adamm/python311
SHA256
1
0
Fork 0
Code Pull Requests Activity

- Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it

Browse Source 
uses features sniffing, not just comparing version
  number. Include also support-expat-CVE-2022-25236-patched.patch.
- Refresh patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - fix_configure_rst.patch
  - skip_if_buildbot-extend.patch
- Remove included patch:
  - support-expat-CVE-2022-25236-patched.patch

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=123
This commit is contained in:
Matej Cepl 2024-05-01 09:01:36 +00:00 committed by Git OBS Bridge
parent 37ecd27cc8
commit e54275a76b
7 changed files with 135 additions and 175 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
CVE-2023-27043-email-parsing-errors.patch
View File

@ -5,10 +5,8 @@
Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst | 8
4 files changed, 344 insertions(+), 21 deletions(-)
Index: Python-3.11.8/Doc/library/email.utils.rst
===================================================================
--- Python-3.11.8.orig/Doc/library/email.utils.rst
+++ Python-3.11.8/Doc/library/email.utils.rst
--- a/Doc/library/email.utils.rst
+++ b/Doc/library/email.utils.rst
@@ -60,13 +60,18 @@ of the new API.
begins with angle brackets, they are stripped off.
@ -58,10 +56,8 @@ Index: Python-3.11.8/Doc/library/email.utils.rst
.. function:: parsedate(date)
Index: Python-3.11.8/Lib/email/utils.py
===================================================================
--- Python-3.11.8.orig/Lib/email/utils.py
+++ Python-3.11.8/Lib/email/utils.py
--- a/Lib/email/utils.py
+++ b/Lib/email/utils.py
@@ -48,6 +48,7 @@ TICK = "'"
specialsre = re.compile(r'[][\\()<>@,:;".]')
escapesre = re.compile(r'[\\"]')
@ -241,10 +237,8 @@ Index: Python-3.11.8/Lib/email/utils.py
return addrs[0]
Index: Python-3.11.8/Lib/test/test_email/test_email.py
===================================================================
--- Python-3.11.8.orig/Lib/test/test_email/test_email.py
+++ Python-3.11.8/Lib/test/test_email/test_email.py
--- a/Lib/test/test_email/test_email.py
+++ b/Lib/test/test_email/test_email.py
@@ -17,6 +17,7 @@ from unittest.mock import patch
import email
@ -253,7 +247,7 @@ Index: Python-3.11.8/Lib/test/test_email/test_email.py
from email.charset import Charset
from email.generator import Generator, DecodedGenerator, BytesGenerator
@@ -3321,15 +3322,137 @@ Foo
@@ -3336,15 +3337,137 @@ Foo
[('Al Person', 'aperson@dom.ain'),
('Bud Person', 'bperson@dom.ain')])
@ -399,7 +393,7 @@ Index: Python-3.11.8/Lib/test/test_email/test_email.py
def test_getaddresses_embedded_comment(self):
"""Test proper handling of a nested comment"""
@@ -3520,6 +3643,54 @@ multipart/report
@@ -3535,6 +3658,54 @@ multipart/report
m = cls(*constructor, policy=email.policy.default)
self.assertIs(m.policy, email.policy.default)
@ -454,10 +448,8 @@ Index: Python-3.11.8/Lib/test/test_email/test_email.py
# Test the iterator/generators
class TestIterators(TestEmailBase):
Index: Python-3.11.8/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst
===================================================================
--- /dev/null
+++ Python-3.11.8/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst
+++ b/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst
@@ -0,0 +1,8 @@
+:func:`email.utils.getaddresses` and :func:`email.utils.parseaddr` now
+return ``('', '')`` 2-tuples in more situations where invalid email

164
CVE-2023-52425-libexpat-2.6.0-backport.patch
View File

@ -1,9 +1,10 @@
---
Lib/test/support/__init__.py | 9 ++++++++-
Lib/test/test_pyexpat.py | 8 ++++----
Lib/test/support/__init__.py | 16 ++++++++++++++--
Lib/test/test_minidom.py | 23 +++++++++--------------
Lib/test/test_pyexpat.py | 14 +++++++-------
Lib/test/test_sax.py | 18 +++++++++---------
Lib/test/test_xml_etree.py | 12 +++++-------
4 files changed, 26 insertions(+), 21 deletions(-)
Lib/test/test_xml_etree.py | 12 ------------
5 files changed, 39 insertions(+), 44 deletions(-)
--- a/Lib/test/support/__init__.py
+++ b/Lib/test/support/__init__.py
@ -20,20 +21,75 @@
"ALWAYS_EQ", "NEVER_EQ", "LARGEST", "SMALLEST",
"LOOPBACK_TIMEOUT", "INTERNET_TIMEOUT", "SHORT_TIMEOUT", "LONG_TIMEOUT",
- "skip_on_s390x",
+ "skip_on_s390x", "fails_with_expat_2_6_0"
+ "skip_on_s390x", "fails_with_expat_2_6_0", "is_expat_2_6_0"
]
@@ -2243,3 +2244,9 @@ def copy_python_src_ignore(path, names):
#Windows doesn't have os.uname() but it doesn't support s390x.
@@ -2240,6 +2241,17 @@ def copy_python_src_ignore(path, names):
}
return ignored
-#Windows doesn't have os.uname() but it doesn't support s390x.
+
+# Windows doesn't have os.uname() but it doesn't support s390x.
skip_on_s390x = unittest.skipIf(hasattr(os, 'uname') and os.uname().machine == 's390x',
'skipped on s390x')
+
+
+_null_pyexpat_parser=pyexpat.ParserCreate()
+@functools.lru_cache
+def _is_expat_2_6_0():
+ return hasattr(pyexpat.ParserCreate(), 'GetReparseDeferralEnabled')
+is_expat_2_6_0 = _is_expat_2_6_0()
+
+fails_with_expat_2_6_0 = (unittest.expectedFailure
+ if hasattr(_null_pyexpat_parser, 'GetReparseDeferralEnabled') else
+ lambda test: test)
+ if is_expat_2_6_0
+ else lambda test: test)
--- a/Lib/test/test_minidom.py
+++ b/Lib/test/test_minidom.py
@@ -6,7 +6,6 @@ import io
from test import support
import unittest
-import pyexpat
import xml.dom.minidom
from xml.dom.minidom import parse, Attr, Node, Document, parseString
@@ -1163,13 +1162,11 @@ class MinidomTest(unittest.TestCase):
# Verify that character decoding errors raise exceptions instead
# of crashing
- if pyexpat.version_info >= (2, 4, 5):
- self.assertRaises(ExpatError, parseString,
- b'<fran\xe7ais></fran\xe7ais>')
- self.assertRaises(ExpatError, parseString,
- b'<franais>Comment \xe7a va ? Tr\xe8s bien ?</franais>')
- else:
- self.assertRaises(UnicodeDecodeError, parseString,
+ # It doesn’t make any sense to insist on the exact text of the
+ # error message, or even the exact Exception … it is enough that
+ # the error has been discovered.
+ with self.assertRaises((UnicodeDecodeError, ExpatError)):
+ parseString(
b'<fran\xe7ais>Comment \xe7a va ? Tr\xe8s bien ?</fran\xe7ais>')
doc.unlink()
@@ -1631,12 +1628,10 @@ class MinidomTest(unittest.TestCase):
self.confirm(doc2.namespaceURI == xml.dom.EMPTY_NAMESPACE)
def testExceptionOnSpacesInXMLNSValue(self):
- if pyexpat.version_info >= (2, 4, 5):
- context = self.assertRaisesRegex(ExpatError, 'syntax error')
- else:
- context = self.assertRaisesRegex(ValueError, 'Unsupported syntax')
-
- with context:
+ # It doesn’t make any sense to insist on the exact text of the
+ # error message, or even the exact Exception … it is enough that
+ # the error has been discovered.
+ with self.assertRaises((ExpatError, ValueError)):
parseString('<element xmlns:abc="http:abc.com/de f g/hi/j k"><abc:foo /></element>')
def testDocRemoveChild(self):
--- a/Lib/test/test_pyexpat.py
+++ b/Lib/test/test_pyexpat.py
@@ -14,8 +14,7 @@ from test.support import os_helper
@ -42,23 +98,30 @@
-from test.support import sortdict, is_emscripten, is_wasi
-
+from test.support import sortdict, is_emscripten, is_wasi, fails_with_expat_2_6_0
+from test.support import sortdict, is_emscripten, is_wasi, is_expat_2_6_0
class SetAttributeTest(unittest.TestCase):
def setUp(self):
@@ -793,6 +792,7 @@ class ReparseDeferralTest(unittest.TestC
@@ -770,9 +769,8 @@ class ReparseDeferralTest(unittest.TestC
self.assertIs(parser.GetReparseDeferralEnabled(), enabled)
self.assertEqual(started, ['doc'])
def test_reparse_deferral_enabled(self):
- if expat.version_info < (2, 6, 0):
- self.skipTest(f'Expat {expat.version_info} does not '
- 'support reparse deferral')
+ if not is_expat_2_6_0:
+ self.skipTest("Linked libexpat doesn't support reparse deferral")
+ @fails_with_expat_2_6_0
def test_reparse_deferral_disabled(self):
started = []
@@ -800,9 +800,9 @@ class ReparseDeferralTest(unittest.TestC
@@ -799,10 +797,12 @@ class ReparseDeferralTest(unittest.TestC
def start_element(name, _):
started.append(name)
+ if not is_expat_2_6_0:
+ self.skipTest("Linked libexpat doesn't support reparse deferral")
+
parser = expat.ParserCreate()
+ self.assertTrue(hasattr(parser, 'GetReparseDeferralEnabled'))
parser.StartElementHandler = start_element
- if expat.version_info >= (2, 6, 0):
- parser.SetReparseDeferralEnabled(False)
@ -79,47 +142,41 @@
import urllib.request
-from test.support import os_helper
-from test.support import findfile
+from test.support import os_helper, findfile, fails_with_expat_2_6_0
+from test.support import os_helper, findfile, is_expat_2_6_0
from test.support.os_helper import FakePath, TESTFN
@@ -1215,9 +1213,7 @@ class ExpatReaderTest(XmlTestBase):
@@ -1215,10 +1213,10 @@ class ExpatReaderTest(XmlTestBase):
self.assertEqual(result.getvalue(), start + b"<doc>text</doc>")
- @unittest.skipIf(pyexpat.version_info < (2, 6, 0),
- f'Expat {pyexpat.version_info} does not '
- 'support reparse deferral')
+ @fails_with_expat_2_6_0
def test_flush_reparse_deferral_enabled(self):
+ if not is_expat_2_6_0:
+ self.skipTest("Linked libexpat doesn't support reparse deferral")
+
result = BytesIO()
xmlgen = XMLGenerator(result)
@@ -1227,6 +1223,8 @@ class ExpatReaderTest(XmlTestBase):
for chunk in ("<doc", ">"):
parser.feed(chunk)
+ self.assertTrue(hasattr(parser._parser, 'GetReparseDeferralEnabled'))
+
self.assertEqual(result.getvalue(), start) # i.e. no elements started
self.assertTrue(parser._parser.GetReparseDeferralEnabled())
@@ -1240,6 +1238,7 @@ class ExpatReaderTest(XmlTestBase):
parser = create_parser()
@@ -1241,6 +1239,9 @@ class ExpatReaderTest(XmlTestBase):
self.assertEqual(result.getvalue(), start + b"<doc></doc>")
+ @fails_with_expat_2_6_0
def test_flush_reparse_deferral_disabled(self):
+ if not is_expat_2_6_0:
+ self.skipTest("Linked libexpat doesn't support reparse deferral")
+
result = BytesIO()
xmlgen = XMLGenerator(result)
@@ -1249,9 +1248,10 @@ class ExpatReaderTest(XmlTestBase):
parser = create_parser()
@@ -1249,9 +1250,8 @@ class ExpatReaderTest(XmlTestBase):
for chunk in ("<doc", ">"):
parser.feed(chunk)
- if pyexpat.version_info >= (2, 6, 0):
- parser._parser.SetReparseDeferralEnabled(False)
- self.assertEqual(result.getvalue(), start) # i.e. no elements started
+ self.assertTrue(hasattr(parser._parser, 'SetReparseDeferralEnabled'))
+
+ parser._parser.SetReparseDeferralEnabled(False)
+ self.assertEqual(result.getvalue(), start) # i.e. no elements started
@ -135,45 +192,30 @@
import sys
import textwrap
import types
@@ -26,7 +25,7 @@ from itertools import product, islice
from test import support
from test.support import os_helper
from test.support import warnings_helper
-from test.support import findfile, gc_collect, swap_attr, swap_item
+from test.support import findfile, gc_collect, swap_attr, swap_item, fails_with_expat_2_6_0
from test.support.import_helper import import_fresh_module
from test.support.os_helper import TESTFN
@@ -1424,9 +1423,11 @@ class XMLPullParserTest(unittest.TestCas
@@ -1424,12 +1423,6 @@ class XMLPullParserTest(unittest.TestCas
self.assert_event_tags(parser, [('end', 'root')])
self.assertIsNone(parser.close())
+ @fails_with_expat_2_6_0
def test_simple_xml_chunk_1(self):
self.test_simple_xml(chunk_size=1, flush=True)
- def test_simple_xml_chunk_1(self):
- self.test_simple_xml(chunk_size=1, flush=True)
-
- def test_simple_xml_chunk_5(self):
- self.test_simple_xml(chunk_size=5, flush=True)
-
def test_simple_xml_chunk_22(self):
self.test_simple_xml(chunk_size=22)
+ @fails_with_expat_2_6_0
def test_simple_xml_chunk_5(self):
self.test_simple_xml(chunk_size=5, flush=True)
@@ -1627,9 +1628,7 @@ class XMLPullParserTest(unittest.TestCas
@@ -1627,9 +1620,6 @@ class XMLPullParserTest(unittest.TestCas
with self.assertRaises(ValueError):
ET.XMLPullParser(events=('start', 'end', 'bogus'))
- @unittest.skipIf(pyexpat.version_info < (2, 6, 0),
- f'Expat {pyexpat.version_info} does not '
- 'support reparse deferral')
+ @fails_with_expat_2_6_0
def test_flush_reparse_deferral_enabled(self):
parser = ET.XMLPullParser(events=('start', 'end'))
@@ -1651,13 +1650,12 @@ class XMLPullParserTest(unittest.TestCas
self.assert_event_tags(parser, [('end', 'doc')])
+ @fails_with_expat_2_6_0
def test_flush_reparse_deferral_disabled(self):
parser = ET.XMLPullParser(events=('start', 'end'))
@@ -1656,8 +1646,6 @@ class XMLPullParserTest(unittest.TestCas
for chunk in ("<doc", ">"):
parser.feed(chunk)

18
fix_configure_rst.patch
View File

@ -3,11 +3,9 @@
Misc/NEWS | 2 +-
2 files changed, 1 insertion(+), 4 deletions(-)
Index: Python-3.11.8/Doc/using/configure.rst
===================================================================
--- Python-3.11.8.orig/Doc/using/configure.rst
+++ Python-3.11.8/Doc/using/configure.rst
@@ -41,7 +41,6 @@ General Options
--- a/Doc/using/configure.rst
+++ b/Doc/using/configure.rst
@@ -43,7 +43,6 @@ General Options
See :data:`sys.int_info.bits_per_digit <sys.int_info>`.
@ -15,7 +13,7 @@ Index: Python-3.11.8/Doc/using/configure.rst
.. option:: --with-cxx-main=COMPILER
Compile the Python ``main()`` function and link Python executable with C++
@@ -527,13 +526,11 @@ macOS Options
@@ -529,13 +528,11 @@ macOS Options
See ``Mac/README.rst``.
@ -29,11 +27,9 @@ Index: Python-3.11.8/Doc/using/configure.rst
.. option:: --enable-framework=INSTALLDIR
Create a Python.framework rather than a traditional Unix install. Optional
Index: Python-3.11.8/Misc/NEWS
===================================================================
--- Python-3.11.8.orig/Misc/NEWS
+++ Python-3.11.8/Misc/NEWS
@@ -9411,7 +9411,7 @@ C API
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -9768,7 +9768,7 @@ C API
- bpo-40939: Removed documentation for the removed ``PyParser_*`` C API.
- bpo-43795: The list in :ref:`limited-api-list` now shows the public name

13
python311.changes
View File

@ -1,3 +1,16 @@
-------------------------------------------------------------------
Wed May 1 08:39:08 UTC 2024 - Matej Cepl <mcepl@suse.com>
- Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it
uses features sniffing, not just comparing version
number. Include also support-expat-CVE-2022-25236-patched.patch.
- Refresh patches:
- CVE-2023-27043-email-parsing-errors.patch
- fix_configure_rst.patch
- skip_if_buildbot-extend.patch
- Remove included patch:
- support-expat-CVE-2022-25236-patched.patch
-------------------------------------------------------------------
Mon Apr 15 10:31:32 UTC 2024 - Daniel Garcia <daniel.garcia@suse.com>

4
python311.spec
View File

@ -155,9 +155,6 @@ Patch10: skip-test_pyobject_freed_is_freed.patch
# PATCH-FIX-SLE fix_configure_rst.patch bpo#43774 mcepl@suse.com
# remove duplicate link targets and make documentation with old Sphinx in SLE
Patch11: fix_configure_rst.patch
# PATCH-FIX-UPSTREAM support-expat-CVE-2022-25236-patched.patch jsc#SLE-21253 mcepl@suse.com
# Makes Python resilient to changes of API of libexpat
Patch12: support-expat-CVE-2022-25236-patched.patch
# PATCH-FIX-UPSTREAM skip_if_buildbot-extend.patch gh#python/cpython#103053 mcepl@suse.com
# Skip test_freeze_simple_script
Patch13: skip_if_buildbot-extend.patch
@ -429,7 +426,6 @@ other applications.
%patch -p1 -P 10
%patch -p1 -P 11
%patch -p1 -P 12
%patch -p1 -P 13
%patch -p1 -P 14
%patch -p1 -P 15

8
skip_if_buildbot-extend.patch
View File

@ -2,11 +2,9 @@
Lib/test/support/__init__.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Index: Python-3.11.8/Lib/test/support/__init__.py
===================================================================
--- Python-3.11.8.orig/Lib/test/support/__init__.py
+++ Python-3.11.8/Lib/test/support/__init__.py
@@ -383,7 +383,7 @@ def skip_if_buildbot(reason=None):
--- a/Lib/test/support/__init__.py
+++ b/Lib/test/support/__init__.py
@@ -384,7 +384,7 @@ def skip_if_buildbot(reason=None):
if not reason:
reason = 'not suitable for buildbots'
try:

77
support-expat-CVE-2022-25236-patched.patch
View File

@ -1,77 +0,0 @@
From 7da97f61816f3cadaa6788804b22a2434b40e8c5 Mon Sep 17 00:00:00 2001
From: "Miss Islington (bot)"
<31488909+miss-islington@users.noreply.github.com>
Date: Mon, 21 Feb 2022 08:16:09 -0800
Subject: [PATCH] bpo-46811: Make test suite support Expat >=2.4.5 (GH-31453)
(GH-31472)
Curly brackets were never allowed in namespace URIs
according to RFC 3986, and so-called namespace-validating
XML parsers have the right to reject them a invalid URIs.
libexpat >=2.4.5 has become strcter in that regard due to
related security issues; with ET.XML instantiating a
namespace-aware parser under the hood, this test has no
future in CPython.
References:
- https://datatracker.ietf.org/doc/html/rfc3968
- https://www.w3.org/TR/xml-names/
Also, test_minidom.py: Support Expat >=2.4.5
(cherry picked from commit 2cae93832f46b245847bdc252456ddf7742ef45e)
Co-authored-by: Sebastian Pipping <sebastian@pipping.org>
---
Lib/test/test_minidom.py | 23 +++++++++--------------
1 file changed, 9 insertions(+), 14 deletions(-)
create mode 100644 Misc/NEWS.d/next/Library/2022-02-20-21-03-31.bpo-46811.8BxgdQ.rst
Index: Python-3.11.8/Lib/test/test_minidom.py
===================================================================
--- Python-3.11.8.orig/Lib/test/test_minidom.py
+++ Python-3.11.8/Lib/test/test_minidom.py
@@ -6,7 +6,6 @@ import io
from test import support
import unittest
-import pyexpat
import xml.dom.minidom
from xml.dom.minidom import parse, Attr, Node, Document, parseString
@@ -1163,13 +1162,11 @@ class MinidomTest(unittest.TestCase):
# Verify that character decoding errors raise exceptions instead
# of crashing
- if pyexpat.version_info >= (2, 4, 5):
- self.assertRaises(ExpatError, parseString,
- b'<fran\xe7ais></fran\xe7ais>')
- self.assertRaises(ExpatError, parseString,
- b'<franais>Comment \xe7a va ? Tr\xe8s bien ?</franais>')
- else:
- self.assertRaises(UnicodeDecodeError, parseString,
+ # It doesn’t make any sense to insist on the exact text of the
+ # error message, or even the exact Exception … it is enough that
+ # the error has been discovered.
+ with self.assertRaises((UnicodeDecodeError, ExpatError)):
+ parseString(
b'<fran\xe7ais>Comment \xe7a va ? Tr\xe8s bien ?</fran\xe7ais>')
doc.unlink()
@@ -1631,12 +1628,10 @@ class MinidomTest(unittest.TestCase):
self.confirm(doc2.namespaceURI == xml.dom.EMPTY_NAMESPACE)
def testExceptionOnSpacesInXMLNSValue(self):
- if pyexpat.version_info >= (2, 4, 5):
- context = self.assertRaisesRegex(ExpatError, 'syntax error')
- else:
- context = self.assertRaisesRegex(ValueError, 'Unsupported syntax')
-
- with context:
+ # It doesn’t make any sense to insist on the exact text of the
+ # error message, or even the exact Exception … it is enough that
+ # the error has been discovered.
+ with self.assertRaises((ExpatError, ValueError)):
parseString('<element xmlns:abc="http:abc.com/de f g/hi/j k"><abc:foo /></element>')
def testDocRemoveChild(self):