11# SOME DESCRIPTIVE TITLE.
2- # Copyright (C) 2001-2023 , Python Software Foundation
2+ # Copyright (C) 2001-2024 , Python Software Foundation
33# This file is distributed under the same license as the Python package.
44# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
55#
66# Translators:
7- # Rafael Fontenelle <[email protected] >, 2023 7+ # Rafael Fontenelle <[email protected] >, 2024 88#
99#, fuzzy
1010msgid ""
1111msgstr ""
1212"Project-Id-Version : Python 3.10\n "
1313"Report-Msgid-Bugs-To : \n "
14- "POT-Creation-Date : 2023-07-29 03:05 +0000\n "
14+ "POT-Creation-Date : 2024-02-23 19:03 +0000\n "
1515"PO-Revision-Date : 2022-11-05 17:23+0000\n "
16- "
Last-Translator :
Rafael Fontenelle <[email protected] >, 2023 \n "
16+ "
Last-Translator :
Rafael Fontenelle <[email protected] >, 2024 \n "
1717"Language-Team : Chinese (China) (https://app.transifex.com/python-doc/teams/5390/zh_CN/)\n "
1818"MIME-Version : 1.0\n "
1919"Content-Type : text/plain; charset=UTF-8\n "
@@ -147,7 +147,7 @@ msgstr "**易受攻击** (1)"
147147msgid "quadratic blowup"
148148msgstr "quadratic blowup"
149149
150- #: ../../library/xml.rst:68 ../../library/xml.rst:103
150+ #: ../../library/xml.rst:68 ../../library/xml.rst:109
151151msgid "external entity expansion"
152152msgstr "external entity expansion"
153153
@@ -168,7 +168,7 @@ msgstr "安全 (3)"
168168msgid "Safe (4)"
169169msgstr "安全 (4)"
170170
171- #: ../../library/xml.rst:69 ../../library/xml.rst:108
171+ #: ../../library/xml.rst:69 ../../library/xml.rst:114
172172msgid "`DTD`_ retrieval"
173173msgstr "`DTD`_ retrieval"
174174
@@ -178,15 +178,24 @@ msgstr "`DTD`_ retrieval"
178178msgid "Safe"
179179msgstr "安全"
180180
181- #: ../../library/xml.rst:70 ../../library/xml.rst:115
181+ #: ../../library/xml.rst:70 ../../library/xml.rst:121
182182msgid "decompression bomb"
183183msgstr "decompression bomb"
184184
185185#: ../../library/xml.rst:70
186186msgid "**Vulnerable**"
187187msgstr "**易受攻击**"
188188
189- #: ../../library/xml.rst:73
189+ #: ../../library/xml.rst:71 ../../library/xml.rst:128
190+ msgid "large tokens"
191+ msgstr "解析大量词元"
192+
193+ #: ../../library/xml.rst:71 ../../library/xml.rst:71 ../../library/xml.rst:71
194+ #: ../../library/xml.rst:71 ../../library/xml.rst:71
195+ msgid "**Vulnerable** (6)"
196+ msgstr "**易受攻击** (6)"
197+
198+ #: ../../library/xml.rst:74
190199msgid ""
191200"Expat 2.4.1 and newer is not vulnerable to the \" billion laughs\" and "
192201"\" quadratic blowup\" vulnerabilities. Items still listed as vulnerable due "
@@ -196,33 +205,43 @@ msgstr ""
196205"Expat 2.4.1 及更新的版本不易受 \" billion laughs\" 和 \" quadratic blowup\" 漏洞的攻击。 "
197206"因为可能要依赖系统提供的库而仍被列为易受攻击的项目。 请检查 :data:`pyexpat.EXPAT_VERSION`。"
198207
199- #: ../../library/xml.rst:77
208+ #: ../../library/xml.rst:78
200209msgid ""
201210":mod:`xml.etree.ElementTree` doesn't expand external entities and raises a "
202211":exc:`ParserError` when an entity occurs."
203212msgstr ":mod:`xml.etree.ElementTree` 不会扩展外部实体并在实体发生时引发 :exc:`ParserError`。"
204213
205- #: ../../library/xml.rst:79
214+ #: ../../library/xml.rst:80
206215msgid ""
207216":mod:`xml.dom.minidom` doesn't expand external entities and simply returns "
208217"the unexpanded entity verbatim."
209218msgstr ":mod:`xml.dom.minidom` 不会扩展外部实体,只是简单地返回未扩展的实体。"
210219
211- #: ../../library/xml.rst:81
220+ #: ../../library/xml.rst:82
212221msgid ":mod:`xmlrpclib` doesn't expand external entities and omits them."
213222msgstr ":mod:`xmlrpclib` 不扩展外部实体并省略它们。"
214223
215- #: ../../library/xml.rst:82
224+ #: ../../library/xml.rst:83
216225msgid ""
217226"Since Python 3.7.1, external general entities are no longer processed by "
218227"default."
219228msgstr "从 Python 3.7.1 开始,默认情况下不再处理外部通用实体。"
220229
221- #: ../../library/xml.rst:91
230+ #: ../../library/xml.rst:85
231+ msgid ""
232+ "Expat 2.6.0 and newer is not vulnerable to denial of service through "
233+ "quadratic runtime caused by parsing large tokens. Items still listed as "
234+ "vulnerable due to potential reliance on system-provided libraries. Check "
235+ ":const:`!pyexpat.EXPAT_VERSION`."
236+ msgstr ""
237+ "Expat 2.6.0 及更新的版本不易受到因解析大量词元而导致利用指数级运行时间的拒绝服务攻击。 "
238+ "由于对系统所提供的库的潜在依赖仍会有一些项目被列为易受攻击。 请检查 :const:`!pyexpat.EXPAT_VERSION`。"
239+
240+ #: ../../library/xml.rst:97
222241msgid "billion laughs / exponential entity expansion"
223242msgstr "billion laughs / exponential entity expansion (狂笑/递归实体扩展)"
224243
225- #: ../../library/xml.rst:87
244+ #: ../../library/xml.rst:93
226245msgid ""
227246"The `Billion Laughs`_ attack -- also known as exponential entity expansion "
228247"-- uses multiple levels of nested entities. Each entity refers to another "
@@ -233,11 +252,11 @@ msgstr ""
233252"`Billion Laughs`_ 攻击 -- 也称为递归实体扩展 -- 使用多级嵌套实体。 每个实体多次引用另一个实体,最终实体定义包含一个小字符串。"
234253" 指数级扩展导致几千 GB 的文本,并消耗大量内存和 CPU 时间。"
235254
236- #: ../../library/xml.rst:98
255+ #: ../../library/xml.rst:104
237256msgid "quadratic blowup entity expansion"
238257msgstr "quadratic blowup entity expansion(二次爆炸实体扩展)"
239258
240- #: ../../library/xml.rst:94
259+ #: ../../library/xml.rst:100
241260msgid ""
242261"A quadratic blowup attack is similar to a `Billion Laughs`_ attack; it "
243262"abuses entity expansion, too. Instead of nested entities it repeats one "
@@ -248,14 +267,14 @@ msgstr ""
248267"二次爆炸攻击类似于 `Billion Laughs`_ 攻击;它也滥用了实体扩展。 它不是嵌套实体,而是一遍又一遍地重复一个具有几千个字符的大型实体。 "
249268"这种攻击不如递归情况有效,但它可避免触发禁止深度嵌套实体的解析器对策。"
250269
251- #: ../../library/xml.rst:101
270+ #: ../../library/xml.rst:107
252271msgid ""
253272"Entity declarations can contain more than just text for replacement. They "
254273"can also point to external resources or local files. The XML parser accesses"
255274" the resource and embeds the content into the XML document."
256275msgstr "实体声明可以包含的不仅仅是替换文本。 它们还可以指向外部资源或本地文件。 XML 解析器访问资源并将内容嵌入到 XML 文档中。"
257276
258- #: ../../library/xml.rst:106
277+ #: ../../library/xml.rst:112
259278msgid ""
260279"Some XML libraries like Python's :mod:`xml.dom.pulldom` retrieve document "
261280"type definitions from remote or local locations. The feature has similar "
@@ -264,7 +283,7 @@ msgstr ""
264283"Python 的一些 XML 库 :mod:`xml.dom.pulldom` 从远程或本地位置检索文档类型定义。 "
265284"该功能与外部实体扩展问题具有相似的含义。"
266285
267- #: ../../library/xml.rst:111
286+ #: ../../library/xml.rst:117
268287msgid ""
269288"Decompression bombs (aka `ZIP bomb`_) apply to all XML libraries that can "
270289"parse compressed XML streams such as gzipped HTTP streams or LZMA-compressed"
@@ -274,17 +293,29 @@ msgstr ""
274293"Decompression bombs(解压炸弹,又名 `ZIP bomb`_)适用于所有可以解析压缩 XML 流(例如 gzip 压缩的 HTTP "
275294"流或 LZMA 压缩的文件)的 XML 库。 对于攻击者来说,它可以将传输的数据量减少三个量级或更多。"
276295
277- #: ../../library/xml.rst:117
296+ #: ../../library/xml.rst:124
297+ msgid ""
298+ "Expat needs to re-parse unfinished tokens; without the protection introduced"
299+ " in Expat 2.6.0, this can lead to quadratic runtime that can be used to "
300+ "cause denial of service in the application parsing XML. The issue is known "
301+ "as `CVE-2023-52425 <https://cve.mitre.org/cgi-"
302+ "bin/cvename.cgi?name=CVE-2023-52425>`_."
303+ msgstr ""
304+ "Expat 需要重新解析未完成的词元;在没有 Expat 2.6.0 所引入的防护措施的情况下,这会导致可被用来在解析 XML "
305+ "的应用程序中制造拒绝服务攻击的指数级运行时间。 此问题被称为 `CVE-2023-52425 <https://cve.mitre.org/cgi-"
306+ "bin/cvename.cgi?name=CVE-2023-52425>`_。"
307+
308+ #: ../../library/xml.rst:130
278309msgid ""
279310"The documentation for `defusedxml`_ on PyPI has further information about "
280311"all known attack vectors with examples and references."
281312msgstr "PyPI上 `defusedxml`_ 的文档包含有关所有已知攻击向量的更多信息以及示例和参考。"
282313
283- #: ../../library/xml.rst:123
314+ #: ../../library/xml.rst:136
284315msgid "The :mod:`defusedxml` Package"
285316msgstr ":mod:`defusedxml` 包"
286317
287- #: ../../library/xml.rst:125
318+ #: ../../library/xml.rst:138
288319msgid ""
289320"`defusedxml`_ is a pure Python package with modified subclasses of all "
290321"stdlib XML parsers that prevent any potentially malicious operation. Use of "
0 commit comments