In the process of investigating and writing tests for issue32424, I discovered that the C implementation of xml.etree.ElementTree does not make a copy of the attrib argument when creating a new element, allowing the attributes of the element to be modified outside of creation.

The Python implementation does not have this problem.

My proposed solution to this was to make a copy of the attrib dictionary in the create_new_element() method in the C implementation, which solves the problem. However, this was apparently objected to on the grounds of performance.

Not knowing C very well, any guidance on a better way to fix this would be appreciated. :)

Instead of always copying the dict in create_new_element(), we should make sure that all code that calls that function (directly or indirectly) does so with a safely owned dict. If that means that we need to add dict copying in some other place, then that's what's needed to fix this bug.

The best fix is to make the copy close to the user input, where we know what we received and how we will continue to use it.

Given that this has probably been like this forever, and thus provably doesn't hurt very much, I would argue that it's not worth fixing this in Py3.7. Not sure about Py2.7, but I think the answer there should be a no, too.