A Series of Potential DoS Risk Points in the CPython Standard Library

Bug report

Bug description:

Approximately six months ago, our automated scanning program detected several issues and an issue(#134873) was filed. Recently, after improving the scanner and re-running it against CPython, additional locations were found that may be susceptible to algorithmic complexity attacks. Although each finding has been validated as carefully as possible, some false positives may still exist.
Please note that these findings do not necessarily imply an exploitable vulnerability (and are unlikely to represent a straightforward remote attack vector). After discussion with PSRC, these points are being disclosed in this issue in order to leverage community review and contributions to assess impact and, where appropriate, implement hardening or fixes.
Incremental updates will be posted over the coming weeks.

We’ve updated the items related to the email module in https://github.com/python/cpython/issues/136063.

1. _c3_mro（EXP）
   https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/functools.py#L780-L823

2.allmethods（Exp）

https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/pydoc.py#L211

3.FragmentBuilderNS._getNSattrs (Poly）https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/xml/dom/expatbuilder.py#L818)

4. __dict_replace（EXP）https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/xml/sax/saxutils.py#L12

5.punycode_decode（Poly)
https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/encodings/punycode.py#L188

.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-151812
• gh-151922
• gh-151923
• gh-151924
• gh-155475
• gh-157561
• gh-157562
• gh-157563

Bắt đầu bằng việc xem xét năm vị trí được nêu trong Lib/functools.py, Lib/pydoc.py, Lib/xml/dom/expatbuilder.py, Lib/xml/sax/saxutils.py và Lib/encodings/punycode.py, cùng với các pull request được liên kết. Đánh giá tác động của từng phát hiện từ scanner và xem việc hardening hay sửa lỗi có phù hợp hay không. Công việc được coi là hoàn tất khi đã quyết định cách xử lý cho mọi phát hiện và mọi thay đổi cần thiết đều được kiểm thử.