pool/python-Jinja2
SHA256
4
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- update to 3.1.4 (bsc#1223980, CVE-2024-34064):

Browse Source 
* The xmlattr filter does not allow keys with / solidus, >
    greater-than sign, or = equals sign, in addition to disallowing
    spaces. Regardless of any validation done by Jinja, user input
    should never be used as keys to this filter, or must be separately
    validated first.

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-Jinja2?expand=0&rev=110
This commit is contained in:
Dirk Mueller 2024-05-06 18:11:54 +00:00 committed by Git OBS Bridge
parent b48e3e3f2d
commit 3e785a3c5f
4 changed files with 24 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Jinja2-3.1.3.tar.gz
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:ac8bd6544d4bb2c9792bf3a159e80bba8fda7f07e81bc3aed565432d5925ba90
size 268261

BIN
jinja2-3.1.4.tar.gz (Stored with Git LFS) Normal file
View File

Binary file not shown.

10
python-Jinja2.changes
View File

@ -1,3 +1,13 @@
-------------------------------------------------------------------
Mon May 6 18:10:40 UTC 2024 - Dirk Müller <dmueller@suse.com>
- update to 3.1.4 (bsc#1223980, CVE-2024-34064):
* The xmlattr filter does not allow keys with / solidus, >
greater-than sign, or = equals sign, in addition to disallowing
spaces. Regardless of any validation done by Jinja, user input
should never be used as keys to this filter, or must be separately
validated first.
------------------------------------------------------------------- -------------------------------------------------------------------
Mon Jan 29 10:10:29 UTC 2024 - Daniel Garcia <daniel.garcia@suse.com> Mon Jan 29 10:10:29 UTC 2024 - Daniel Garcia <daniel.garcia@suse.com>

22
python-Jinja2.spec
View File

@ -16,7 +16,6 @@
# #
%define skip_python2 1
%ifarch %{ix86} armv7l %ifarch %{ix86} armv7l
%bcond_with test %bcond_with test
%else %else
@ -24,16 +23,18 @@
%endif %endif
%{?sle15_python_module_pythons} %{?sle15_python_module_pythons}
Name: python-Jinja2 Name: python-Jinja2
Version: 3.1.3 Version: 3.1.4
Release: 0 Release: 0
Summary: A template engine written in pure Python Summary: A template engine written in pure Python
License: BSD-3-Clause License: BSD-3-Clause
URL: https://jinja.palletsprojects.com URL: https://jinja.palletsprojects.com
Source: https://files.pythonhosted.org/packages/source/J/Jinja2/Jinja2-%{version}.tar.gz Source: https://files.pythonhosted.org/packages/source/J/Jinja2/jinja2-%{version}.tar.gz
BuildRequires: %{python_module MarkupSafe >= 0.23} BuildRequires: %{python_module MarkupSafe >= 0.23}
BuildRequires: %{python_module base >= 3.7} BuildRequires: %{python_module base >= 3.7}
BuildRequires: %{python_module flit-core}
BuildRequires: %{python_module pip}
BuildRequires: %{python_module pytest} BuildRequires: %{python_module pytest}
BuildRequires: %{python_module setuptools} BuildRequires: %{python_module wheel}
BuildRequires: dos2unix BuildRequires: dos2unix
BuildRequires: fdupes BuildRequires: fdupes
BuildRequires: python-rpm-macros BuildRequires: python-rpm-macros
@ -51,14 +52,13 @@ inspired non-XML syntax but supports inline expressions and an optional
sandboxed environment. sandboxed environment.
%prep %prep
%setup -q -n Jinja2-%{version} %setup -q -n jinja2-%{version}
dos2unix LICENSE.rst # Fix wrong EOL encoding
%build %build
%python_build %pyproject_wheel
%install %install
%python_install %pyproject_install
%python_expand %fdupes %{buildroot}%{$python_sitelib} %python_expand %fdupes %{buildroot}%{$python_sitelib}
%check %check
@ -70,9 +70,9 @@ donttest="test_striptags"
%endif %endif
%files %{python_files} %files %{python_files}
%license LICENSE.rst %license LICENSE.txt
%doc README.rst CHANGES.rst artwork examples %doc README.md docs/changes.rst docs/examples
%{python_sitelib}/jinja2 %{python_sitelib}/jinja2
%{python_sitelib}/Jinja2-%{version}-py%{python_version}.egg-info %{python_sitelib}/jinja2-%{version}.dist-info
%changelog %changelog