A Series of Potential DoS Risk Points in the CPython Standard Library

Bug report

Bug description:

Approximately six months ago, our automated scanning program detected several issues and an issue(#134873) was filed. Recently, after improving the scanner and re-running it against CPython, additional locations were found that may be susceptible to algorithmic complexity attacks. Although each finding has been validated as carefully as possible, some false positives may still exist.
Please note that these findings do not necessarily imply an exploitable vulnerability (and are unlikely to represent a straightforward remote attack vector). After discussion with PSRC, these points are being disclosed in this issue in order to leverage community review and contributions to assess impact and, where appropriate, implement hardening or fixes.
Incremental updates will be posted over the coming weeks.

We’ve updated the items related to the email module in https://github.com/python/cpython/issues/136063.

1. _c3_mro（EXP）
   https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/functools.py#L780-L823

2.allmethods（Exp）

https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/pydoc.py#L211

3.FragmentBuilderNS._getNSattrs (Poly）https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/xml/dom/expatbuilder.py#L818)

4. __dict_replace（EXP）https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/xml/sax/saxutils.py#L12

5.punycode_decode（Poly)
https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/encodings/punycode.py#L188

.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-151812
• gh-151922
• gh-151923
• gh-151924
• gh-155475
• gh-157561
• gh-157562
• gh-157563

首先检查 Lib/functools.py、Lib/pydoc.py、Lib/xml/dom/expatbuilder.py、Lib/xml/sax/saxutils.py 和 Lib/encodings/punycode.py 中提到的五个位置，以及相关联的 pull request。评估每项扫描器发现的影响，并判断是否适合进行加固或修复。所有发现都已确定处理方式，且任何必要的更改都已由测试覆盖，即表示完成。