From 19d9cd9aac96c09fc481a7ac481ffa83cab23705fb76d6b62f6ef82c49b789cb Mon Sep 17 00:00:00 2001 From: Matej Cepl Date: Fri, 19 Mar 2021 14:30:08 +0000 Subject: [PATCH 1/2] - Add 166-add-xfail-test_add_or_replace_parameter_fail.patch, which makes tests working with CVE-2021-23336. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-w3lib?expand=0&rev=17 --- ...l-test_add_or_replace_parameter_fail.patch | 80 +++++++++++++++++++ python-w3lib.changes | 6 ++ python-w3lib.spec | 10 ++- 3 files changed, 93 insertions(+), 3 deletions(-) create mode 100644 166-add-xfail-test_add_or_replace_parameter_fail.patch diff --git a/166-add-xfail-test_add_or_replace_parameter_fail.patch b/166-add-xfail-test_add_or_replace_parameter_fail.patch new file mode 100644 index 0000000..094244e --- /dev/null +++ b/166-add-xfail-test_add_or_replace_parameter_fail.patch @@ -0,0 +1,80 @@ +From 34c62eb265cdb75b748d8aca43a2f8b9581dbd6a Mon Sep 17 00:00:00 2001 +From: Eugenio Lacuesta +Date: Wed, 10 Mar 2021 12:20:24 -0300 +Subject: [PATCH 1/8] [CI] Run tests on GitHub actions + +--- + tests/test_url.py | 24 ++++++++++++++---------- + 1 file changed, 14 insertions(+), 10 deletions(-) + delete mode 100644 .github/workflows/build.yml + create mode 100644 .github/workflows/tests.yml + +--- a/tests/test_url.py ++++ b/tests/test_url.py +@@ -2,11 +2,14 @@ + from __future__ import absolute_import + import os + import unittest ++ ++import pytest ++from six.moves.urllib.parse import urlparse ++ + from w3lib.url import (is_url, safe_url_string, safe_download_url, + url_query_parameter, add_or_replace_parameter, url_query_cleaner, + file_uri_to_path, parse_data_uri, path_to_file_uri, any_to_uri, + urljoin_rfc, canonicalize_url, parse_url, add_or_replace_parameters) +-from six.moves.urllib.parse import urlparse + + + class UrlTests(unittest.TestCase): +@@ -76,17 +79,16 @@ class UrlTests(unittest.TestCase): + def test_safe_url_string_unsafe_chars(self): + safeurl = safe_url_string(r"http://localhost:8001/unwise{,},|,\,^,[,],`?|=[]&[]=|") + self.assertEqual(safeurl, r"http://localhost:8001/unwise%7B,%7D,|,%5C,%5E,[,],%60?|=[]&[]=|") +- ++ + def test_safe_url_string_quote_path(self): + safeurl = safe_url_string(u'http://google.com/"hello"', quote_path=True) + self.assertEqual(safeurl, u'http://google.com/%22hello%22') +- ++ + safeurl = safe_url_string(u'http://google.com/"hello"', quote_path=False) + self.assertEqual(safeurl, u'http://google.com/"hello"') +- ++ + safeurl = safe_url_string(u'http://google.com/"hello"') + self.assertEqual(safeurl, u'http://google.com/%22hello%22') +- + + def test_safe_url_string_with_query(self): + safeurl = safe_url_string(u"http://www.example.com/£?unit=µ") +@@ -299,10 +301,6 @@ class UrlTests(unittest.TestCase): + self.assertEqual(add_or_replace_parameter(url, 'arg3', 'nv3'), + 'http://domain/test?arg1=v1&arg2=v2&arg3=nv3') + +- url = 'http://domain/test?arg1=v1;arg2=v2' +- self.assertEqual(add_or_replace_parameter(url, 'arg1', 'v3'), +- 'http://domain/test?arg1=v3&arg2=v2') +- + self.assertEqual(add_or_replace_parameter("http://domain/moreInfo.asp?prodID=", 'prodID', '20'), + 'http://domain/moreInfo.asp?prodID=20') + url = 'http://rmc-offers.co.uk/productlist.asp?BCat=2%2C60&CatID=60' +@@ -327,6 +325,13 @@ class UrlTests(unittest.TestCase): + self.assertEqual(add_or_replace_parameter(url, 'arg1', 'v3'), + 'http://domain/test?arg1=v3&arg2=v2') + ++ @pytest.mark.xfail(reason="https://github.com/scrapy/w3lib/issues/164") ++ def test_add_or_replace_parameter_fail(self): ++ self.assertEqual( ++ add_or_replace_parameter('http://domain/test?arg1=v1;arg2=v2', 'arg1', 'v3'), ++ 'http://domain/test?arg1=v3&arg2=v2' ++ ) ++ + def test_add_or_replace_parameters(self): + url = 'http://domain/test' + self.assertEqual(add_or_replace_parameters(url, {'arg': 'v'}), +@@ -741,4 +746,3 @@ class DataURITests(unittest.TestCase): + + if __name__ == "__main__": + unittest.main() +- diff --git a/python-w3lib.changes b/python-w3lib.changes index 2989791..7ee5acc 100644 --- a/python-w3lib.changes +++ b/python-w3lib.changes @@ -1,3 +1,9 @@ +------------------------------------------------------------------- +Fri Mar 19 14:28:28 UTC 2021 - Matej Cepl + +- Add 166-add-xfail-test_add_or_replace_parameter_fail.patch, + which makes tests working with CVE-2021-23336. + ------------------------------------------------------------------- Wed Jul 22 11:05:23 UTC 2020 - Marketa Calabkova diff --git a/python-w3lib.spec b/python-w3lib.spec index 272fad3..76bcf6c 100644 --- a/python-w3lib.spec +++ b/python-w3lib.spec @@ -1,7 +1,7 @@ # # spec file for package python-w3lib # -# Copyright (c) 2020 SUSE LLC +# Copyright (c) 2021 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -25,6 +25,10 @@ License: BSD-3-Clause Group: Development/Languages/Python URL: https://github.com/scrapy/w3lib Source: https://files.pythonhosted.org/packages/source/w/w3lib/w3lib-%{version}.tar.gz +# PATCH-FIX-UPSTREAM 166-add-xfail-test_add_or_replace_parameter_fail.patch mcepl@suse.com +# Allow working with Python fixed CVE-2021-23336 +Patch0: 166-add-xfail-test_add_or_replace_parameter_fail.patch +BuildRequires: %{python_module pytest} BuildRequires: %{python_module setuptools} BuildRequires: %{python_module six >= 1.4.1} BuildRequires: fdupes @@ -56,7 +60,7 @@ This is a Python library of web-related functions, such as: * extract arguments from urls %prep -%setup -q -n w3lib-%{version} +%autosetup -p1 -n w3lib-%{version} %build %python_build @@ -66,7 +70,7 @@ This is a Python library of web-related functions, such as: %python_expand %fdupes %{buildroot}%{$python_sitelib} %check -%python_exec setup.py test +%pytest %files %{python_files} %doc README.rst From 7d4e9744402c993d3d477eb388e61a35a238f9e897deafd26e4bef9ffa2972fd Mon Sep 17 00:00:00 2001 From: Matej Cepl Date: Fri, 19 Mar 2021 15:15:22 +0000 Subject: [PATCH 2/2] Fix changes OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-w3lib?expand=0&rev=18 --- python-w3lib.changes | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/python-w3lib.changes b/python-w3lib.changes index 7ee5acc..f5d0722 100644 --- a/python-w3lib.changes +++ b/python-w3lib.changes @@ -2,7 +2,7 @@ Fri Mar 19 14:28:28 UTC 2021 - Matej Cepl - Add 166-add-xfail-test_add_or_replace_parameter_fail.patch, - which makes tests working with CVE-2021-23336. + which makes tests working with CVE-2021-23336 (bsc#1181270). ------------------------------------------------------------------- Wed Jul 22 11:05:23 UTC 2020 - Marketa Calabkova