- Add 99366-patch.dict-can-decorate-async.patch fixing

gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.

- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).

- Why in the world we download from HTTP?

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python38?expand=0&rev=128

99366-patch.dict-can-decorate-async.patch

@@ -0,0 +1,79 @@
+From c0dea0309b9a0a7cbc87727c9957f0a388fb9b0f Mon Sep 17 00:00:00 2001
+From: Nikita Sobolev <mail@sobolevn.me>
+Date: Fri, 11 Nov 2022 11:04:30 +0300
+Subject: [PATCH] gh-98086: Now ``patch.dict`` can decorate async functions
+ (GH-98095) (cherry picked from commit
+ 67b4d2772c5124b908f8ed9b13166a79bbeb88d2)
+
+Co-authored-by: Nikita Sobolev <mail@sobolevn.me>
+---
+ Lib/unittest/mock.py                                                   |   18 ++++++++++
+ Lib/unittest/test/testmock/testasync.py                                |   17 +++++++++
+ Misc/NEWS.d/next/Library/2022-10-08-19-39-27.gh-issue-98086.y---WC.rst |    1 
+ 3 files changed, 36 insertions(+)
+ create mode 100644 Misc/NEWS.d/next/Library/2022-10-08-19-39-27.gh-issue-98086.y---WC.rst
+
+--- a/Lib/unittest/mock.py
++++ b/Lib/unittest/mock.py
+@@ -1749,6 +1749,12 @@ class _patch_dict(object):
+     def __call__(self, f):
+         if isinstance(f, type):
+             return self.decorate_class(f)
++        if inspect.iscoroutinefunction(f):
++            return self.decorate_async_callable(f)
++        return self.decorate_callable(f)
++
++
++    def decorate_callable(self, f):
+         @wraps(f)
+         def _inner(*args, **kw):
+             self._patch_dict()
+@@ -1757,6 +1763,18 @@ class _patch_dict(object):
+             finally:
+                 self._unpatch_dict()
+ 
++        return _inner
++
++
++    def decorate_async_callable(self, f):
++        @wraps(f)
++        async def _inner(*args, **kw):
++            self._patch_dict()
++            try:
++                return await f(*args, **kw)
++            finally:
++                self._unpatch_dict()
++
+         return _inner
+ 
+ 
+--- a/Lib/unittest/test/testmock/testasync.py
++++ b/Lib/unittest/test/testmock/testasync.py
+@@ -143,6 +143,23 @@ class AsyncPatchCMTest(unittest.TestCase
+ 
+         asyncio.run(test_async())
+ 
++    def test_patch_dict_async_def(self):
++        foo = {'a': 'a'}
++        @patch.dict(foo, {'a': 'b'})
++        async def test_async():
++            self.assertEqual(foo['a'], 'b')
++
++        self.assertTrue(inspect.iscoroutinefunction(test_async))
++        asyncio.run(test_async())
++
++    def test_patch_dict_async_def_context(self):
++        foo = {'a': 'a'}
++        async def test_async():
++            with patch.dict(foo, {'a': 'b'}):
++                self.assertEqual(foo['a'], 'b')
++
++        asyncio.run(test_async())
++
+ 
+ class AsyncMockTest(unittest.TestCase):
+     def test_iscoroutinefunction_default(self):
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2022-10-08-19-39-27.gh-issue-98086.y---WC.rst
+@@ -0,0 +1 @@
++Make sure ``patch.dict()`` can be applied on async functions.

python38.changes

@@ -1,7 +1,16 @@
 -------------------------------------------------------------------
-Sun Apr 30 18:17:07 UTC 2023 - Matej Cepl <mcepl@suse.com>
+Sat May  6 17:31:35 UTC 2023 - Matej Cepl <mcepl@suse.com>
 
-- Why in the world we download from HTTP?
+- Add 99366-patch.dict-can-decorate-async.patch fixing
+  gh#python/cpython#98086 (backport from Python 3.10 patch in
+  gh#python/cpython!99366), fixing bsc#1211158.
+
+-------------------------------------------------------------------
+Wed May  3 14:09:37 UTC 2023 - Matej Cepl <mcepl@suse.com>
+
+- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
+  CVE-2007-4559 (bsc#1203750) by adding the filter for
+  tarfile.extractall (PEP 706).
 
 -------------------------------------------------------------------
 Tue Apr 18 05:00:11 UTC 2023 - Steve Kowalik <steven.kowalik@suse.com>

python38.spec

@@ -180,6 +180,12 @@ Patch38:        98437-sphinx.locale._-as-gettext-in-pyspecific.patch
 # blocklist bypass via the urllib.parse component when supplying
 # a URL that starts with blank characters
 Patch39:        CVE-2023-24329-blank-URL-bypass.patch
+# PATCH-FIX-UPSTREAM CVE-2007-4559-filter-tarfile_extractall.patch bsc#1203750 mcepl@suse.com
+# Implement PEP-706 to filter outcome of the tarball extracing
+Patch40:        CVE-2007-4559-filter-tarfile_extractall.patch
+# PATCH-FIX-UPSTREAM 99366-patch.dict-can-decorate-async.patch bsc#[0-9]+ mcepl@suse.com
+# Patch for gh#python/cpython#98086
+Patch41:        99366-patch.dict-can-decorate-async.patch
 BuildRequires:  autoconf-archive
 BuildRequires:  automake
 BuildRequires:  fdupes
@@ -453,6 +459,8 @@ other applications.
 %patch37 -p1
 %patch38 -p1
 %patch39 -p1
+%patch40 -p1
+%patch41 -p1
 
 # drop Autoconf version requirement
 sed -i 's/^AC_PREREQ/dnl AC_PREREQ/' configure.ac
@@ -752,7 +760,7 @@ find "$PDOCS" -name "*.bat" -delete
 install -m 755 -D Tools/gdb/libpython.py %{buildroot}%{_datadir}/gdb/auto-load/%{_libdir}/libpython%{python_abi}.so.%{so_major}.%{so_minor}-gdb.py
 
 # install devel files to /config
-#cp Makefile Makefile.pre.in Makefile.pre $RPM_BUILD_ROOT%{sitedir}/config-%{python_abi}/
+#cp Makefile Makefile.pre.in Makefile.pre $RPM_BUILD_ROOT%%{sitedir}/config-%%{python_abi}/
 
 # RPM macros
 mkdir -p %{buildroot}%{_rpmconfigdir}/macros.d/
@@ -762,7 +770,7 @@ install -m 644 %{SOURCE7} %{buildroot}%{_rpmconfigdir}/macros.d/ # macros.python
 %endif
 # flavor specific macros, only to be supplied "if we are in the buildset", e.g. installed.
 echo '
-# macros for the %{python_pkg_name} flavor
+# macros for the %%{python_pkg_name} flavor
 %%have_%{python_pkg_name} 1
 ' > %{buildroot}%{_rpmconfigdir}/macros.d/macros.%{python_pkg_name}