A Series of Potential DoS Risk Points in the CPython Standard Library

Bug report

Bug description:

Approximately six months ago, our automated scanning program detected several issues and an issue(#134873) was filed. Recently, after improving the scanner and re-running it against CPython, additional locations were found that may be susceptible to algorithmic complexity attacks. Although each finding has been validated as carefully as possible, some false positives may still exist.
Please note that these findings do not necessarily imply an exploitable vulnerability (and are unlikely to represent a straightforward remote attack vector). After discussion with PSRC, these points are being disclosed in this issue in order to leverage community review and contributions to assess impact and, where appropriate, implement hardening or fixes.
Incremental updates will be posted over the coming weeks.

We’ve updated the items related to the email module in https://github.com/python/cpython/issues/136063.

1. _c3_mro（EXP）
   https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/functools.py#L780-L823

2.allmethods（Exp）

https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/pydoc.py#L211

3.FragmentBuilderNS._getNSattrs (Poly）https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/xml/dom/expatbuilder.py#L818)

4. __dict_replace（EXP）https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/xml/sax/saxutils.py#L12

5.punycode_decode（Poly)
https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/encodings/punycode.py#L188

.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-151812
• gh-151922
• gh-151923
• gh-151924
• gh-155475
• gh-157561
• gh-157562
• gh-157563

Start by reviewing the five locations named in Lib/functools.py, Lib/pydoc.py, Lib/xml/dom/expatbuilder.py, Lib/xml/sax/saxutils.py, and Lib/encodings/punycode.py, along with the linked pull requests. Assess each scanner finding for impact and whether hardening or a fix is appropriate. Done means every finding has a decided disposition and any necessary changes are covered by tests.