forked from pool/python312
Matěj Cepl
07beab470d
CVE-2025-11468: to preserve parens when folding comments.
(bsc#1257029, gh#python/cpython#143935)
CVE-2025-11468-email-hdr-fold-comment.patch
CVE-2025-12781: fix decoding with non-standard Base64 alphabet
(bsc#1257108, gh#python/cpython#125346)
CVE-2025-12781-b64decode-alt-chars.patch
CVE-2026-0672: rejects control characters in http cookies.
(bsc#1257031, gh#python/cpython#143919)
CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
CVE-2026-0865: rejecting control characters in
wsgiref.headers.Headers, which could be abused for injecting
false HTTP headers. (bsc#1257042, gh#python/cpython#143916)
CVE-2026-0865-wsgiref-ctrl-chars.patch
CVE-2025-15366: basically the same as the previous patch for
IMAP protocol. (bsc#1257044, gh#python/cpython#143921)
CVE-2025-15366-imap-ctrl-chars.patch
CVE-2025-15282: basically the same as the previous patch for
urllib library. (bsc#1257046, gh#python/cpython#143925)
CVE-2025-15282-urllib-ctrl-chars.patch
CVE-2025-15367: basically the same as the previous patch for
poplib library. (bsc#1257041, gh#python/cpython#143923)
CVE-2025-15367-poplib-ctrl-chars.patch
CVE-2025-13836: to prevent reading an HTTP response from
Content-Length per default as the length. (bsc#1254400,
gh#python/cpython#119451)
CVE-2025-13836-http-resp-cont-len.patch
CVE-2025-12084: prevent quadratic behavior in node ID cache
clearing. (bsc#1254997, gh#python/cpython#142145)
CVE-2025-12084-minidom-quad-search.patch
CVE-2025-13837: protect against OOM when loading malicious
content. (bsc#1254401, gh#python/cpython#119342)
CVE-2025-13837-plistlib-mailicious-length.patch
- gh-99242: os.getloadavg() may throw OSError when running
regression tests under certain conditions (e.g. chroot).
This error is now caught and ignored, since reporting load
average is optional.
- gh-121160: Add a test for readline.set_history_length().
Note that this test may fail on readline libraries.
- gh-121200: Fix test_expanduser_pwd2() of test_posixpath.
Call getpwnam() to get pw_dir, since it can be different
than getpwall() pw_dir. Patch by Victor Stinner.
- gh-121188: When creating the JUnit XML file, regrtest now
escapes characters which are invalid in XML, such as the
chr(27) control character used in ANSI escape sequences.
Patch by Victor Stinner.
- CVE-2026-1299 and CVE-2024-6923: email headers with
embedded newlines are now quoted on output. The generator
will now refuse to serialize (write) headers that are
unsafely folded or delimited; see verify_generated_headers.
(Contributed by Bas Bloemsaat and Petr Viktorin in
bsc#1228780, gh-121650; bsc#1257181, gh-121650).
- gh-120495: Fix incorrect exception handling in Tab Nanny.
Patch by Wulian233.
would produce incorrect results if type parameters in
a class scope were overridden by assignments in a class
scope and from __future__ import annotations semantics were
- gh-81936: help() and showtopic() methods now respect
a configured output argument to pydoc.Helper and not use
the pager in such cases. Patch by Enrico Tröger.
- gh-119577: The DeprecationWarning emitted when testing the
truth value of an xml.etree.ElementTree.Element now
- gh-121871: Documentation HTML varies from timestamp. Patch
by Bernhard M. Wiedemann (bsc#1227999).
- gh-122029: Emit c_call events in sys.setprofile() when
a PyMethodObject pointing to a PyCFunction is called.
modification of a list object, where one thread assigns
a slice and another clears it.
bytes and bytearray objects when using protocol version 5.
Patch by Bénédikt Tran.
194 lines
8.8 KiB
Diff
194 lines
8.8 KiB
Diff
From f922c02c529d25d61aa9c28a8192639c1fce8d4d Mon Sep 17 00:00:00 2001
|
|
From: Serhiy Storchaka <storchaka@gmail.com>
|
|
Date: Wed, 5 Nov 2025 20:12:31 +0200
|
|
Subject: [PATCH] gh-125346: Add more base64 tests
|
|
|
|
Add more tests for the altchars argument of b64decode() and for the map01
|
|
argument of b32decode().
|
|
---
|
|
Doc/library/base64.rst | 18 +++-
|
|
Lib/base64.py | 40 ++++++++-
|
|
Lib/test/test_base64.py | 42 +++++++++-
|
|
Misc/NEWS.d/next/Library/2025-11-06-12-03-29.gh-issue-125346.7Gfpgw.rst | 5 +
|
|
4 files changed, 91 insertions(+), 14 deletions(-)
|
|
|
|
Index: Python-3.12.12/Doc/library/base64.rst
|
|
===================================================================
|
|
--- Python-3.12.12.orig/Doc/library/base64.rst 2025-10-09 13:07:00.000000000 +0200
|
|
+++ Python-3.12.12/Doc/library/base64.rst 2026-02-10 22:15:41.801235355 +0100
|
|
@@ -74,15 +74,20 @@
|
|
A :exc:`binascii.Error` exception is raised
|
|
if *s* is incorrectly padded.
|
|
|
|
- If *validate* is ``False`` (the default), characters that are neither
|
|
+ If *validate* is false (the default), characters that are neither
|
|
in the normal base-64 alphabet nor the alternative alphabet are
|
|
- discarded prior to the padding check. If *validate* is ``True``,
|
|
- these non-alphabet characters in the input result in a
|
|
- :exc:`binascii.Error`.
|
|
+ discarded prior to the padding check, but the ``+`` and ``/`` characters
|
|
+ keep their meaning if they are not in *altchars* (they will be discarded
|
|
+ in future Python versions).
|
|
+ If *validate* is true, these non-alphabet characters in the input
|
|
+ result in a :exc:`binascii.Error`.
|
|
|
|
For more information about the strict base64 check, see :func:`binascii.a2b_base64`
|
|
|
|
- May assert or raise a :exc:`ValueError` if the length of *altchars* is not 2.
|
|
+ .. deprecated:: next
|
|
+ Accepting the ``+`` and ``/`` characters with an alternative alphabet
|
|
+ is now deprecated.
|
|
+
|
|
|
|
.. function:: standard_b64encode(s)
|
|
|
|
@@ -113,6 +118,9 @@
|
|
``/`` in the standard Base64 alphabet, and return the decoded
|
|
:class:`bytes`.
|
|
|
|
+ .. deprecated:: next
|
|
+ Accepting the ``+`` and ``/`` characters is now deprecated.
|
|
+
|
|
|
|
.. function:: b32encode(s)
|
|
|
|
Index: Python-3.12.12/Lib/base64.py
|
|
===================================================================
|
|
--- Python-3.12.12.orig/Lib/base64.py 2026-02-10 22:15:02.534016402 +0100
|
|
+++ Python-3.12.12/Lib/base64.py 2026-02-10 22:15:41.801591556 +0100
|
|
@@ -71,20 +71,39 @@
|
|
The result is returned as a bytes object. A binascii.Error is raised if
|
|
s is incorrectly padded.
|
|
|
|
- If validate is False (the default), characters that are neither in the
|
|
+ If validate is false (the default), characters that are neither in the
|
|
normal base-64 alphabet nor the alternative alphabet are discarded prior
|
|
- to the padding check. If validate is True, these non-alphabet characters
|
|
+ to the padding check. If validate is true, these non-alphabet characters
|
|
in the input result in a binascii.Error.
|
|
For more information about the strict base64 check, see:
|
|
|
|
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
|
|
"""
|
|
s = _bytes_from_decode_data(s)
|
|
+ badchar = None
|
|
if altchars is not None:
|
|
altchars = _bytes_from_decode_data(altchars)
|
|
- assert len(altchars) == 2, repr(altchars)
|
|
+ if len(altchars) != 2:
|
|
+ raise ValueError(f'invalid altchars: {altchars!r}')
|
|
+ for b in b'+/':
|
|
+ if b not in altchars and b in s:
|
|
+ badchar = b
|
|
+ break
|
|
s = s.translate(bytes.maketrans(altchars, b'+/'))
|
|
- return binascii.a2b_base64(s, strict_mode=validate)
|
|
+ result = binascii.a2b_base64(s, strict_mode=validate)
|
|
+ if badchar is not None:
|
|
+ import warnings
|
|
+ if validate:
|
|
+ warnings.warn(f'invalid character {chr(badchar)!a} in Base64 data '
|
|
+ f'with altchars={altchars!r} and validate=True '
|
|
+ f'will be an error in future Python versions',
|
|
+ DeprecationWarning, stacklevel=2)
|
|
+ else:
|
|
+ warnings.warn(f'invalid character {chr(badchar)!a} in Base64 data '
|
|
+ f'with altchars={altchars!r} and validate=False '
|
|
+ f'will be discarded in future Python versions',
|
|
+ FutureWarning, stacklevel=2)
|
|
+ return result
|
|
|
|
|
|
def standard_b64encode(s):
|
|
@@ -129,8 +148,19 @@
|
|
The alphabet uses '-' instead of '+' and '_' instead of '/'.
|
|
"""
|
|
s = _bytes_from_decode_data(s)
|
|
+ badchar = None
|
|
+ for b in b'+/':
|
|
+ if b in s:
|
|
+ badchar = b
|
|
+ break
|
|
s = s.translate(_urlsafe_decode_translation)
|
|
- return b64decode(s)
|
|
+ result = binascii.a2b_base64(s, strict_mode=False)
|
|
+ if badchar is not None:
|
|
+ import warnings
|
|
+ warnings.warn(f'invalid character {chr(badchar)!a} in URL-safe Base64 data '
|
|
+ f'will be discarded in future Python versions',
|
|
+ FutureWarning, stacklevel=2)
|
|
+ return result
|
|
|
|
|
|
|
|
Index: Python-3.12.12/Lib/test/test_base64.py
|
|
===================================================================
|
|
--- Python-3.12.12.orig/Lib/test/test_base64.py 2026-02-10 22:15:04.364274059 +0100
|
|
+++ Python-3.12.12/Lib/test/test_base64.py 2026-02-10 22:17:42.445725550 +0100
|
|
@@ -232,6 +232,25 @@
|
|
b'\xd3V\xbeo\xf7\x1d')
|
|
self.check_decode_type_errors(base64.urlsafe_b64decode)
|
|
|
|
+ def test_b64decode_altchars(self):
|
|
+ # Test with arbitrary alternative characters
|
|
+ eq = self.assertEqual
|
|
+ res = b'\xd3V\xbeo\xf7\x1d'
|
|
+ for altchars in b'*$', b'+/', b'/+', b'+_', b'-+', b'-/', b'/_':
|
|
+ data = b'01a%cb%ccd' % tuple(altchars)
|
|
+ data_str = data.decode('ascii')
|
|
+ altchars_str = altchars.decode('ascii')
|
|
+
|
|
+ eq(base64.b64decode(data, altchars=altchars), res)
|
|
+ eq(base64.b64decode(data_str, altchars=altchars), res)
|
|
+ eq(base64.b64decode(data, altchars=altchars_str), res)
|
|
+ eq(base64.b64decode(data_str, altchars=altchars_str), res)
|
|
+
|
|
+ self.assertRaises(ValueError, base64.b64decode, b'', altchars=b'+')
|
|
+ self.assertRaises(ValueError, base64.b64decode, b'', altchars=b'+/-')
|
|
+ self.assertRaises(ValueError, base64.b64decode, '', altchars='+')
|
|
+ self.assertRaises(ValueError, base64.b64decode, '', altchars='+/-')
|
|
+
|
|
def test_b64decode_padding_error(self):
|
|
self.assertRaises(binascii.Error, base64.b64decode, b'abc')
|
|
self.assertRaises(binascii.Error, base64.b64decode, 'abc')
|
|
@@ -263,10 +282,25 @@
|
|
with self.assertRaises(binascii.Error):
|
|
base64.b64decode(bstr.decode('ascii'), validate=True)
|
|
|
|
- # Normal alphabet characters not discarded when alternative given
|
|
- res = b'\xFB\xEF\xBE\xFF\xFF\xFF'
|
|
- self.assertEqual(base64.b64decode(b'++[[//]]', b'[]'), res)
|
|
- self.assertEqual(base64.urlsafe_b64decode(b'++--//__'), res)
|
|
+ # Normal alphabet characters will be discarded when alternative given
|
|
+ with self.assertWarns(FutureWarning):
|
|
+ self.assertEqual(base64.b64decode(b'++++', altchars=b'-_'),
|
|
+ b'\xfb\xef\xbe')
|
|
+ with self.assertWarns(FutureWarning):
|
|
+ self.assertEqual(base64.b64decode(b'////', altchars=b'-_'),
|
|
+ b'\xff\xff\xff')
|
|
+ with self.assertWarns(DeprecationWarning):
|
|
+ self.assertEqual(base64.b64decode(b'++++', altchars=b'-_', validate=True),
|
|
+ b'\xfb\xef\xbe')
|
|
+ with self.assertWarns(DeprecationWarning):
|
|
+ self.assertEqual(base64.b64decode(b'////', altchars=b'-_', validate=True),
|
|
+ b'\xff\xff\xff')
|
|
+ with self.assertWarns(FutureWarning):
|
|
+ self.assertEqual(base64.urlsafe_b64decode(b'++++'), b'\xfb\xef\xbe')
|
|
+ with self.assertWarns(FutureWarning):
|
|
+ self.assertEqual(base64.urlsafe_b64decode(b'////'), b'\xff\xff\xff')
|
|
+ with self.assertRaises(binascii.Error):
|
|
+ base64.b64decode(b'+/!', altchars=b'-_')
|
|
|
|
def test_b32encode(self):
|
|
eq = self.assertEqual
|
|
Index: Python-3.12.12/Misc/NEWS.d/next/Library/2025-11-06-12-03-29.gh-issue-125346.7Gfpgw.rst
|
|
===================================================================
|
|
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
|
|
+++ Python-3.12.12/Misc/NEWS.d/next/Library/2025-11-06-12-03-29.gh-issue-125346.7Gfpgw.rst 2026-02-10 22:15:41.802353823 +0100
|
|
@@ -0,0 +1,5 @@
|
|
+Accepting ``+`` and ``/`` characters with an alternative alphabet in
|
|
+:func:`base64.b64decode` and :func:`base64.urlsafe_b64decode` is now
|
|
+deprecated.
|
|
+In future Python versions they will be errors in the strict mode and
|
|
+discarded in the non-strict mode.
|