[2.7.18.16] Give Expat parsers a 16-byte random hash salt (CVE-2026-7210) - #105

Backport of upstream pythongh-149018 (CVE-2026-7210): Expat's hash-flooding salt was too weak. Part of 2.7.18.16 (Linear PROD-1588).

Stacked on #104 (Expat 2.9.0). The base branch is 2.7.18.16-expat-2.9.0; retarget it to 2.7.18.16 once #104 merges.

Problem

pyexpat and cElementTree salt every parser with XML_SetHashSalt(parser, _Py_HashSecret.prefix). On 2.7, _Py_HashSecret is all zeros unless -R is used. A salt of 0 makes Expat generate its own, and our build defines XML_POOR_ENTROPY, so that salt comes from the time and pid. With 2.7.18.15:

$ EXPAT_ENTROPY_DEBUG=1 python -c "import pyexpat; pyexpat.ParserCreate().Parse('<a/>', True)"
expat: Entropy: fallback(8) --> 0x7fffffffffc792e4 (8 bytes)     # run 1
expat: Entropy: fallback(8) --> 0xdfffffffffc7dc21 (8 bytes)     # run 2

Fix

With Expat ≥ 2.8.0, pyexpat and _elementtree each read 16 bytes from _PyOS_URandom() at import, and pass them to every parser through XML_SetHashSalt16Bytes():

expat: Entropy: explicit(16) --> [0xb59df9d834359beb, 0x334b37ed14f0f358] (16 bytes)

• As upstream, SetHashSalt16Bytes is appended to PyExpat_CAPI. It is NULL for Expat < 2.8.0.
• With an older Expat, or if the OS random source fails, the code falls back to the old XML_SetHashSalt() call.
• 2.7 difference: upstream reads the salt from a new 16-byte expat member of _Py_HashSecret. 2.7's _Py_HashSecret_t is an exported struct of two longs, so each module keeps its own process-wide random salt instead.

Dependency

This needs Expat ≥ 2.8.0. The bundled copy is 2.9.0 after #104. On Windows, pyexpat.pyd links the external AS libexpat.lib and uses the bundled headers, so that library must be ≥ 2.8.0. The platform's current expat is 2.8.4, which meets that.

Testing (Linux x86_64, prod OpenSSL 1.1.1w, bundled expat 2.9.0)

• New test_pyexpat.HashSaltTest (pyexpat and cElementTree) runs a child interpreter with EXPAT_ENTROPY_DEBUG=1 and requires every parser's salt to be explicit(16).
  • With [2.7.18.16] Update bundled Expat to 2.9.0 (30 expat CVEs) #104 alone (Expat 2.9.0, no fix), both tests fail with fallback(8).
  • With this change, both pass.
  • Both are skipped when Expat is older than 2.8.0, so they're skipped on 2.7.18.15.
• test_pyexpat, test_xml_etree, test_xml_etree_c, test_minidom, test_sax and test_xmlrpc pass.
• Windows x64: not built here.