
_POSIX_C_SOURCE as 199506L.
 2018-12-10 11:30:21 +01:00
Gregory P. Smith 9d4712bc8f bpo-35011: Restore use of pyexpatns.h in libexpat (GH-9939) 
Restores the use of pyexpatns.h to isolate our embedded copy of the expat C
library so that its symbols do not conflict at link or dynamic loading time
with an embedding application or other extension modules with their own
version of libexpat.

https://github.com/python/cpython/commit/5dc3f23b5fb0b510926012cb3732dae63cddea60#diff-3afaf7274c90ce1b7405f75ad825f545 inadvertently removed it when upgrading expat.
 2018-10-17 18:10:46 -07:00
Benjamin Peterson 5033aa77aa bpo-34625: Update vendorized expat version to 2.2.6. (GH-9150) 2018-09-10 21:04:00 -07:00
Benjamin Peterson 4e21100fa7 bpo-33956: update vendored expat to 2.2.5 (GH-7925) 2018-06-26 19:25:45 -07:00
luzpaz a5293b4ff2 Fix miscellaneous typos (#4275) 2017-11-05 15:37:50 +02:00
Benjamin Peterson b1d1c422cc remove configure check for memmove (#3716) 
Python requires C implementations provide memmove, so we shouldn't need to check for it. The only place using this configure check was expat, where we can simply always define HAVE_MEMMOVE.
 2017-09-24 12:08:40 -07:00
Serhiy Storchaka 13ad3b7a82 bpo-31462: Remove trailing whitespaces. (#3564) 2017-09-14 09:38:36 +03:00
Victor Stinner 759e30ec47 bpo-31170: Update libexpat from 2.2.3 to 2.2.4 (#3315) 
* bpo-31170: Update libexpat from 2.2.3 to 2.2.4

Fix copying of partial characters for UTF-8 input (libexpat bug 115):
https://github.com/libexpat/libexpat/issues/115

* Add NEWS entry.
 2017-09-05 01:58:08 +02:00
Victor Stinner 93d0cb58b4 bpo-30947: Update libexpat from 2.2.1 to 2.2.3 (#3106) 
* bpo-30947: Update libexpat from 2.2.1 to 2.2.3

* Add NEWS entry

* Add new loadlibrary.c

* expat_external.h: restore include "pyexpatns.h"

* PCbuild: add expat/loadlibrary.c

* Define XML_POOR_ENTROPY to compile expat
 2017-08-18 23:43:54 +02:00
Segev Finer f52325598e Avoid _GNU_SOURCE redefined warning in xmlparse.c (#2670) 2017-07-11 21:47:03 +02:00