python-interpreters/python39
SHA256
7
0
Fork 0
forked from pool/python39
Code Pull Requests Activity

Add missing %patch call.

Browse Source
This commit is contained in:
Matej Cepl
2025-11-21 12:51:18 +01:00
parent 6d41ecb4ad
commit 9cf0841df6
3 changed files with 85 additions and 144 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@@ -1 +1,2 @@
.osc
python39-*-build/

225
CVE-2025-6075-expandvars-perf-degrad.patch
View File

@@ -11,19 +11,19 @@ Content-Transfer-Encoding: 8bit
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Łukasz Langa <lukasz@langa.pl>
---
Lib/ntpath.py | 126 ++++++------------
Lib/posixpath.py | 43 +++---
Lib/test/test_genericpath.py | 14 ++
Lib/test/test_ntpath.py | 17 ++-
...-05-30-22-33-27.gh-issue-136065.bu337o.rst | 1 +
5 files changed, 91 insertions(+), 110 deletions(-)
Lib/ntpath.py | 126 +++-------
Lib/posixpath.py | 43 +--
Lib/test/test_genericpath.py | 19 +
Lib/test/test_ntpath.py | 23 +
Misc/NEWS.d/next/Security/2025-05-30-22-33-27.gh-issue-136065.bu337o.rst | 1
5 files changed, 96 insertions(+), 116 deletions(-)
create mode 100644 Misc/NEWS.d/next/Security/2025-05-30-22-33-27.gh-issue-136065.bu337o.rst
diff --git a/Lib/ntpath.py b/Lib/ntpath.py
index 56c3614ba76b2e..604a1bd8d7a4e5 100644
--- a/Lib/ntpath.py
+++ b/Lib/ntpath.py
@@ -335,17 +335,23 @@ def expanduser(path):
Index: Python-3.9.24/Lib/ntpath.py
===================================================================
--- Python-3.9.24.orig/Lib/ntpath.py 2025-11-21 12:52:18.350673347 +0100
+++ Python-3.9.24/Lib/ntpath.py 2025-11-21 12:52:34.076133325 +0100
@@ -335,17 +335,23 @@
# XXX With COMMAND.COM you can use any characters in a variable name,
# XXX except '^|<>='.
@@ -50,7 +50,7 @@ index 56c3614ba76b2e..604a1bd8d7a4e5 100644
percent = b'%'
brace = b'{'
rbrace = b'}'
@@ -354,94 +360,44 @@ def expandvars(path):
@@ -354,94 +360,44 @@
else:
if '$' not in path and '%' not in path:
return path
@@ -177,11 +177,11 @@ index 56c3614ba76b2e..604a1bd8d7a4e5 100644
# Normalize a path, e.g. A//B, A/./B and A/foo/../B all become A\B.
diff --git a/Lib/posixpath.py b/Lib/posixpath.py
index de2b90c10cc3f2..5daa6ef5f12605 100644
--- a/Lib/posixpath.py
+++ b/Lib/posixpath.py
@@ -275,42 +275,41 @@ def expanduser(path):
Index: Python-3.9.24/Lib/posixpath.py
===================================================================
--- Python-3.9.24.orig/Lib/posixpath.py 2025-11-21 12:52:18.388628236 +0100
+++ Python-3.9.24/Lib/posixpath.py 2025-11-21 12:52:34.076301225 +0100
@@ -275,42 +275,41 @@
# This expands the forms $variable and ${variable} only.
# Non-existent variables are left unchanged.
@@ -240,7 +240,7 @@ index de2b90c10cc3f2..5daa6ef5f12605 100644
name = name[1:-1]
try:
if environ is None:
@@ -318,13 +317,11 @@ def expandvars(path):
@@ -318,13 +317,11 @@
else:
value = environ[name]
except KeyError:
@@ -258,26 +258,45 @@ index de2b90c10cc3f2..5daa6ef5f12605 100644
# Normalize a path, e.g. A//B, A/./B and A/foo/../B all become A/B.
diff --git a/Lib/test/test_genericpath.py b/Lib/test/test_genericpath.py
index e7acbcd29088b3..cd6180cc290c80 100644
--- a/Lib/test/test_genericpath.py
+++ b/Lib/test/test_genericpath.py
@@ -8,6 +8,7 @@
import unittest
Index: Python-3.9.24/Lib/test/test_genericpath.py
===================================================================
--- Python-3.9.24.orig/Lib/test/test_genericpath.py 2025-11-21 12:52:19.232406542 +0100
+++ Python-3.9.24/Lib/test/test_genericpath.py 2025-11-21 12:52:34.077309462 +0100
@@ -9,7 +9,7 @@
import warnings
from test import support
+from test.support import os_helper
from test.support.script_helper import assert_python_ok
from test.support import FakePath
-from test.support import FakePath
+from test.support import FakePath, EnvironmentVarGuard
@@ -429,6 +430,19 @@ def check(value, expected):
def create_file(filename, data=b'foo'):
@@ -374,7 +374,7 @@
def test_expandvars(self):
expandvars = self.pathmodule.expandvars
- with support.EnvironmentVarGuard() as env:
+ with EnvironmentVarGuard() as env:
env.clear()
env["foo"] = "bar"
env["{foo"] = "baz1"
@@ -408,7 +408,7 @@
expandvars = self.pathmodule.expandvars
def check(value, expected):
self.assertEqual(expandvars(value), expected)
- with support.EnvironmentVarGuard() as env:
+ with EnvironmentVarGuard() as env:
env.clear()
nonascii = support.FS_NONASCII
env['spam'] = nonascii
@@ -429,6 +429,19 @@
os.fsencode('$bar%s bar' % nonascii))
check(b'$spam}bar', os.fsencode('%s}bar' % nonascii))
+ @support.requires_resource('cpu')
+ def test_expandvars_large(self):
+ expandvars = self.pathmodule.expandvars
+ with os_helper.EnvironmentVarGuard() as env:
+ with EnvironmentVarGuard() as env:
+ env.clear()
+ env["A"] = "B"
+ n = 100_000
@@ -290,10 +309,10 @@ index e7acbcd29088b3..cd6180cc290c80 100644
def test_abspath(self):
self.assertIn("foo", self.pathmodule.abspath("foo"))
with warnings.catch_warnings():
diff --git a/Lib/test/test_ntpath.py b/Lib/test/test_ntpath.py
index 8f07d18e134fb7..6534c791d8d269 100644
--- a/Lib/test/test_ntpath.py
+++ b/Lib/test/test_ntpath.py
Index: Python-3.9.24/Lib/test/test_ntpath.py
===================================================================
--- Python-3.9.24.orig/Lib/test/test_ntpath.py 2025-11-21 12:52:19.665352116 +0100
+++ Python-3.9.24/Lib/test/test_ntpath.py 2025-11-21 12:52:34.077441463 +0100
@@ -1,11 +1,10 @@
import ntpath
import os
@@ -303,18 +322,36 @@ index 8f07d18e134fb7..6534c791d8d269 100644
import warnings
from ntpath import ALLOW_MISSING
-from test.support import TestFailed, FakePath
+from test.support import TestFailed, FakePath, os_helper
+from test.support import TestFailed, FakePath, EnvironmentVarGuard
from test import support, test_genericpath
from tempfile import TemporaryFile
@@ -687,6 +686,19 @@ def check(value, expected):
@@ -642,7 +641,7 @@
ntpath.realpath("file.txt", **kwargs))
def test_expandvars(self):
- with support.EnvironmentVarGuard() as env:
+ with EnvironmentVarGuard() as env:
env.clear()
env["foo"] = "bar"
env["{foo"] = "baz1"
@@ -671,7 +670,7 @@
def test_expandvars_nonascii(self):
def check(value, expected):
tester('ntpath.expandvars(%r)' % value, expected)
- with support.EnvironmentVarGuard() as env:
+ with EnvironmentVarGuard() as env:
env.clear()
nonascii = support.FS_NONASCII
env['spam'] = nonascii
@@ -687,10 +686,23 @@
check('%spam%bar', '%sbar' % nonascii)
check('%{}%bar'.format(nonascii), 'ham%sbar' % nonascii)
+ @support.requires_resource('cpu')
+ def test_expandvars_large(self):
+ expandvars = ntpath.expandvars
+ with os_helper.EnvironmentVarGuard() as env:
+ with EnvironmentVarGuard() as env:
+ env.clear()
+ env["A"] = "B"
+ n = 100_000
@@ -327,7 +364,12 @@ index 8f07d18e134fb7..6534c791d8d269 100644
def test_expanduser(self):
tester('ntpath.expanduser("test")', 'test')
@@ -908,6 +920,7 @@ def test_nt_helpers(self):
- with support.EnvironmentVarGuard() as env:
+ with EnvironmentVarGuard() as env:
env.clear()
tester('ntpath.expanduser("~test")', '~test')
@@ -908,6 +920,7 @@
self.assertIsInstance(b_final_path, bytes)
self.assertGreater(len(b_final_path), 0)
@@ -335,112 +377,9 @@ index 8f07d18e134fb7..6534c791d8d269 100644
class NtCommonTest(test_genericpath.CommonTest, unittest.TestCase):
pathmodule = ntpath
attributes = ['relpath']
diff --git a/Misc/NEWS.d/next/Security/2025-05-30-22-33-27.gh-issue-136065.bu337o.rst b/Misc/NEWS.d/next/Security/2025-05-30-22-33-27.gh-issue-136065.bu337o.rst
new file mode 100644
index 00000000000000..1d152bb5318380
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2025-05-30-22-33-27.gh-issue-136065.bu337o.rst
Index: Python-3.9.24/Misc/NEWS.d/next/Security/2025-05-30-22-33-27.gh-issue-136065.bu337o.rst
===================================================================
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
+++ Python-3.9.24/Misc/NEWS.d/next/Security/2025-05-30-22-33-27.gh-issue-136065.bu337o.rst 2025-11-21 12:52:34.076771610 +0100
@@ -0,0 +1 @@
+Fix quadratic complexity in :func:`os.path.expandvars`.
From b4fb84faf470183801c3e3d361bec03101d928ed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C5=81ukasz=20Langa?= <lukasz@langa.pl>
Date: Fri, 31 Oct 2025 16:45:42 +0100
Subject: [PATCH 2/2] Oops, there's no test.support.os_helper on 3.9
---
Lib/test/test_genericpath.py | 9 ++++-----
Lib/test/test_ntpath.py | 10 +++++-----
2 files changed, 9 insertions(+), 10 deletions(-)
diff --git a/Lib/test/test_genericpath.py b/Lib/test/test_genericpath.py
index cd6180cc290c80..e53bb203a0c4fd 100644
--- a/Lib/test/test_genericpath.py
+++ b/Lib/test/test_genericpath.py
@@ -8,9 +8,8 @@
import unittest
import warnings
from test import support
-from test.support import os_helper
from test.support.script_helper import assert_python_ok
-from test.support import FakePath
+from test.support import FakePath, EnvironmentVarGuard
def create_file(filename, data=b'foo'):
@@ -375,7 +374,7 @@ def test_splitdrive(self):
def test_expandvars(self):
expandvars = self.pathmodule.expandvars
- with support.EnvironmentVarGuard() as env:
+ with EnvironmentVarGuard() as env:
env.clear()
env["foo"] = "bar"
env["{foo"] = "baz1"
@@ -409,7 +408,7 @@ def test_expandvars_nonascii(self):
expandvars = self.pathmodule.expandvars
def check(value, expected):
self.assertEqual(expandvars(value), expected)
- with support.EnvironmentVarGuard() as env:
+ with EnvironmentVarGuard() as env:
env.clear()
nonascii = support.FS_NONASCII
env['spam'] = nonascii
@@ -433,7 +432,7 @@ def check(value, expected):
@support.requires_resource('cpu')
def test_expandvars_large(self):
expandvars = self.pathmodule.expandvars
- with os_helper.EnvironmentVarGuard() as env:
+ with EnvironmentVarGuard() as env:
env.clear()
env["A"] = "B"
n = 100_000
diff --git a/Lib/test/test_ntpath.py b/Lib/test/test_ntpath.py
index 6534c791d8d269..9a8a44b235b2ce 100644
--- a/Lib/test/test_ntpath.py
+++ b/Lib/test/test_ntpath.py
@@ -4,7 +4,7 @@
import unittest
import warnings
from ntpath import ALLOW_MISSING
-from test.support import TestFailed, FakePath, os_helper
+from test.support import TestFailed, FakePath, EnvironmentVarGuard
from test import support, test_genericpath
from tempfile import TemporaryFile
@@ -641,7 +641,7 @@ def test_realpath_cwd(self):
ntpath.realpath("file.txt", **kwargs))
def test_expandvars(self):
- with support.EnvironmentVarGuard() as env:
+ with EnvironmentVarGuard() as env:
env.clear()
env["foo"] = "bar"
env["{foo"] = "baz1"
@@ -670,7 +670,7 @@ def test_expandvars(self):
def test_expandvars_nonascii(self):
def check(value, expected):
tester('ntpath.expandvars(%r)' % value, expected)
- with support.EnvironmentVarGuard() as env:
+ with EnvironmentVarGuard() as env:
env.clear()
nonascii = support.FS_NONASCII
env['spam'] = nonascii
@@ -689,7 +689,7 @@ def check(value, expected):
@support.requires_resource('cpu')
def test_expandvars_large(self):
expandvars = ntpath.expandvars
- with os_helper.EnvironmentVarGuard() as env:
+ with EnvironmentVarGuard() as env:
env.clear()
env["A"] = "B"
n = 100_000
@@ -702,7 +702,7 @@ def test_expandvars_large(self):
def test_expanduser(self):
tester('ntpath.expanduser("test")', 'test')
- with support.EnvironmentVarGuard() as env:
+ with EnvironmentVarGuard() as env:
env.clear()
tester('ntpath.expanduser("~test")', '~test')

3
python39.spec
View File

@@ -196,7 +196,7 @@ Patch51: sphinx-802.patch
Patch52: gh139257-Support-docutils-0.22.patch
# PATCH-FIX-UPSTREAM CVE-2025-6075-expandvars-perf-degrad.patch bsc#1252974 mcepl@suse.com
# Avoid potential quadratic complexity vulnerabilities in path modules
Patch54: CVE-2025-6075-expandvars-perf-degrad.patch
Patch53: CVE-2025-6075-expandvars-perf-degrad.patch
BuildRequires: autoconf-archive
BuildRequires: automake
BuildRequires: fdupes
@@ -469,6 +469,7 @@ other applications.
%patch -p1 -P 50
%patch -p1 -P 51
%patch -p1 -P 52
%patch -p1 -P 53
# drop Autoconf version requirement
sed -i 's/^AC_PREREQ/dnl AC_PREREQ/' configure.ac