From e6eac2b3aaa1dcc43c88428b6e39addb2b0543f2 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Fri, 1 May 2026 14:42:33 +0200 Subject: [PATCH] [3.14] gh-111264: Add a note about untrusted input to tomllib docs (GH-146209) (GH-149223) (cherry picked from commit 9d41e2a534aab460dd656ef251adaed5d2d64b93) Co-authored-by: Stan Ulbrych --- Doc/library/tomllib.rst | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Doc/library/tomllib.rst b/Doc/library/tomllib.rst index 30d7ff50a1a..95b2c91314c 100644 --- a/Doc/library/tomllib.rst +++ b/Doc/library/tomllib.rst @@ -17,6 +17,13 @@ This module provides an interface for parsing TOML 1.0.0 (Tom's Obvious Minimal Language, `https://toml.io `_). This module does not support writing TOML. +.. warning:: + + Be cautious when parsing data from untrusted sources. + A malicious TOML string may cause the decoder to consume considerable + CPU and memory resources. + Limiting the size of data to be parsed is recommended. + .. seealso:: The :pypi:`Tomli-W package `