A Series of Potential DoS Risk Points in the CPython Standard Library

Bug report

Bug description:

Approximately six months ago, our automated scanning program detected several issues and an issue(#134873) was filed. Recently, after improving the scanner and re-running it against CPython, additional locations were found that may be susceptible to algorithmic complexity attacks. Although each finding has been validated as carefully as possible, some false positives may still exist.
Please note that these findings do not necessarily imply an exploitable vulnerability (and are unlikely to represent a straightforward remote attack vector). After discussion with PSRC, these points are being disclosed in this issue in order to leverage community review and contributions to assess impact and, where appropriate, implement hardening or fixes.
Incremental updates will be posted over the coming weeks.

We’ve updated the items related to the email module in https://github.com/python/cpython/issues/136063.

1. _c3_mro（EXP）
   https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/functools.py#L780-L823

2.allmethods（Exp）

https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/pydoc.py#L211

3.FragmentBuilderNS._getNSattrs (Poly）https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/xml/dom/expatbuilder.py#L818)

4. __dict_replace（EXP）https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/xml/sax/saxutils.py#L12

5.punycode_decode（Poly)
https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/encodings/punycode.py#L188

.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-151812
• gh-151922
• gh-151923
• gh-151924
• gh-155475
• gh-157561
• gh-157562
• gh-157563

Commencez par examiner les cinq emplacements mentionnés dans Lib/functools.py, Lib/pydoc.py, Lib/xml/dom/expatbuilder.py, Lib/xml/sax/saxutils.py et Lib/encodings/punycode.py, ainsi que les pull requests associées. Évaluez l’impact de chaque constat du scanner et déterminez s’il convient de renforcer la sécurité ou d’appliquer une correction. Le travail est terminé lorsque le traitement de chaque constat a été décidé et que toutes les modifications nécessaires sont couvertes par des tests.