XML vulnerabilities in Python

Ouverte
#61,441 23 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Personne n'a encore pris cette issue.

Évaluation

Difficulté
5/5
Temps estimé
Plus d'une semaine
Accessibilité débutants
15/100
Type d'issue
Bug
Clarté
À clarifier
Activité
À l'abandon
Stack technique
python
Domaine
security

Piste de recherche

Start by reviewing the linked PRs #9217, #9265, #9511, and #9512, then compare their scope with the remaining dependency bpo-24238. The issue names xmlbomb_20130219.patch and xmlbomb_20150518.patch, but does not identify a current entry point, test, or clear completion criteria.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

extension-modules stdlib topic-XML type-security
BPO 17239
Nosy @warsaw, @birkenfeld, @rhettinger, @pitrou, @scoder, @larryhastings, @tiran, @benjaminp, @jwilk, @ned-deily, @mcepl, @ezio-melotti, @mitar, @vadmium, @serhiy-storchaka, @zooba
PRs
  • python/cpython#9217
  • python/cpython#9265
  • python/cpython#9511
  • python/cpython#9512
  • Dependencies
  • bpo-17318: xml.sax and xml.dom fetch DTDs by default (✅)
  • bpo-24238: Avoid entity expansion attacks in Element Tree
  • Files
  • xmlbomb_20130219.patch
  • xmlbomb_20150518.patch: Merged to 3.5
  • Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
    closed_at = None
    created_at = <Date 2013-02-19.15:35:41.914>
    labels = ['type-security', 'expert-XML', '3.8', '3.9', 'extension-modules', '3.7', 'library']
    title = 'XML vulnerabilities in Python'
    updated_at = <Date 2021-11-08.16:56:41.595>
    user = 'https://github.com/tiran'
    

    bugs.python.org fields:

    activity = <Date 2021-11-08.16:56:41.595>
    actor = 'vstinner'
    assignee = 'none'
    closed = False
    closed_date = None
    closer = None
    components = ['Extension Modules', 'Library (Lib)', 'XML']
    creation = <Date 2013-02-19.15:35:41.914>
    creator = 'christian.heimes'
    dependencies = ['17318', '24238']
    files = ['29122', '39415']
    hgrepos = []
    issue_num = 17239
    keywords = ['patch']
    message_count = 23.0
    messages = ['182393', '184285', '184289', '184387', '185053', '243450', '243469', '243581', '324416', '324685', '325562', '325573', '325586', '325590', '325595', '325610', '325642', '325648', '325702', '325738', '326144', '326228', '326229']
    nosy_count = 20.0
    nosy_names = ['barry', 'georg.brandl', 'rhettinger', 'pitrou', 'scoder', 'larry', 'christian.heimes', 'benjamin.peterson', 'jwilk', 'ned.deily', 'mcepl', 'ezio.melotti', 'Arfrever', 'eli.bendersky', 'mitar', 'martin.panter', 'serhiy.storchaka', 'franck', 'steve.dower', 'rsandwick3']
    pr_nums = ['9217', '9265', '9511', '9512']
    priority = 'critical'
    resolution = None
    stage = 'patch review'
    status = 'open'
    superseder = None
    type = 'security'
    url = 'https://bugs.python.org/issue17239'
    versions = ['Python 3.7', 'Python 3.8', 'Python 3.9']
    

    bpo-24238 is https://github.com/python/cpython/issues/68426 which remains open.

    Langage dominant
    Python
    Étoiles
    77.2k
    Forks
    36k
    Merge moyen
    1 j 9 h
    PR mergées (30 j)
    558

    Guide de contribution

    Ouvrir le guide de contribution

    Par où commencer

    1. Lisez l'issue en entier, puis le guide de contribution du projet.
    2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
    3. Forkez le dépôt et travaillez sur une branche.
    4. Ouvrez une pull request qui référence le numéro de l'issue.

    Autres issues de python/cpython

    Toutes les issues de python/cpython

    Recevez les nouvelles issues par e-mail

    Un résumé court des issues GitHub adaptées aux débutants.