gh-149017: Upgrade bundled Expat to 2.8.0 (#149020) · python/cpython@005555a · GitHub
Skip to content

Commit 005555a

Browse files
StanFromIrelandStanFromIreland
authored
gh-149017: Upgrade bundled Expat to 2.8.0 (#149020)
1 parent fc829e8 commit 005555a

11 files changed

Lines changed: 180 additions & 229 deletions

File tree

‎Misc/NEWS.d/next/Security/2026-04-26-17-49-58.gh-issue-149017.EiVFPo.rst‎

Lines changed: 1 addition & 0 deletions

‎Misc/sbom.spdx.json‎

Lines changed: 18 additions & 18 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Modules/expat/expat.h‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@
4545
#ifndef Expat_INCLUDED
4646
# define Expat_INCLUDED 1
4747

48+
# include <stdint.h> // for uint8_t
4849
# include <stdlib.h>
4950
# include "expat_external.h"
5051

@@ -917,10 +918,21 @@ XML_SetParamEntityParsing(XML_Parser parser,
917918
function behavior. This must be called before parsing is started.
918919
Returns 1 if successful, 0 when called after parsing has started.
919920
Note: If parser == NULL, the function will do nothing and return 0.
921+
DEPRECATED since Expat 2.8.0.
920922
*/
921923
XMLPARSEAPI(int)
922924
XML_SetHashSalt(XML_Parser parser, unsigned long hash_salt);
923925

926+
/* Sets the hash salt to use for internal hash calculations.
927+
Helps in preventing DoS attacks based on predicting hash function behavior.
928+
This must be called before parsing is started.
929+
Returns XML_TRUE if successful, XML_FALSE when called after parsing has
930+
started or when parser is NULL.
931+
Added in Expat 2.8.0.
932+
*/
933+
XMLPARSEAPI(XML_Bool)
934+
XML_SetHashSalt16Bytes(XML_Parser parser, const uint8_t entropy[16]);
935+
924936
/* If XML_Parse or XML_ParseBuffer have returned XML_STATUS_ERROR, then
925937
XML_GetErrorCode returns information about the error.
926938
*/
@@ -1081,8 +1093,8 @@ XML_SetReparseDeferralEnabled(XML_Parser parser, XML_Bool enabled);
10811093
See https://semver.org
10821094
*/
10831095
# define XML_MAJOR_VERSION 2
1084-
# define XML_MINOR_VERSION 7
1085-
# define XML_MICRO_VERSION 5
1096+
# define XML_MINOR_VERSION 8
1097+
# define XML_MICRO_VERSION 0
10861098

10871099
# ifdef __cplusplus
10881100
}

‎Modules/expat/expat_config.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,5 +22,10 @@
2222
// bpo-30947: Python uses best available entropy sources to
2323
// call XML_SetHashSalt(), expat entropy sources are not needed
2424
#define XML_POOR_ENTROPY 1
25+
#undef HAVE_ARC4RANDOM
26+
#undef HAVE_ARC4RANDOM_BUF
27+
#undef HAVE_GETENTROPY
28+
#undef HAVE_GETRANDOM
29+
#undef HAVE_SYSCALL_GETRANDOM
2530

2631
#endif /* EXPAT_CONFIG_H */

‎Modules/expat/expat_external.h‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,10 @@
1212
Copyright (c) 2001-2002 Greg Stein <gstein@users.sourceforge.net>
1313
Copyright (c) 2002-2006 Karl Waclawek <karl@waclawek.net>
1414
Copyright (c) 2016 Cristian Rodríguez <crrodriguez@opensuse.org>
15-
Copyright (c) 2016-2026 Sebastian Pipping <sebastian@pipping.org>
15+
Copyright (c) 2016-2025 Sebastian Pipping <sebastian@pipping.org>
1616
Copyright (c) 2017 Rhodri James <rhodri@wildebeest.org.uk>
1717
Copyright (c) 2018 Yury Gribov <tetra2005@gmail.com>
18+
Copyright (c) 2026 Matthew Fernandez <matthew.fernandez@gmail.com>
1819
Licensed under the MIT license:
1920
2021
Permission is hereby granted, free of charge, to any person obtaining
@@ -48,7 +49,7 @@
4849
/* Expat tries very hard to make the API boundary very specifically
4950
defined. There are two macros defined to control this boundary;
5051
each of these can be defined before including this header to
51-
achieve some different behavior, but doing so it not recommended or
52+
achieve some different behavior, but doing so is not recommended or
5253
tested frequently.
5354
5455
XMLCALL - The calling convention to use for all calls across the

‎Modules/expat/internal.h‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
Copyright (c) 2002-2003 Fred L. Drake, Jr. <fdrake@users.sourceforge.net>
2929
Copyright (c) 2002-2006 Karl Waclawek <karl@waclawek.net>
3030
Copyright (c) 2003 Greg Stein <gstein@users.sourceforge.net>
31-
Copyright (c) 2016-2025 Sebastian Pipping <sebastian@pipping.org>
31+
Copyright (c) 2016-2026 Sebastian Pipping <sebastian@pipping.org>
3232
Copyright (c) 2018 Yury Gribov <tetra2005@gmail.com>
3333
Copyright (c) 2019 David Loffredo <loffredo@steptools.com>
3434
Copyright (c) 2023-2024 Sony Corporation / Snild Dolkow <snild@sony.com>
@@ -113,6 +113,7 @@
113113
#if defined(_WIN32) \
114114
&& (! defined(__USE_MINGW_ANSI_STDIO) \
115115
|| (1 - __USE_MINGW_ANSI_STDIO - 1 == 0))
116+
# define EXPAT_FMT_LLX(midpart) "%" midpart "I64x"
116117
# define EXPAT_FMT_ULL(midpart) "%" midpart "I64u"
117118
# if defined(_WIN64) // Note: modifiers "td" and "zu" do not work for MinGW
118119
# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "I64d"
@@ -122,6 +123,7 @@
122123
# define EXPAT_FMT_SIZE_T(midpart) "%" midpart "u"
123124
# endif
124125
#else
126+
# define EXPAT_FMT_LLX(midpart) "%" midpart "llx"
125127
# define EXPAT_FMT_ULL(midpart) "%" midpart "llu"
126128
# if ! defined(ULONG_MAX)
127129
# error Compiler did not define ULONG_MAX for us

‎Modules/expat/refresh.sh‎

Lines changed: 15 additions & 3 deletions

0 commit comments

Comments
 (0)