Accepting request 1220124 from devel:languages:python:Factory
- Update CVE-2024-9287-venv_path_unquoted.patch according to the upstream PR gh#python/cpython!126301. OBS-URL: https://build.opensuse.org/request/show/1220124 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python310?expand=0&rev=51
This commit is contained in:
Dominique Leuenberger
Git OBS Bridge
commit
c683cd8edc
@ -1,32 +1,31 @@
|
||||
From b6a3bbd155c558cdcda482629073e492437db3d0 Mon Sep 17 00:00:00 2001
|
||||
From: y5c4l3 <y5c4l3@proton.me>
|
||||
Date: Sat, 28 Sep 2024 02:09:07 +0800
|
||||
Subject: [PATCH] Quote template strings in `venv` activation scripts
|
||||
From 21139b45039a72e8346bdc32d498345ef174ba92 Mon Sep 17 00:00:00 2001
|
||||
From: Victor Stinner <vstinner@python.org>
|
||||
Date: Fri, 1 Nov 2024 14:11:47 +0100
|
||||
Subject: [PATCH] [3.11] gh-124651: Quote template strings in `venv` activation
|
||||
scripts (GH-124712) (GH-126185) (#126269)
|
||||
|
||||
This patch properly quotes template strings in `venv` activation
|
||||
scripts. This mitigates potential command injection.
|
||||
|
||||
Signed-off-by: y5c4l3 <y5c4l3@proton.me>
|
||||
(cherry picked from commit ae961ae94bf19c8f8c7fbea3d1c25cc55ce8ae97)
|
||||
---
|
||||
Lib/test/test_venv.py | 81 ++++++++++
|
||||
Lib/venv/__init__.py | 42 ++++-
|
||||
Lib/venv/scripts/common/activate | 6
|
||||
Lib/venv/scripts/common/activate | 8
|
||||
Lib/venv/scripts/nt/activate.bat | 6
|
||||
Lib/venv/scripts/posix/activate.csh | 6
|
||||
Lib/venv/scripts/posix/activate.csh | 8
|
||||
Lib/venv/scripts/posix/activate.fish | 8
|
||||
Misc/NEWS.d/next/Library/2024-09-28-02-03-04.gh-issue-124651.bLBGtH.rst | 1
|
||||
6 files changed, 128 insertions(+), 14 deletions(-)
|
||||
7 files changed, 134 insertions(+), 20 deletions(-)
|
||||
create mode 100644 Misc/NEWS.d/next/Library/2024-09-28-02-03-04.gh-issue-124651.bLBGtH.rst
|
||||
|
||||
--- a/Lib/test/test_venv.py
|
||||
+++ b/Lib/test/test_venv.py
|
||||
@@ -10,6 +10,7 @@ import ensurepip
|
||||
import os
|
||||
import os.path
|
||||
import re
|
||||
+import shlex
|
||||
import shutil
|
||||
import struct
|
||||
@@ -15,6 +15,7 @@ import struct
|
||||
import subprocess
|
||||
import sys
|
||||
import tempfile
|
||||
+import shlex
|
||||
from test.support import (captured_stdout, captured_stderr, requires_zlib,
|
||||
skip_if_broken_multiprocessing_synchronize)
|
||||
from test.support.os_helper import (can_symlink, EnvironmentVarGuard, rmtree)
|
||||
@@ -85,6 +86,10 @@ class BaseTest(unittest.TestCase):
|
||||
result = f.read()
|
||||
return result
|
||||
@ -178,14 +177,14 @@ Signed-off-by: y5c4l3 <y5c4l3@proton.me>
|
||||
return text
|
||||
|
||||
def install_scripts(self, context, path):
|
||||
@@ -409,6 +440,7 @@ class EnvBuilder:
|
||||
@@ -408,6 +439,7 @@ class EnvBuilder:
|
||||
with open(srcfile, 'rb') as f:
|
||||
data = f.read()
|
||||
if not srcfile.endswith(('.exe', '.pdb')):
|
||||
try:
|
||||
+ context.script_path = srcfile
|
||||
try:
|
||||
data = data.decode('utf-8')
|
||||
data = self.replace_variables(data, context)
|
||||
data = data.encode('utf-8')
|
||||
--- a/Lib/venv/scripts/common/activate
|
||||
+++ b/Lib/venv/scripts/common/activate
|
||||
@@ -38,11 +38,11 @@ deactivate () {
|
||||
@ -202,15 +201,18 @@ Signed-off-by: y5c4l3 <y5c4l3@proton.me>
|
||||
export PATH
|
||||
|
||||
# unset PYTHONHOME if set
|
||||
@@ -55,7 +55,7 @@ fi
|
||||
@@ -55,9 +55,9 @@ fi
|
||||
|
||||
if [ -z "${VIRTUAL_ENV_DISABLE_PROMPT:-}" ] ; then
|
||||
_OLD_VIRTUAL_PS1="${PS1:-}"
|
||||
- PS1="__VENV_PROMPT__${PS1:-}"
|
||||
+ PS1=__VENV_PROMPT__"${PS1:-}"
|
||||
export PS1
|
||||
VIRTUAL_ENV_PROMPT="__VENV_PROMPT__"
|
||||
- VIRTUAL_ENV_PROMPT="__VENV_PROMPT__"
|
||||
+ VIRTUAL_ENV_PROMPT=__VENV_PROMPT__
|
||||
export VIRTUAL_ENV_PROMPT
|
||||
fi
|
||||
|
||||
--- a/Lib/venv/scripts/nt/activate.bat
|
||||
+++ b/Lib/venv/scripts/nt/activate.bat
|
||||
@@ -8,7 +8,7 @@ if defined _OLD_CODEPAGE (
|
||||
@ -222,27 +224,20 @@ Signed-off-by: y5c4l3 <y5c4l3@proton.me>
|
||||
|
||||
if not defined PROMPT set PROMPT=$P$G
|
||||
|
||||
@@ -16,7 +16,7 @@ if defined _OLD_VIRTUAL_PROMPT set PROMP
|
||||
if defined _OLD_VIRTUAL_PYTHONHOME set PYTHONHOME=%_OLD_VIRTUAL_PYTHONHOME%
|
||||
|
||||
set _OLD_VIRTUAL_PROMPT=%PROMPT%
|
||||
-set PROMPT=__VENV_PROMPT__%PROMPT%
|
||||
+set "PROMPT=__VENV_PROMPT__%PROMPT%"
|
||||
|
||||
if defined PYTHONHOME set _OLD_VIRTUAL_PYTHONHOME=%PYTHONHOME%
|
||||
set PYTHONHOME=
|
||||
@@ -24,7 +24,7 @@ set PYTHONHOME=
|
||||
@@ -24,8 +24,8 @@ set PYTHONHOME=
|
||||
if defined _OLD_VIRTUAL_PATH set PATH=%_OLD_VIRTUAL_PATH%
|
||||
if not defined _OLD_VIRTUAL_PATH set _OLD_VIRTUAL_PATH=%PATH%
|
||||
|
||||
-set PATH=%VIRTUAL_ENV%\__VENV_BIN_NAME__;%PATH%
|
||||
-set VIRTUAL_ENV_PROMPT=__VENV_PROMPT__
|
||||
+set "PATH=%VIRTUAL_ENV%\__VENV_BIN_NAME__;%PATH%"
|
||||
set VIRTUAL_ENV_PROMPT=__VENV_PROMPT__
|
||||
+set "VIRTUAL_ENV_PROMPT=__VENV_PROMPT__"
|
||||
|
||||
:END
|
||||
if defined _OLD_CODEPAGE (
|
||||
--- a/Lib/venv/scripts/posix/activate.csh
|
||||
+++ b/Lib/venv/scripts/posix/activate.csh
|
||||
@@ -8,16 +8,16 @@ alias deactivate 'test $?_OLD_VIRTUAL_PA
|
||||
@@ -8,17 +8,17 @@ alias deactivate 'test $?_OLD_VIRTUAL_PA
|
||||
# Unset irrelevant variables.
|
||||
deactivate nondestructive
|
||||
|
||||
@ -258,10 +253,43 @@ Signed-off-by: y5c4l3 <y5c4l3@proton.me>
|
||||
|
||||
if (! "$?VIRTUAL_ENV_DISABLE_PROMPT") then
|
||||
- set prompt = "__VENV_PROMPT__$prompt"
|
||||
- setenv VIRTUAL_ENV_PROMPT "__VENV_PROMPT__"
|
||||
+ set prompt = __VENV_PROMPT__"$prompt"
|
||||
setenv VIRTUAL_ENV_PROMPT "__VENV_PROMPT__"
|
||||
+ setenv VIRTUAL_ENV_PROMPT __VENV_PROMPT__
|
||||
endif
|
||||
|
||||
alias pydoc python -m pydoc
|
||||
--- a/Lib/venv/scripts/posix/activate.fish
|
||||
+++ b/Lib/venv/scripts/posix/activate.fish
|
||||
@@ -33,10 +33,10 @@ end
|
||||
# Unset irrelevant variables.
|
||||
deactivate nondestructive
|
||||
|
||||
-set -gx VIRTUAL_ENV "__VENV_DIR__"
|
||||
+set -gx VIRTUAL_ENV __VENV_DIR__
|
||||
|
||||
set -gx _OLD_VIRTUAL_PATH $PATH
|
||||
-set -gx PATH "$VIRTUAL_ENV/__VENV_BIN_NAME__" $PATH
|
||||
+set -gx PATH "$VIRTUAL_ENV/"__VENV_BIN_NAME__ $PATH
|
||||
|
||||
# Unset PYTHONHOME if set.
|
||||
if set -q PYTHONHOME
|
||||
@@ -56,7 +56,7 @@ if test -z "$VIRTUAL_ENV_DISABLE_PROMPT"
|
||||
set -l old_status $status
|
||||
|
||||
# Output the venv prompt; color taken from the blue of the Python logo.
|
||||
- printf "%s%s%s" (set_color 4B8BBE) "__VENV_PROMPT__" (set_color normal)
|
||||
+ printf "%s%s%s" (set_color 4B8BBE) __VENV_PROMPT__ (set_color normal)
|
||||
|
||||
# Restore the return status of the previous command.
|
||||
echo "exit $old_status" | .
|
||||
@@ -65,5 +65,5 @@ if test -z "$VIRTUAL_ENV_DISABLE_PROMPT"
|
||||
end
|
||||
|
||||
set -gx _OLD_FISH_PROMPT_OVERRIDE "$VIRTUAL_ENV"
|
||||
- set -gx VIRTUAL_ENV_PROMPT "__VENV_PROMPT__"
|
||||
+ set -gx VIRTUAL_ENV_PROMPT __VENV_PROMPT__
|
||||
end
|
||||
--- /dev/null
|
||||
+++ b/Misc/NEWS.d/next/Library/2024-09-28-02-03-04.gh-issue-124651.bLBGtH.rst
|
||||
@@ -0,0 +1 @@
|
||||
|
||||
@ -1,3 +1,9 @@
|
||||
-------------------------------------------------------------------
|
||||
Fri Nov 1 21:38:45 UTC 2024 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
- Update CVE-2024-9287-venv_path_unquoted.patch according to the
|
||||
upstream PR gh#python/cpython!126301.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Oct 24 16:09:00 UTC 2024 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user