You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Reduce memory usage of urllib.unquote and unquote_to_bytes #88500
'eng' claimed in original title that "urllib.parse.parse_qsl cannot parse large data". On original PR, said problem with 6-7 millions bytes.
Claim should be backed up by a generated example that fails with original code and succeeds with new code. Claims of 'faster' also needs some examples.
Original PRs must nearly all propose merging a branch created from main into main. Performance enhancements are often not backported.
I created a new PR and included fixing a similar legacy design issue in unquote() as well as the original report's unquote_to_bytes(). Some performance microbenchmarks need running before I'll consider moving forward with it.
If someone wanted to consider this a security issue it could be backported. It is at most a fixed constant factor (roughly $len(input) * sizeof(PyObject)$ memory consumption vs a maximally antagonistic input though. That doesn't smell DoS worthy.
Activity
[-]urllib cannot parse large data[/-][+]urllib.parse.parse_qsl cannot parse large data[/+][-]urllib cannot parse large data[/-][+]urllib.parse.parse_qsl cannot parse large data[/+]terryjreedy commentedon Jun 7, 2021
'eng' claimed in original title that "urllib.parse.parse_qsl cannot parse large data". On original PR, said problem with 6-7 millions bytes.
Claim should be backed up by a generated example that fails with original code and succeeds with new code. Claims of 'faster' also needs some examples.
Original PRs must nearly all propose merging a branch created from main into main. Performance enhancements are often not backported.
[-]urllib.parse.parse_qsl cannot parse large data[/-][+]Use bytearray in urllib.unquote_to_bytes[/+][-]urllib.parse.parse_qsl cannot parse large data[/-][+]Use bytearray in urllib.unquote_to_bytes[/+]4 remaining items
iritkatriel commentedon Sep 11, 2022
The PR was closed due to technicalities (pointing to the wrong branch, CLA) and the OP didn’t follow up.
Unless someone object I will close this issue as well.
pythongh-88500: Reduce memory use of urllib.unquote
[-]Use bytearray in urllib.unquote_to_bytes[/-][+]Reduce memory usage of urllib.unquote and unquote_to_bytes[/+]gpshead commentedon Sep 12, 2022
I created a new PR and included fixing a similar legacy design issue in
unquote()as well as the original report'sunquote_to_bytes(). Some performance microbenchmarks need running before I'll consider moving forward with it.If someone wanted to consider this a security issue it could be backported. It is at most a fixed constant factor (roughly$len(input) * sizeof(PyObject)$ memory consumption vs a maximally antagonistic input though. That doesn't smell DoS worthy.
gh-88500: Reduce memory use of `urllib.unquote` (#96763)