A Series of Potential DoS Risk Points in the CPython Standard Library

Bug report

Bug description:

Approximately six months ago, our automated scanning program detected several issues and an issue(#134873) was filed. Recently, after improving the scanner and re-running it against CPython, additional locations were found that may be susceptible to algorithmic complexity attacks. Although each finding has been validated as carefully as possible, some false positives may still exist.
Please note that these findings do not necessarily imply an exploitable vulnerability (and are unlikely to represent a straightforward remote attack vector). After discussion with PSRC, these points are being disclosed in this issue in order to leverage community review and contributions to assess impact and, where appropriate, implement hardening or fixes.
Incremental updates will be posted over the coming weeks.

We’ve updated the items related to the email module in https://github.com/python/cpython/issues/136063.

1. _c3_mro（EXP）
   https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/functools.py#L780-L823

2.allmethods（Exp）

https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/pydoc.py#L211

3.FragmentBuilderNS._getNSattrs (Poly）https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/xml/dom/expatbuilder.py#L818)

4. __dict_replace（EXP）https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/xml/sax/saxutils.py#L12

5.punycode_decode（Poly)
https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/encodings/punycode.py#L188

.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-151812
• gh-151922
• gh-151923
• gh-151924
• gh-155475
• gh-157561
• gh-157562
• gh-157563

Comece revisando os cinco locais mencionados em Lib/functools.py, Lib/pydoc.py, Lib/xml/dom/expatbuilder.py, Lib/xml/sax/saxutils.py e Lib/encodings/punycode.py, juntamente com os pull requests vinculados. Avalie o impacto de cada descoberta do scanner e se é apropriado aplicar hardening ou uma correção. Considera-se concluído quando a disposição de cada descoberta tiver sido decidida e quaisquer alterações necessárias estiverem cobertas por testes.