开源软件构建与测试

We truncated the diff of some files because they were too big. If you want to see the full diff for every file, click here.

Changes of Revision 2

_service:tar_scm:python3.spec Changed

@@ -2,8 +2,8 @@
 Summary: Interpreter of the Python3 programming language
 URL: https://www.python.org/
 
-Version: 3.10.2
-Release: 5
+Version: 3.10.9
+Release: 3
 License: Python-2.0
 
 %global branchversion 3.10
@@ -87,10 +87,10 @@
 
 Patch1:   00001-rpath.patch
 Patch251: 00251-change-user-install-location.patch
-Patch6000:  backport-bpo-46811-Make-test-suite-support-Expat-2.4.5.patch
-Patch6001:  backport-CVE-2015-20107.patch
+Patch6000:  backport-Make-urllib.parse.urlparse-enforce-that-a-scheme-mus.patch 
 
 Patch9000:  add-the-sm3-method-for-obtaining-the-salt-value.patch
+Patch9001:  fix-CVE-2023-24329.patch
 
 Provides: python%{branchversion} = %{version}-%{release}
 Provides: python(abi) = %{branchversion}
@@ -144,8 +144,6 @@
 Obsoletes: python3-idle
 Provides: python3-test
 Obsoletes: python3-test
-Provides: python3-tkinter
-Obsoletes: python3-tkinter
 Provides: %{name}-tools = %{version}-%{release}
 Obsoletes: %{name}-tools < %{version}-%{release}
 
@@ -153,11 +151,22 @@
 This package contains the header files and configuration needed to develop
 python3 modules.
 
+%package tkinter
+Summary: A GUI toolkit for Python
+Requires: %{name} = %{version}-%{release}
+Provides: %{name}-turtle = %{version}-%{release}
+Provides: %{name}-tkinter = %{version}-%{release}
+
+%description tkinter
+The Tkinter (Tk interface) library is a graphical user interface toolkit for
+the Python programming language.
+
 %package debug
 Summary: Debug version of the Python runtime
 
 Requires: %{name} = %{version}-%{release}
 Requires: %{name}-devel = %{version}-%{release}
+Requires: %{name}-tkinter = %{version}-%{release}
 
 %description debug
 python3-debug provides a version of the Python runtime with numerous debugging
@@ -176,9 +185,9 @@
 %patch1 -p1
 %patch251 -p1
 %patch6000 -p1
-%patch6001 -p1
 
 %patch9000 -p1
+%patch9001 -p1
 
 %build
 autoconf
@@ -257,6 +266,7 @@
   --with-valgrind \
 %endif
   --without-ensurepip \
+  --with-lto \
   %{optimizations_flag}
 
 %make_build EXTRA_CFLAGS="$CFLAGS"
@@ -384,7 +394,7 @@
 
 WITHIN_PYTHON_RPM_BUILD= \
 LD_LIBRARY_PATH=$(pwd)/build/debug $(pwd)/build/debug/python -m test.regrtest \
-    -wW --slowest -j0 \
+    -wW --slowest -j0 --timeout 1800 \
     -x test_distutils \
     -x test_bdist_rpm \
     -x test_gdb \
@@ -396,7 +406,7 @@
 
 WITHIN_PYTHON_RPM_BUILD= \
 LD_LIBRARY_PATH=$(pwd)/build/optimized $(pwd)/build/optimized/python -m test.regrtest \
-    -wW --slowest -j0 \
+    -wW --slowest -j0 --timeout 1800 \
     -x test_distutils \
     -x test_bdist_rpm \
     -x test_gdb \
@@ -659,17 +669,6 @@
 
 %{_datadir}/icons/hicolor/*/apps/idle3.*
 
-%{pylibdir}/tkinter
-%exclude %{pylibdir}/tkinter/test
-%{dynload_dir}/_tkinter.%{SOABI_optimized}.so
-%{pylibdir}/turtle.py
-%{pylibdir}/__pycache__/turtle*%{bytecode_suffixes}
-%dir %{pylibdir}/turtledemo
-%{pylibdir}/turtledemo/*.py
-%{pylibdir}/turtledemo/*.cfg
-%dir %{pylibdir}/turtledemo/__pycache__/
-%{pylibdir}/turtledemo/__pycache__/*%{bytecode_suffixes}
-
 %{pylibdir}/ctypes/test
 %{pylibdir}/distutils/tests
 %{pylibdir}/sqlite3/test
@@ -684,7 +683,6 @@
 %{dynload_dir}/_testimportmultiple.%{SOABI_optimized}.so
 %{dynload_dir}/_xxtestfuzz.%{SOABI_optimized}.so
 %{pylibdir}/lib2to3/tests
-%{pylibdir}/tkinter/test
 %{pylibdir}/unittest/test
 
 %exclude %dir %{pylibdir}/test/
@@ -693,6 +691,17 @@
 %exclude %{pylibdir}/test/__pycache__/__init__%{bytecode_suffixes}
 %exclude %{pylibdir}/test/support/
 
+%files tkinter
+%{pylibdir}/tkinter
+%{dynload_dir}/_tkinter.%{SOABI_optimized}.so
+%{pylibdir}/turtle.py
+%{pylibdir}/__pycache__/turtle*%{bytecode_suffixes}
+%dir %{pylibdir}/turtledemo
+%{pylibdir}/turtledemo/*.py
+%{pylibdir}/turtledemo/*.cfg
+%dir %{pylibdir}/turtledemo/__pycache__/
+%{pylibdir}/turtledemo/__pycache__/*%{bytecode_suffixes}
+
 %files debug
 %{_bindir}/python3-debug
 
@@ -795,6 +804,66 @@
 %{_mandir}/*/*
 
 %changelog
+* Thu Apr 06 2023 shixuantong <shixuantong1@huawei.com> - 3.10.9-3
+- Type:CVE
+- CVE:CVE-2023-24329
+- SUG:NA
+- DESC:fix CVE-2023-24329
+
+* Mon Mar 13 2023 Chenxi Mao <chenxi.mao@suse.com> - 3.10.9-2
+- Type:enhancement
+- CVE:NA
+- SUG:NA
+- DESC: Enable link time optimizaitons (LTO) for better performance.
+
+* Mon Jan 30 2023 zhuofeng <zhuofeng2@huawei.com> - 3.10.9-1
+- Type:enhancement
+- CVE:NA
+- SUG:NA
+- DESC:update version to 3.10.9
+
+* Mon Nov 28 2022 zhuofeng <zhuofeng2@huawei.com> - 3.10.2-12                                         
+- Type:CVE
+- CVE:CVE-2022-37454
+- SUG:NA
+- DESC:fix CVE-2022-37454
+
+* Thu Nov 10 2022 zhuofeng <zhuofeng2@huawei.com> - 3.10.2-11
+- Type:CVE
+- CVE:CVE-2022-45061
+- SUG:NA
+- DESC:fix CVE-2022-45061
+
+* Wed Nov 09 2022 zhuofeng <zhuofeng2@huawei.com> - 3.10.2-10
+- Type:CVE
+- CVE:CVE-2022-42919
+- SUG:NA
+- DESC:fix CVE-2022-42919
+
+* Thu Sep 08 2022 shixuantong <shixuantong@h-partners.com> - 3.10.2-9
+- Type:CVE
+- CVE:CVE-2020-10735
+- SUG:NA
+- DESC:fix CVE-2020-10735
+
+* Thu Aug 25 2022 shixuantong <shixuantong@h-partners.com> - 3.10.2-8
+- Type:CVE
+- CVE:CVE-2021-28861
+- SUG:NA
+- DESC:fix CVE-2021-28861
+
+* Fri Aug 12 2022 shixuantong <shixuantong@h-partners.com> - 3.10.2-7
+- Type:enhancement
+- CVE:NA
+- SUG:NA
+- DESC:split python3-tkinter from python3-devel
+
+* Wed Aug 03 2022 shixuantong <shixuantong@h-partners.com> - 3.10.2-6
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:add timeout when running the test case

_service:tar_scm:00001-rpath.patch Changed

_service:tar_scm:00251-change-user-install-location.patch Changed

@@ -1,37 +1,65 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Lumir Balhar <lbalhar@redhat.com>
+From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
 Date: Mon, 15 Feb 2021 12:19:27 +0100
 Subject: PATCH 00251: Change user install location
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
-Change the values of sysconfig's "posix_prefix" install scheme to /usr/local
-when RPM build or venv/virtualenv is not detected,
-to make pip, sysconfig and distutils install into an isolated location.
+Set values of base and platbase in sysconfig from /usr
+to /usr/local when RPM build is not detected
+to make pip and similar tools install into separate location.
 
-The original values are saved as an additional "rpm_prefix" install scheme.
-
-The site module adds the /usr/local paths to sys.path when site packages are
-enabled and RPM build is not detected.
+Set values of prefix and exec_prefix in distutils install command
+to /usr/local if executable is /usr/bin/python* and RPM build
+is not detected to make distutils and pypa/distutils install into separate location.
 
 Fedora Change: https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
+Downstream only.
 
-Rewrote in Fedora 36+ to patch sysconfig instead of distutils,
-see https://discuss.python.org/t/pep-632-deprecate-distutils-module/5134/104
+We've tried to rework in Fedora 36/Python 3.10 to follow https://bugs.python.org/issue43976
+but we have identified serious problems with that approach,
+see https://bugzilla.redhat.com/2026979 or https://bugzilla.redhat.com/2097183
 
-Downstream only for now, waiting for https://bugs.python.org/issue43976
+pypa/distutils integration: https://github.com/pypa/distutils/pull/70
 
 Co-authored-by: Petr Viktorin <encukou@gmail.com>
 Co-authored-by: Miro Hrončok <miro@hroncok.cz>
 Co-authored-by: Michal Cyprian <m.cyprian@gmail.com>
 Co-authored-by: Lumír Balhar <frenzy.madness@gmail.com>
 ---
- Lib/site.py                |  9 ++++++++-
- Lib/sysconfig.py           | 25 +++++++++++++++++++++++++
- Lib/test/test_sysconfig.py |  4 +++-
- 3 files changed, 36 insertions(+), 2 deletions(-)
+ Lib/distutils/command/install.py |  8 +++--
+ Lib/site.py                      |  9 +++++-
+ Lib/sysconfig.py                 | 53 +++++++++++++++++++++++++++++++-
+ Lib/test/test_sysconfig.py       | 17 ++++++++--
+ 4 files changed, 81 insertions(+), 6 deletions(-)
 
+diff --git a/Lib/distutils/command/install.py b/Lib/distutils/command/install.py
+index 01d5331a63..79f70f0de4 100644
+--- a/Lib/distutils/command/install.py
++++ b/Lib/distutils/command/install.py
+@@ -159,6 +159,8 @@ class install(Command):
+ 
+     negative_opt = {'no-compile' : 'compile'}
+ 
++    # Allow Fedora to add components to the prefix
++    _prefix_addition = getattr(sysconfig, '_prefix_addition', '')
+ 
+     def initialize_options(self):
+         """Initializes options."""
+@@ -441,8 +443,10 @@ def finalize_unix(self):
+                     raise DistutilsOptionError(
+                           "must not supply exec-prefix without prefix")
+ 
+-                self.prefix = os.path.normpath(sys.prefix)
+-                self.exec_prefix = os.path.normpath(sys.exec_prefix)
++                self.prefix = (
++                    os.path.normpath(sys.prefix) + self._prefix_addition)
++                self.exec_prefix = (
++                    os.path.normpath(sys.exec_prefix) + self._prefix_addition)
+ 
+             else:
+                 if self.exec_prefix is None:
 diff --git a/Lib/site.py b/Lib/site.py
 index 939893eb5e..d1316c3355 100644
 --- a/Lib/site.py
@@ -54,46 +82,113 @@
          if os.path.isdir(sitedir):
              addsitedir(sitedir, known_paths)
 diff --git a/Lib/sysconfig.py b/Lib/sysconfig.py
-index daf9f00006..40e4edf0ae 100644
+index daf9f00006..10368c92a7 100644
 --- a/Lib/sysconfig.py
 +++ b/Lib/sysconfig.py
-@@ -58,6 +58,31 @@
+@@ -58,6 +58,16 @@
          },
      }
  
-+# backup the original posix_prefix as rpm_prefix
-+# RPM packages use it and we need to be able to read it even when changed
++# For a brief period of time in the Fedora 36 life cycle,
++# this installation scheme existed and was documented in the release notes.
++# For backwards compatibility, we keep it here (at least on 3.10 and 3.11).
 +_INSTALL_SCHEMES'rpm_prefix' = _INSTALL_SCHEMES'posix_prefix'
 +# Virtualenv >= 20.10.0 favors the "venv" scheme over the defaults when creating virtual environments.
 +# See: https://github.com/pypa/virtualenv/commit/8da79db86d8a5c74d03667a40e64ff832076445e
 +# See: https://bugs.python.org/issue45413
-+# "venv" should be the same as the unpatched posix_prefix for us,
++# "venv" should be the same as the posix_prefix for us,
 +# so new virtual environments aren't created with paths like venv/local/bin/python.
 +_INSTALL_SCHEMES'venv' = _INSTALL_SCHEMES'posix_prefix'
-+
+ 
+ # NOTE: site.py has copy of this function.
+ # Sync it when modify this function.
+@@ -117,6 +127,19 @@ def joinuser(*args):
+             },
+     }
+ 
++# This is used by distutils.command.install in the stdlib
++# as well as pypa/distutils (e.g. bundled in setuptools).
++# The self.prefix value is set to sys.prefix + /local/
++# if neither RPM build nor virtual environment is
++# detected to make distutils install packages
++# into the separate location.
++# https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
 +if (not (hasattr(sys, 'real_prefix') or
 +    sys.prefix != sys.base_prefix) and
 +    'RPM_BUILD_ROOT' not in os.environ):
-+        _INSTALL_SCHEMES'posix_prefix' = {
-+            'stdlib': '{installed_base}/{platlibdir}/python{py_version_short}',
-+            'platstdlib': '{platbase}/{platlibdir}/python{py_version_short}',
-+            'purelib': '{base}/local/lib/python{py_version_short}/site-packages',
-+            'platlib': '{platbase}/local/{platlibdir}/python{py_version_short}/site-packages',
-+            'include':
-+                '{installed_base}/include/python{py_version_short}{abiflags}',
-+            'platinclude':
-+                '{installed_platbase}/include/python{py_version_short}{abiflags}',
-+            'scripts': '{base}/local/bin',
-+            'data': '{base}/local',
-+        }
++    _prefix_addition = '/local'
++
++
+ _SCHEME_KEYS = ('stdlib', 'platstdlib', 'purelib', 'platlib', 'include',
+                 'scripts', 'data')
  
- # NOTE: site.py has copy of this function.
- # Sync it when modify this function.
+@@ -211,11 +234,39 @@ def _extend_dict(target_dict, other_dict):
+         target_dictkey = value
+ 
+ 
++_CONFIG_VARS_LOCAL = None
++
++
++def _config_vars_local():
++    # This function returns the config vars with prefixes amended to /usr/local
++    # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
++    global _CONFIG_VARS_LOCAL
++    if _CONFIG_VARS_LOCAL is None:
++        _CONFIG_VARS_LOCAL = dict(get_config_vars())
++        _CONFIG_VARS_LOCAL'base' = '/usr/local'
++        _CONFIG_VARS_LOCAL'platbase' = '/usr/local'
++    return _CONFIG_VARS_LOCAL
++
++
+ def _expand_vars(scheme, vars):
+     res = {}
+     if vars is None:
+         vars = {}
+-    _extend_dict(vars, get_config_vars())
++
++    # when we are not in a virtual environment or an RPM build
++    # we change '/usr' to '/usr/local'
++    # to avoid surprises, we explicitly check for the /usr/ prefix
++    # Python virtual environments have different prefixes
++    # we only do this for posix_prefix, not to mangle the venv scheme
++    # posix_prefix is used by sudo pip install
++    # we only change the defaults here, so explicit --prefix will take precedence
++    # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
++    if (scheme == 'posix_prefix' and
++        _PREFIX == '/usr' and
++        'RPM_BUILD_ROOT' not in os.environ):
++            _extend_dict(vars, _config_vars_local())
++    else:
++        _extend_dict(vars, get_config_vars())
+ 
+     for key, value in _INSTALL_SCHEMESscheme.items():
+         if os.name in ('posix', 'nt'):
 diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py
-index 9408657c91..fd49b2bcce 100644
+index 5ee9839c04..16e92ca86f 100644
 --- a/Lib/test/test_sysconfig.py
 +++ b/Lib/test/test_sysconfig.py
-@@ -263,7 +263,7 @@ def test_get_config_h_filename(self):
+@@ -105,8 +105,19 @@ def test_get_path(self):
+         for scheme in _INSTALL_SCHEMES:
+             for name in _INSTALL_SCHEMESscheme:
+                 expected = _INSTALL_SCHEMESschemename.format(**config_vars)
++                tested = get_path(name, scheme)
++                # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
++                if tested.startswith('/usr/local'):
++                    # /usr/local should only be used in posix_prefix

_service:tar_scm:backport-CVE-2015-20107.patch Deleted

@@ -1,149 +0,0 @@
-From b9509ba7a9c668b984dab876c7926fe1dc5aa0ba Mon Sep 17 00:00:00 2001
-From: Petr Viktorin <encukou@gmail.com>
-Date: Fri, 3 Jun 2022 11:43:35 +0200
-Subject: PATCH gh-68966: Make mailcap refuse to match unsafe
- filenames/types/params (GH-91993)
-
----
- Doc/library/mailcap.rst                       | 12 +++++++++
- Lib/mailcap.py                                | 26 +++++++++++++++++--
- Lib/test/test_mailcap.py                      |  8 ++++--
- ...2-04-27-18-25-30.gh-issue-68966.gjS8zs.rst |  4 +++
- 4 files changed, 46 insertions(+), 4 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Security/2022-04-27-18-25-30.gh-issue-68966.gjS8zs.rst
-
-diff --git a/Doc/library/mailcap.rst b/Doc/library/mailcap.rst
-index 5490c8468d..bfaedb4609 100644
---- a/Doc/library/mailcap.rst
-+++ b/Doc/library/mailcap.rst
-@@ -60,6 +60,18 @@ standard.  However, mailcap files are supported on most Unix systems.
-    use) to determine whether or not the mailcap line applies.  :func:`findmatch`
-    will automatically check such conditions and skip the entry if the check fails.
- 
-+   .. versionchanged:: 3.11
-+
-+      To prevent security issues with shell metacharacters (symbols that have
-+      special effects in a shell command line), ``findmatch`` will refuse
-+      to inject ASCII characters other than alphanumerics and ``@+=:,./-_``
-+      into the returned command line.
-+
-+      If a disallowed character appears in *filename*, ``findmatch`` will always
-+      return ``(None, None)`` as if no entry was found.
-+      If such a character appears elsewhere (a value in *plist* or in *MIMEtype*),
-+      ``findmatch`` will ignore all mailcap entries which use that value.
-+      A :mod:`warning <warnings>` will be raised in either case.
- 
- .. function:: getcaps()
- 
-diff --git a/Lib/mailcap.py b/Lib/mailcap.py
-index 856b6a5547..7278ea7051 100644
---- a/Lib/mailcap.py
-+++ b/Lib/mailcap.py
-@@ -2,6 +2,7 @@
- 
- import os
- import warnings
-+import re
- 
- __all__ = "getcaps","findmatch"
- 
-@@ -19,6 +20,11 @@ def lineno_sort_key(entry):
-     else:
-         return 1, 0
- 
-+_find_unsafe = re.compile(r'^\xa1-\U0010FFFF\w@+=:,./-').search
-+
-+class UnsafeMailcapInput(Warning):
-+    """Warning raised when refusing unsafe input"""
-+
- 
- # Part 1: top-level interface.
- 
-@@ -171,15 +177,22 @@ def findmatch(caps, MIMEtype, key='view', filename="/dev/null", plist=):
-     entry to use.
- 
-     """
-+    if _find_unsafe(filename):
-+        msg = "Refusing to use mailcap with filename %r. Use a safe temporary filename." % (filename,)
-+        warnings.warn(msg, UnsafeMailcapInput)
-+        return None, None
-     entries = lookup(caps, MIMEtype, key)
-     # XXX This code should somehow check for the needsterminal flag.
-     for e in entries:
-         if 'test' in e:
-             test = subst(e'test', filename, plist)
-+            if test is None:
-+                continue
-             if test and os.system(test) != 0:
-                 continue
-         command = subst(ekey, MIMEtype, filename, plist)
--        return command, e
-+        if command is not None:
-+            return command, e
-     return None, None
- 
- def lookup(caps, MIMEtype, key=None):
-@@ -212,6 +225,10 @@ def subst(field, MIMEtype, filename, plist=):
-             elif c == 's':
-                 res = res + filename
-             elif c == 't':
-+                if _find_unsafe(MIMEtype):
-+                    msg = "Refusing to substitute MIME type %r into a shell command." % (MIMEtype,)
-+                    warnings.warn(msg, UnsafeMailcapInput)
-+                    return None
-                 res = res + MIMEtype
-             elif c == '{':
-                 start = i
-@@ -219,7 +236,12 @@ def subst(field, MIMEtype, filename, plist=):
-                     i = i+1
-                 name = fieldstart:i
-                 i = i+1
--                res = res + findparam(name, plist)
-+                param = findparam(name, plist)
-+                if _find_unsafe(param):
-+                    msg = "Refusing to substitute parameter %r (%s) into a shell command" % (param, name)
-+                    warnings.warn(msg, UnsafeMailcapInput)
-+                    return None
-+                res = res + param
-             # XXX To do:
-             # %n == number of parts if type is multipart/*
-             # %F == list of alternating type and filename for parts
-diff --git a/Lib/test/test_mailcap.py b/Lib/test/test_mailcap.py
-index d3995b1472..8185f4a780 100644
---- a/Lib/test/test_mailcap.py
-+++ b/Lib/test/test_mailcap.py
-@@ -128,7 +128,8 @@ def test_subst(self):
-             ("", "audio/*", "foo.txt", ""),
-             ("echo foo", "audio/*", "foo.txt", "echo foo"),
-             ("echo %s", "audio/*", "foo.txt", "echo foo.txt"),
--            ("echo %t", "audio/*", "foo.txt", "echo audio/*"),
-+            ("echo %t", "audio/*", "foo.txt", None),
-+            ("echo %t", "audio/wav", "foo.txt", "echo audio/wav"),
-             ("echo \\%t", "audio/*", "foo.txt", "echo %t"),
-             ("echo foo", "audio/*", "foo.txt", plist, "echo foo"),
-             ("echo %{total}", "audio/*", "foo.txt", plist, "echo 3")
-@@ -212,7 +213,10 @@ def test_findmatch(self):
-              ('"An audio fragment"', audio_basic_entry)),
-             (c, "audio/*",
-              {"filename": fname},
--             ("/usr/local/bin/showaudio audio/*", audio_entry)),
-+             (None, None)),
-+            (c, "audio/wav",
-+             {"filename": fname},
-+             ("/usr/local/bin/showaudio audio/wav", audio_entry)),
-             (c, "message/external-body",
-              {"plist": plist},
-              ("showexternal /dev/null default john python.org     /tmp foo bar", message_entry))
-diff --git a/Misc/NEWS.d/next/Security/2022-04-27-18-25-30.gh-issue-68966.gjS8zs.rst b/Misc/NEWS.d/next/Security/2022-04-27-18-25-30.gh-issue-68966.gjS8zs.rst
-new file mode 100644
-index 0000000000..da81a1f699
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2022-04-27-18-25-30.gh-issue-68966.gjS8zs.rst
-@@ -0,0 +1,4 @@
-+The deprecated mailcap module now refuses to inject unsafe text (filenames,
-+MIME types, parameters) into shell commands. Instead of using such text, it
-+will warn and act as if a match was not found (or for test commands, as if
-+the test failed).
--- 
-2.23.0
-

_service:tar_scm:backport-Make-urllib.parse.urlparse-enforce-that-a-scheme-mus.patch Added

@@ -0,0 +1,73 @@
+From 439b9cfaf43080e91c4ad69f312f21fa098befc7 Mon Sep 17 00:00:00 2001
+From: Ben Kallus <49924171+kenballus@users.noreply.github.com>
+Date: Sun, 13 Nov 2022 18:25:55 +0000
+Subject: PATCH gh-99418: Make urllib.parse.urlparse enforce that a scheme
+ must begin with an alphabetical ASCII character. (#99421)
+
+Prevent urllib.parse.urlparse from accepting schemes that don't begin with an alphabetical ASCII character.
+
+RFC 3986 defines a scheme like this: `scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )`
+RFC 2234 defines an ALPHA like this: `ALPHA = %x41-5A / %x61-7A`
+
+The WHATWG URL spec defines a scheme like this:
+`"A URL-scheme string must be one ASCII alpha, followed by zero or more of ASCII alphanumeric, U+002B (+), U+002D (-), and U+002E (.)."`
+---
+ Lib/test/test_urlparse.py                      | 18 ++++++++++++++++++
+ Lib/urllib/parse.py                            |  2 +-
+ ...22-11-12-15-45-51.gh-issue-99418.FxfAXS.rst |  2 ++
+ 3 files changed, 21 insertions(+), 1 deletion(-)
+ create mode 100644 Misc/NEWS.d/next/Library/2022-11-12-15-45-51.gh-issue-99418.FxfAXS.rst
+
+diff --git a/Lib/test/test_urlparse.py b/Lib/test/test_urlparse.py
+index 31943f3..f42ed9b 100644
+--- a/Lib/test/test_urlparse.py
++++ b/Lib/test/test_urlparse.py
+@@ -665,6 +665,24 @@ class UrlParseTestCase(unittest.TestCase):
+                         with self.assertRaises(ValueError):
+                             p.port
+ 
++    def test_attributes_bad_scheme(self):
++        """Check handling of invalid schemes."""
++        for bytes in (False, True):
++            for parse in (urllib.parse.urlsplit, urllib.parse.urlparse):
++                for scheme in (".", "+", "-", "0", "http&", "६http"):
++                    with self.subTest(bytes=bytes, parse=parse, scheme=scheme):
++                        url = scheme + "://www.example.net"
++                        if bytes:
++                            if url.isascii():
++                                url = url.encode("ascii")
++                            else:
++                                continue
++                        p = parse(url)
++                        if bytes:
++                            self.assertEqual(p.scheme, b"")
++                        else:
++                            self.assertEqual(p.scheme, "")
++
+     def test_attributes_without_netloc(self):
+         # This example is straight from RFC 3261.  It looks like it
+         # should allow the username, hostname, and port to be filled
+diff --git a/Lib/urllib/parse.py b/Lib/urllib/parse.py
+index b7965fe..bd59852 100644
+--- a/Lib/urllib/parse.py
++++ b/Lib/urllib/parse.py
+@@ -470,7 +470,7 @@ def urlsplit(url, scheme='', allow_fragments=True):
+         clear_cache()
+     netloc = query = fragment = ''
+     i = url.find(':')
+-    if i > 0:
++    if i > 0 and url0.isascii() and url0.isalpha():
+         for c in url:i:
+             if c not in scheme_chars:
+                 break
+diff --git a/Misc/NEWS.d/next/Library/2022-11-12-15-45-51.gh-issue-99418.FxfAXS.rst b/Misc/NEWS.d/next/Library/2022-11-12-15-45-51.gh-issue-99418.FxfAXS.rst
+new file mode 100644
+index 0000000..0a06e7c
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2022-11-12-15-45-51.gh-issue-99418.FxfAXS.rst
+@@ -0,0 +1,2 @@
++Fix bug in :func:`urllib.parse.urlparse` that causes URL schemes that begin
++with a digit, a plus sign, or a minus sign to be parsed incorrectly.
+-- 
+2.33.0
+

_service:tar_scm:backport-bpo-46811-Make-test-suite-support-Expat-2.4.5.patch Deleted

@@ -1,104 +0,0 @@
-From 7da97f61816f3cadaa6788804b22a2434b40e8c5 Mon Sep 17 00:00:00 2001
-From: "Miss Islington (bot)"
- <31488909+miss-islington@users.noreply.github.com>
-Date: Mon, 21 Feb 2022 08:16:09 -0800
-Subject: PATCH bpo-46811: Make test suite support Expat >=2.4.5 (GH-31453)
- (GH-31472)
-
-Curly brackets were never allowed in namespace URIs
-according to RFC 3986, and so-called namespace-validating
-XML parsers have the right to reject them a invalid URIs.
-
-libexpat >=2.4.5 has become strcter in that regard due to
-related security issues; with ET.XML instantiating a
-namespace-aware parser under the hood, this test has no
-future in CPython.
-
-References:
-- https://datatracker.ietf.org/doc/html/rfc3968
-- https://www.w3.org/TR/xml-names/
-
-Also, test_minidom.py: Support Expat >=2.4.5
-(cherry picked from commit 2cae93832f46b245847bdc252456ddf7742ef45e)
-
-Co-authored-by: Sebastian Pipping <sebastian@pipping.org>
----
- Lib/test/test_minidom.py                                | 17 +++++++++++++++--
- Lib/test/test_xml_etree.py                              |  6 ------
- .../Library/2022-02-20-21-03-31.bpo-46811.8BxgdQ.rst    |  1 +
- 3 files changed, 16 insertions(+), 8 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Library/2022-02-20-21-03-31.bpo-46811.8BxgdQ.rst
-
-diff --git a/Lib/test/test_minidom.py b/Lib/test/test_minidom.py
-index 1663b1f..9762025 100644
---- a/Lib/test/test_minidom.py
-+++ b/Lib/test/test_minidom.py
-@@ -6,10 +6,12 @@ import io
- from test import support
- import unittest
- 
-+import pyexpat
- import xml.dom.minidom
- 
- from xml.dom.minidom import parse, Node, Document, parseString
- from xml.dom.minidom import getDOMImplementation
-+from xml.parsers.expat import ExpatError
- 
- 
- tstfile = support.findfile("test.xml", subdir="xmltestdata")
-@@ -1147,7 +1149,13 @@ class MinidomTest(unittest.TestCase):
- 
-         # Verify that character decoding errors raise exceptions instead
-         # of crashing
--        self.assertRaises(UnicodeDecodeError, parseString,
-+        if pyexpat.version_info >= (2, 4, 5):
-+            self.assertRaises(ExpatError, parseString,
-+                    b'<fran\xe7ais></fran\xe7ais>')
-+            self.assertRaises(ExpatError, parseString,
-+                    b'<franais>Comment \xe7a va ? Tr\xe8s bien ?</franais>')
-+        else:
-+            self.assertRaises(UnicodeDecodeError, parseString,
-                 b'<fran\xe7ais>Comment \xe7a va ? Tr\xe8s bien ?</fran\xe7ais>')
- 
-         doc.unlink()
-@@ -1609,7 +1617,12 @@ class MinidomTest(unittest.TestCase):
-         self.confirm(doc2.namespaceURI == xml.dom.EMPTY_NAMESPACE)
- 
-     def testExceptionOnSpacesInXMLNSValue(self):
--        with self.assertRaisesRegex(ValueError, 'Unsupported syntax'):
-+        if pyexpat.version_info >= (2, 4, 5):
-+            context = self.assertRaisesRegex(ExpatError, 'syntax error')
-+        else:
-+            context = self.assertRaisesRegex(ValueError, 'Unsupported syntax')
-+
-+        with context:
-             parseString('<element xmlns:abc="http:abc.com/de f g/hi/j k"><abc:foo /></element>')
- 
-     def testDocRemoveChild(self):
-diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py
-index 285559a..4bd4291 100644
---- a/Lib/test/test_xml_etree.py
-+++ b/Lib/test/test_xml_etree.py
-@@ -2183,12 +2183,6 @@ class BugsTest(unittest.TestCase):
-                 b"<?xml version='1.0' encoding='ascii'?>\n"
-                 b'<body>t&#227;g</body>')
- 
--    def test_issue3151(self):
--        e = ET.XML('<prefix:localname xmlns:prefix="${stuff}"/>')
--        self.assertEqual(e.tag, '{${stuff}}localname')
--        t = ET.ElementTree(e)
--        self.assertEqual(ET.tostring(e), b'<ns0:localname xmlns:ns0="${stuff}" />')
--
-     def test_issue6565(self):
-         elem = ET.XML("<body><tag/></body>")
-         self.assertEqual(summarize_list(elem), 'tag')
-diff --git a/Misc/NEWS.d/next/Library/2022-02-20-21-03-31.bpo-46811.8BxgdQ.rst b/Misc/NEWS.d/next/Library/2022-02-20-21-03-31.bpo-46811.8BxgdQ.rst
-new file mode 100644
-index 0000000..6969bd1
---- /dev/null
-+++ b/Misc/NEWS.d/next/Library/2022-02-20-21-03-31.bpo-46811.8BxgdQ.rst
-@@ -0,0 +1 @@
-+Make test suite support Expat >=2.4.5
--- 
-1.8.3.1
-

_service:tar_scm:fix-CVE-2023-24329.patch Added

@@ -0,0 +1,44 @@
+From 1bad5b2ebc2f3cb663ce425b9979b4ec4dce27b2 Mon Sep 17 00:00:00 2001
+From: shixuantong <shixuantong1@huawei.com>
+Date: Thu, 6 Apr 2023 03:30:44 +0000
+Subject: PATCH fix CVE-2023-24329
+
+---
+ Lib/test/test_urlparse.py | 7 +++++++
+ Lib/urllib/parse.py       | 2 +-
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/Lib/test/test_urlparse.py b/Lib/test/test_urlparse.py
+index f42ed9b..b310017 100644
+--- a/Lib/test/test_urlparse.py
++++ b/Lib/test/test_urlparse.py
+@@ -683,6 +683,13 @@ class UrlParseTestCase(unittest.TestCase):
+                         else:
+                             self.assertEqual(p.scheme, "")
+ 
++    def test_attributes_bad_scheme_CVE_2023_24329(self):
++        """Check handling of invalid schemes that starts with blank characters."""
++        for parse in (urllib.parse.urlsplit, urllib.parse.urlparse):
++            url = " https://www.example.net"
++            p = parse(url)
++            self.assertEqual(p.scheme, "https")
++
+     def test_attributes_without_netloc(self):
+         # This example is straight from RFC 3261.  It looks like it
+         # should allow the username, hostname, and port to be filled
+diff --git a/Lib/urllib/parse.py b/Lib/urllib/parse.py
+index bd59852..7eb3ad8 100644
+--- a/Lib/urllib/parse.py
++++ b/Lib/urllib/parse.py
+@@ -454,7 +454,7 @@ def urlsplit(url, scheme='', allow_fragments=True):
+ 
+     Note that % escapes are not expanded.
+     """
+-
++    url = url.lstrip()
+     url, scheme, _coerce_result = _coerce_args(url, scheme)
+ 
+     for b in _UNSAFE_URL_BYTES_TO_REMOVE:
+-- 
+2.33.0
+

_service Changed

_service:tar_scm:Python-3.10.2.tar.xz -> _service:tar_scm:Python-3.10.9.tar.xz Changed