gh-139313: Improve docs on XML security by hartwork · Pull Request #139460 · python/cpython

hartwork · 2025-09-30T19:00:37Z

Issue: Update the XML security documentation #139313

📚 Documentation preview 📚: https://cpython-previews--139460.org.readthedocs.build/

Clarify that: - it takes parsing for an attack - that some doors are closed by default - only version 2.7.2 has all the fixes - use of the bundle depends on configuration

hartwork · 2025-10-04T15:24:48Z

@vstinner I saw your related work in commit cb99d99. Would you be up for review here?

hartwork · 2025-10-13T16:52:21Z

@picnixz I was hoping for this PR to be a quick and uncontroversial win for everyone. Would you be up to get this over the finish line with me? Else could you connect me to someone up for it? I believe @hedsnz uncovered some actual issues in #139313 that are worth addressing.

The keys ideas in this pull request are:

warn about ExternalEntityRefHandler right where users will be looking
try to make clear that XML issues are not a problem of Python in particular
that the defaults are pretty good by now
that >=2.6.0 is no longer recent enough but >=2.7.2
that use of system Expat depends on configuration while resisting to copy details but refer to another page
link to upstream Expat for users unknown to Expat

What do you think?

@vstinner

General idea by @vstinner

hedsnz

Thanks very much @hartwork, this PR addresses everything in the issue I originally raised, and I think it strikes a good balance between giving enough background so that people know where to start looking for further information, while not giving so much information that is better documented elsewhere.

I've offered a couple of very minor wording suggestions.

@hedsnz

Ideas by @hedsnz

@hedsnz

Original idea by @hedsnz with adjustments

@vstinner

As suggested by @vstinner

hartwork · 2025-10-20T13:25:03Z

Thanks very much @hartwork, this PR addresses everything in the issue I originally raised, and I think it strikes a good balance between giving enough background so that people know where to start looking for further information, while not giving so much information that is better documented elsewhere.

@hedsnz cool, thanks for your support!

I've offered a couple of very minor wording suggestions.

Thanks for the review!

hartwork · 2025-10-24T13:29:56Z

@vstinner could this be merged please please?

StanFromIreland · 2025-10-24T13:31:27Z

Note that the general guideline around here is to wait a month before pinging, there is a long queue of PRs (>2000!).

hartwork · 2025-10-24T13:43:55Z

@StanFromIreland I understand that the project has many other pull request but I'll be honest with you, I only jumped in to help with this PR here (that was not my own pain point) because I felt like it could be a quick win, and this pull request is way too trivial and tiny to have a life of 3 weeks in my book. It only means that I will twice to be the guy providing doc fixes like this next time. I'm not sure that's intended. I'm happy to team up with you personally on other pull request review in CPython as feasible if that helps you move faster on the queue. Thanks for considering my side.

vstinner · 2025-10-28T17:52:02Z

@vstinner could this be merged please please?

I don't know XML very well. Maybe @encukou or @serhiy-storchaka would like to review it.

The previous version was apparantly not clear enough.

hartwork · 2025-10-29T15:48:46Z

I don't know XML very well. Maybe @encukou or @serhiy-storchaka would like to review it.

@vstinner thanks!

(I was asking you because of your commit cb99d99 on Doc/library/xml.rst.)

serhiy-storchaka

LGTM. 👍

vstinner

LGTM. Should we backport this change to 3.13 and 3.14?

hartwork · 2025-10-29T19:24:16Z

LGTM.

@vstinner thank you!

Should we backport this change to 3.13 and 3.14?

I have a feeling the question is probably more towards other Python core devs. If you decide for it and @bedevere-bot has trouble auto-cherry-picking, I'll be happy to help with a manual backbort.

serhiy-storchaka · 2025-10-29T19:57:44Z

If it is worth to be committed in main, it should be backported.

hartwork · 2025-11-05T11:38:51Z

Ready to merge?

miss-islington-app · 2025-11-05T19:00:02Z

Thanks @hartwork for the PR, and @serhiy-storchaka for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

Clarify that: - it takes parsing for an attack - that some doors are closed by default - only Expat version 2.7.2 has all the fixes - use of the bundle depends on configuration (cherry picked from commit baa9f33) Co-authored-by: Sebastian Pipping <sebastian@pipping.org>

bedevere-app · 2025-11-05T19:00:11Z

GH-141065 is a backport of this pull request to the 3.14 branch.

Clarify that: - it takes parsing for an attack - that some doors are closed by default - only Expat version 2.7.2 has all the fixes - use of the bundle depends on configuration (cherry picked from commit baa9f33) Co-authored-by: Sebastian Pipping <sebastian@pipping.org>

bedevere-app · 2025-11-05T19:00:16Z

GH-141066 is a backport of this pull request to the 3.13 branch.

Clarify that: - it takes parsing for an attack - that some doors are closed by default - only Expat version 2.7.2 has all the fixes - use of the bundle depends on configuration (cherry picked from commit baa9f33) Co-authored-by: Sebastian Pipping <sebastian@pipping.org>

hartwork · 2025-11-05T22:16:43Z

@serhiy-storchaka thank you! 🙏

serhiy-storchaka · 2025-11-06T09:30:26Z

Thank you for your contribution.

Clarify that: - it takes parsing for an attack - that some doors are closed by default - only Expat version 2.7.2 has all the fixes - use of the bundle depends on configuration

hartwork added 3 commits September 30, 2025 20:53

Doc/library/xml.rst: Improve section on XML security

7c336ac

Clarify that: - it takes parsing for an attack - that some doors are closed by default - only version 2.7.2 has all the fixes - use of the bundle depends on configuration

Doc/library/pyexpat.rst: Document risk of ExternalEntityRefHandler

adb0de6

Add news item

fb47ad6

bedevere-app Bot added awaiting review docs Documentation in the Doc dir labels Sep 30, 2025

github-project-automation Bot added this to Docs PRs Sep 30, 2025

bedevere-app Bot mentioned this pull request Sep 30, 2025

Update the XML security documentation #139313

Closed

github-project-automation Bot moved this to Todo in Docs PRs Sep 30, 2025

hartwork added 2 commits September 30, 2025 21:04

Fix news item syntax

d89f991

Drop troublesome HTML anchor from news item

10b2988

hartwork mentioned this pull request Oct 8, 2025

Expose Expat XML attack protection APIs #90949

Open

picnixz self-requested a review October 13, 2025 17:53

vstinner reviewed Oct 14, 2025

View reviewed changes

Comment thread Doc/library/xml.rst Outdated

Comment thread Misc/NEWS.d/next/Documentation/2025-09-30-20-57-26.gh-issue-139313.ibcC9q.rst Outdated

Try to point to configure argument --with-system-expat directly

c8d9afb

General idea by @vstinner

hartwork requested a review from vstinner October 14, 2025 13:29

hedsnz reviewed Oct 20, 2025

View reviewed changes

Comment thread Doc/library/xml.rst Outdated

Comment thread Doc/library/xml.rst Outdated

Comment thread Doc/library/xml.rst Outdated

hartwork added 3 commits October 20, 2025 15:07

Improve language

5d935bd

Ideas by @hedsnz

Use more active language

31523ec

Original idea by @hedsnz with adjustments

Drop news entry

fb5234e

As suggested by @vstinner

vstinner added the skip news label Oct 20, 2025

serhiy-storchaka reviewed Oct 28, 2025

View reviewed changes

Comment thread Doc/library/pyexpat.rst Outdated

Re-write warning about xmlparser.ExternalEntityRefHandler

3dc3baf

The previous version was apparantly not clear enough.

hartwork requested a review from serhiy-storchaka October 29, 2025 15:49

Fix RST syntax

e9e1e62

serhiy-storchaka approved these changes Oct 29, 2025

View reviewed changes

Comment thread Doc/library/pyexpat.rst Outdated

bedevere-app Bot added awaiting merge and removed awaiting review labels Oct 29, 2025

hartwork added 2 commits October 29, 2025 18:27

Drop a sentence of arguable value

98da91a

Fix typo

5fe73a1

vstinner reviewed Oct 29, 2025

View reviewed changes

Comment thread Doc/library/pyexpat.rst

Comment thread Doc/library/xml.rst

vstinner approved these changes Oct 29, 2025

View reviewed changes

serhiy-storchaka added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Oct 29, 2025

hartwork mentioned this pull request Nov 2, 2025

gh-54873: Add support for namespaces prefixes to xml.sax.expatreader #118317

Open

serhiy-storchaka merged commit baa9f33 into python:main Nov 5, 2025
32 checks passed

github-project-automation Bot moved this from Todo to Done in Docs PRs Nov 5, 2025

bedevere-app Bot removed the awaiting merge label Nov 5, 2025

bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Nov 5, 2025

bedevere-app Bot removed the needs backport to 3.13 bugs and security fixes label Nov 5, 2025

Uh oh!

Uh oh!

Conversation

hartwork commented Sep 30, 2025 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hartwork commented Oct 4, 2025

Uh oh!

hartwork commented Oct 13, 2025

Uh oh!

Uh oh!

Uh oh!

hedsnz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hartwork commented Oct 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hartwork commented Oct 24, 2025

Uh oh!

StanFromIreland commented Oct 24, 2025

Uh oh!

hartwork commented Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vstinner commented Oct 28, 2025

Uh oh!

Uh oh!

hartwork commented Oct 29, 2025

Uh oh!

serhiy-storchaka left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vstinner left a comment

Choose a reason for hiding this comment

Uh oh!

hartwork commented Oct 29, 2025

Uh oh!

serhiy-storchaka commented Oct 29, 2025

Uh oh!

hartwork commented Nov 5, 2025

Uh oh!

Uh oh!

miss-islington-app Bot commented Nov 5, 2025

Uh oh!

bedevere-app Bot commented Nov 5, 2025

Uh oh!

bedevere-app Bot commented Nov 5, 2025

Uh oh!

hartwork commented Nov 5, 2025

Uh oh!

serhiy-storchaka commented Nov 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

hartwork commented Sep 30, 2025 •

edited by github-actions Bot

Loading

hartwork commented Oct 20, 2025 •

edited

Loading

hartwork commented Oct 24, 2025 •

edited

Loading