1
0

49 Commits

Author SHA256 Message Date
0f652cd6b1 - Add security patches:
* CVE-2025-67724.patch (bsc#1254903)
  * CVE-2025-67725.patch (bsc#1254905)
  * CVE-2025-67726.patch (bsc#1254904)
2025-12-16 11:44:42 +01:00
8f0aed5840 Accepting request 1277990 from devel:languages:python
- Update to 6.5.0 (CVE-2025-47287, bsc#1243268):
  * Security Improvements:
    - Previously, malformed multipart-form-data requests could log
      multiple warnings and constitute a denial-of-service attack. Now
      an exception is raised at the first error, so there is only one
      log message per request. This fixes CVE-2025-47287.
  * General Changes:
    - Python 3.14 is now supported. Older versions of Tornado will
      work on Python 3.14 but may log deprecation warnings.
    - The free-threading mode of Python 3.13 is now supported on an
      experimental basis. Prebuilt wheels are not yet available for
      this configuration, but it can be built from source.
    - The minimum supported Python version is 3.9.
  * Deprecation Notices:
    - Support for obs-fold continuation lines in HTTP headers is
      deprecated and will be removed in Tornado 7.0, as is the use of
      carriage returns without line feeds as header separators.
    - The callback argument to websocket_connect is deprecated and
      will be removed in Tornado 7.0. Note that on_message_callback is
      not deprecated.
    - The log_message and args attributes of tornado.web.HTTPError are
      deprecated. Use the new get_message method instead.

OBS-URL: https://build.opensuse.org/request/show/1277990
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-tornado6?expand=0&rev=20
2025-05-23 12:27:19 +00:00
d509d3561b - Update to 6.5.0 (CVE-2025-47287, bsc#1243268):
* Security Improvements:
    - Previously, malformed multipart-form-data requests could log
      multiple warnings and constitute a denial-of-service attack. Now
      an exception is raised at the first error, so there is only one
      log message per request. This fixes CVE-2025-47287.
  * General Changes:
    - Python 3.14 is now supported. Older versions of Tornado will
      work on Python 3.14 but may log deprecation warnings.
    - The free-threading mode of Python 3.13 is now supported on an
      experimental basis. Prebuilt wheels are not yet available for
      this configuration, but it can be built from source.
    - The minimum supported Python version is 3.9.
  * Deprecation Notices:
    - Support for obs-fold continuation lines in HTTP headers is
      deprecated and will be removed in Tornado 7.0, as is the use of
      carriage returns without line feeds as header separators.
    - The callback argument to websocket_connect is deprecated and
      will be removed in Tornado 7.0. Note that on_message_callback is
      not deprecated.
    - The log_message and args attributes of tornado.web.HTTPError are
      deprecated. Use the new get_message method instead.

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=46
2025-05-16 09:31:51 +00:00
da9e76faa6 Accepting request 1226139 from devel:languages:python
- Update to 6.4.2: 
  + Security Improvements:
    * Parsing of the cookie header is now much more efficient. The older
      algorithm sometimes had quadratic performance which allowed for a
      denial-of-service attack in which the server would spend excessive
      CPU time parsing cookies and block the event loop.
      (CVE-2024-52804, bsc#1233668)

OBS-URL: https://build.opensuse.org/request/show/1226139
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-tornado6?expand=0&rev=19
2024-11-26 19:55:22 +00:00
c3ee285ce0 - Update to 6.4.2:
+ Security Improvements:
    * Parsing of the cookie header is now much more efficient. The older
      algorithm sometimes had quadratic performance which allowed for a
      denial-of-service attack in which the server would spend excessive
      CPU time parsing cookies and block the event loop.
      (CVE-2024-52804, bsc#1233668)

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=44
2024-11-25 03:21:09 +00:00
a009a9b49d Accepting request 1190823 from devel:languages:python
OBS-URL: https://build.opensuse.org/request/show/1190823
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-tornado6?expand=0&rev=18
2024-08-02 15:26:09 +00:00
81000c3e06 Accepting request 1174712 from devel:languages:python
- Add patch support-pytest-8.2.patch:
  * Support pytest >= 8.2 changes.

OBS-URL: https://build.opensuse.org/request/show/1174712
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-tornado6?expand=0&rev=17
2024-05-20 16:09:27 +00:00
a11320e89a - Add patch support-pytest-8.2.patch:
* Support pytest >= 8.2 changes.

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=40
2024-05-17 03:37:55 +00:00
dc9a103e25 Accepting request 1138133 from devel:languages:python
- Add patch openssl-3.2.patch gh#tornadoweb/tornado#3355

OBS-URL: https://build.opensuse.org/request/show/1138133
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-tornado6?expand=0&rev=16
2024-01-12 22:44:36 +00:00
a616e76829 - Add patch openssl-3.2.patch gh#tornadoweb/tornado#3355
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=38
2024-01-11 13:38:53 +00:00
f8f002f82d Accepting request 1136473 from devel:languages:python
- update to 6.4:
  * https://www.tornadoweb.org/en/stable/releases/v6.4.0.html
  * Python 3.12 is now supported.
- drop py312-datetime.patch (upstream)

  * The Content-Length header and chunked Transfer-Encoding sizes
    are now parsed more strictly (according to the relevant RFCs)
    to avoid potential request-smuggling vulnerabilities when
  * Do not test multi-line headers.
- require python-backports.ssl_hostname only on python 2.x
    or 3.2.
  * This release fixes a path traversal vulnerability in StaticFileHandler,
  in which files whose names started with the static_path directory
  * SSLIOStream.connect and IOStream.start_tls now
  * Certificate validation will now use the system CA root certificates
    instead of certifi when possible (i.e. Python 2.7.9+ or 3.4+).
  * The default SSL configuration has become stricter,
    using ssl.create_default_context where available on the client side.
    (On the server side, applications are encouraged to migrate from
  * The deprecated classes in the tornado.auth module, GoogleMixin,
  + See more release details at
- added python3 package

OBS-URL: https://build.opensuse.org/request/show/1136473
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-tornado6?expand=0&rev=15
2024-01-05 21:59:41 +00:00
108259eb7b - update to 6.4:
* https://www.tornadoweb.org/en/stable/releases/v6.4.0.html
  * Python 3.12 is now supported.
- drop py312-datetime.patch (upstream)
  * The Content-Length header and chunked Transfer-Encoding sizes
    are now parsed more strictly (according to the relevant RFCs)
    to avoid potential request-smuggling vulnerabilities when
  * Do not test multi-line headers.
- require python-backports.ssl_hostname only on python 2.x
    or 3.2.
  * This release fixes a path traversal vulnerability in StaticFileHandler,
  in which files whose names started with the static_path directory
  * SSLIOStream.connect and IOStream.start_tls now
  * Certificate validation will now use the system CA root certificates
    instead of certifi when possible (i.e. Python 2.7.9+ or 3.4+).
  * The default SSL configuration has become stricter,
    using ssl.create_default_context where available on the client side.
    (On the server side, applications are encouraged to migrate from
  * The deprecated classes in the tornado.auth module, GoogleMixin,
  + See more release details at
- added python3 package

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=36
2024-01-03 10:28:18 +00:00
440d8d0f16 Accepting request 1112880 from devel:languages:python
OBS-URL: https://build.opensuse.org/request/show/1112880
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-tornado6?expand=0&rev=14
2023-09-26 20:00:21 +00:00
4b07d776a9 Accepting request 1112758 from home:mcalabkova:branches:devel:languages:python:312
- Update to 6.3.3
  * The Content-Length header and chunked Transfer-Encoding sizes 
    are now parsed more strictly (according to the relevant RFCs) 
    to avoid potential request-smuggling vulnerabilities when 
    deployed behind certain proxies.
- Add py312-datetime.patch to fix build with Python 3.12

OBS-URL: https://build.opensuse.org/request/show/1112758
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=34
2023-09-21 16:50:37 +00:00
28c4b9947b Accepting request 1102687 from devel:languages:python
- New upstream release 6.3.2 (bsc#1211741, CVE-2023-28370)

OBS-URL: https://build.opensuse.org/request/show/1102687
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-tornado6?expand=0&rev=13
2023-08-07 13:29:00 +00:00
4e1961348e - New upstream release 6.3.2 (bsc#1211741, CVE-2023-28370)
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=32
2023-08-07 11:21:42 +00:00
e074e45d19 Accepting request 1090058 from devel:languages:python
- New upstream release 6.3.2
  - Security improvements
    - Fixed an open redirect vulnerability in StaticFileHandler
      under certain configurations.
  - ``tornado.web``
    - `.RequestHandler.set_cookie` once again accepts capitalized
      keyword arguments for backwards compatibility. This is
      deprecated and in Tornado 7.0 only lowercase arguments will
      be accepted.
  - What's new in Tornado 6.3.0
    - The new `.Application` setting ``xsrf_cookie_name``
      can now be used to take advantage of the ``__Host``
      cookie prefix for improved security.  To use it, add
      ``{"xsrf_cookie_name": "__Host-xsrf", "xsrf_cookie_kwargs":
      {"secure": True}}`` to your `.Application` settings. Note
      that this feature currently only works when HTTPS is used.
    - `.WSGIContainer` now supports running the application in
      a ``ThreadPoolExecutor`` so the event loop is no longer
      blocked.
    - `.AsyncTestCase` and `.AsyncHTTPTestCase`, which were
      deprecated in Tornado 6.2, are no longer deprecated.
    - WebSockets are now much faster at receiving large messages
      split into many fragments.
  - General changes
    - Python 3.7 is no longer supported; the minimum supported  .
      Python version is 3.8 Python 3.12 is now supported        .
    - To avoid spurious deprecation warnings, users of Python
      3.10 should upgrade to at least version 3.10.9, and users
      of Python 3.11 should upgrade to at least version 3.11.1.
    - Tornado submodules are now imported automatically on

OBS-URL: https://build.opensuse.org/request/show/1090058
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-tornado6?expand=0&rev=12
2023-06-02 22:06:34 +00:00
b4238da8d4 Fix changes
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=30
2023-05-31 19:15:27 +00:00
1d12a5645e Clean up the SPEC file
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=29
2023-05-30 13:57:47 +00:00
d7a748ab7f Accepting request 1089804 from home:dancermak:branches:devel:languages:python
New upstream release 6.3.2

OBS-URL: https://build.opensuse.org/request/show/1089804
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=28
2023-05-30 13:41:07 +00:00
680cae9655 Accepting request 1081738 from devel:languages:python
OBS-URL: https://build.opensuse.org/request/show/1081738
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-tornado6?expand=0&rev=11
2023-04-22 19:58:20 +00:00
4f13b9c1bf Accepting request 1081668 from home:dirkmueller:acdc:as_python3_module
SR for python stack proposal

OBS-URL: https://build.opensuse.org/request/show/1081668
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=26
2023-04-21 13:31:11 +00:00
b9af869d41 Clean up SPEC file
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=25
2023-02-10 22:21:19 +00:00
5a8e6d5dde Accepting request 999454 from devel:languages:python
Automatic submission by obs-autosubmit

OBS-URL: https://build.opensuse.org/request/show/999454
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-tornado6?expand=0&rev=10
2022-08-28 11:12:11 +00:00
58feea819f - update to 6.2:
* https://www.tornadoweb.org/en/stable/releases/v6.2.0.html
- drop remove-multiheader-http-test.patch (upstream)

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=23
2022-08-19 16:30:50 +00:00
71a2812e4f Accepting request 973568 from devel:languages:python
- Add patch remove-multiheader-http-test.patch:
  * Do not test multi-line headers.

OBS-URL: https://build.opensuse.org/request/show/973568
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-tornado6?expand=0&rev=9
2022-04-29 22:44:27 +00:00
578faf51ea - Add patch remove-multiheader-http-test.patch:
* Do not test multi-line headers.

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=21
2022-04-28 07:17:34 +00:00
e26517be59 Accepting request 940021 from devel:languages:python
OBS-URL: https://build.opensuse.org/request/show/940021
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-tornado6?expand=0&rev=8
2021-12-13 19:41:47 +00:00
eeb3dbbabd Accepting request 939930 from home:bnavigator:branches:devel:languages:python
OBS-URL: https://build.opensuse.org/request/show/939930
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=20
2021-12-11 23:57:18 +00:00
1ae9d06e7c Accepting request 910351 from devel:languages:python
OBS-URL: https://build.opensuse.org/request/show/910351
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-tornado6?expand=0&rev=7
2021-08-06 20:44:31 +00:00
08cc04f4d3 Accepting request 910321 from home:bnavigator:branches:devel:languages:python
- Remove exec bits from demos: fix boo#1189066
- Add python-tornado6-rpmlintrc for empty JS resource in demo

OBS-URL: https://build.opensuse.org/request/show/910321
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=19
2021-08-05 15:36:07 +00:00
d19502ca00 Accepting request 870435 from devel:languages:python
OBS-URL: https://build.opensuse.org/request/show/870435
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-tornado6?expand=0&rev=6
2021-02-15 22:10:17 +00:00
a359431735 Accepting request 870424 from home:bnavigator:branches:devel:languages:python
- back to version 6.1. Tornado pin in distributed is removed.
- Dear bot, here are the patch names:
  * re-drop python-tornado6-httpclient-test.patch
  * re-drop skip-failing-tests.patch
  * re-drop tornado-testsuite_timeout.patch
  * refreshed ignore-resourcewarning-doctests.patch

OBS-URL: https://build.opensuse.org/request/show/870424
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=17
2021-02-09 09:42:17 +00:00
891d9f45e1 - Adds back patches:
* python-tornado6-httpclient-test.patch
  * skip-failing-tests.patch
  * tornado-testsuite_timeout.patch

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=16
2021-02-08 16:30:50 +00:00
d10f9ef2bf - Revert back to 6.0.4 for incompatibility with python-distributed.
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=15
2021-02-07 12:56:34 +00:00
5e1dd37bfb Accepting request 868432 from devel:languages:python
OBS-URL: https://build.opensuse.org/request/show/868432
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-tornado6?expand=0&rev=5
2021-02-04 19:22:58 +00:00
e99de4e2d1 Accepting request 868396 from home:bnavigator:branches:devel:languages:python
- Update to version 6.1.0
  * Full changelog can be found at
    https://www.tornadoweb.org/en/stable/releases/v6.1.0.html
- Drop patches not applying anymore.
  * python-tornado6-httpclient-test.patch
  * skip-failing-tests.patch
  * tornado-testsuite_timeout.patch
- Refresh and comment ignore-resourcewarning-doctests.patch
- Fix documentation deduplication

OBS-URL: https://build.opensuse.org/request/show/868396
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=13
2021-02-01 17:34:14 +00:00
dd1f66e82d Accepting request 800447 from devel:languages:python
OBS-URL: https://build.opensuse.org/request/show/800447
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-tornado6?expand=0&rev=4
2020-05-08 21:00:40 +00:00
Tomáš Chvátal
cd0da1faa3 Accepting request 800438 from home:pmonrealgonzalez:branches:devel:languages:python
- Fix build with curl 7.70.0:
  * Revert commit c443fb7bf8a87ba8ab02b9a6af9e140cabc0ab0d which
    introduces test_method_after_redirect() test.
- Add python-tornado6-httpclient-test.patch

OBS-URL: https://build.opensuse.org/request/show/800438
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=11
2020-05-05 18:06:11 +00:00
ed55724a09 Accepting request 783780 from devel:languages:python
OBS-URL: https://build.opensuse.org/request/show/783780
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-tornado6?expand=0&rev=3
2020-03-26 23:19:53 +00:00
Tomáš Chvátal
7636501f08 Accepting request 783774 from home:pgajdos:python
- version update to 6.0.4
  General changes
  ~~~~~~~~~~~~~~
    ``asyncio.set_event_loop_policy(asyncio.WindowsSelectorEventLoopPolicy())`` for
    this platform/version.
  Bug fixes
  ~~~~~~~~
  - Fixed an issue in `.IOStream` (introduced in 6.0.0) that resulted in
    ``StreamClosedError`` being incorrectly raised if a stream is closed mid-read
    but there is enough buffered data to satisfy the read.
  - `.AnyThreadEventLoopPolicy` now always uses the selector event loop on Windows.
- modified patches
  % ignore-resourcewarning-doctests.patch (refreshed)
  % skip-failing-tests.patch (refreshed)
  % tornado-testsuite_timeout.patch (refreshed)

OBS-URL: https://build.opensuse.org/request/show/783774
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=9
2020-03-11 11:21:53 +00:00
218ec0c5e2 Accepting request 749161 from devel:languages:python
- Add ignore-resourcewarning-doctests.patch to ignore ResourceWarnings
  when running doctests.
- Use %autopatch macro instead of specific patch number macros

- Define TRAVIS to disable unreliable tests

- Replace %fdupes -s with plain %fdupes; hardlinks are better.

OBS-URL: https://build.opensuse.org/request/show/749161
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-tornado6?expand=0&rev=2
2019-11-22 09:25:33 +00:00
444c98fdb2 - Add ignore-resourcewarning-doctests.patch to ignore ResourceWarnings
when running doctests.
- Use %autopatch macro instead of specific patch number macros

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=7
2019-11-18 04:02:23 +00:00
Tomáš Chvátal
ffd7e28fa4 - Define TRAVIS to disable unreliable tests
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=6
2019-11-08 15:02:44 +00:00
9a501a531a Accepting request 737143 from devel:languages:python
Add py-tornado5

OBS-URL: https://build.opensuse.org/request/show/737143
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-tornado6?expand=0&rev=1
2019-11-07 22:12:21 +00:00
cef319f125 - Replace %fdupes -s with plain %fdupes; hardlinks are better.
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=4
2019-10-14 14:46:09 +00:00
f0c8cba7cc Accepting request 737135 from home:dimstar:Factory
- Provide versioned python-tornado symbol, making this package a
  full option in case the meta package is not applicable.

OBS-URL: https://build.opensuse.org/request/show/737135
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=3
2019-10-10 14:13:25 +00:00
Tomáš Chvátal
58645cf8ce - Per discussion with RM switch back to python-tornado<version>
system with python-tornado standing in as a metapkg

- Provide and obsolete python-toro that was integrated in tornado

- Minimal version is 3.5 and as such remove 3.4 compat deps
- Change this package back to latest python tornado to use
  same approach like we do with pytest

- Provide %oldpython-tornado symbol too

- Reduce the conflicts even more

- Remove duplicate entry

- Remove cruft dependencies that should not be needed

- Switch to tornado 4 temporarily.

- Conflicts fixes

- Fix package name

- Split tornado versions into their own packages.
  This package now depends on the current preferred version.
- Remove patches since there is no longer a source here:
  * asyncio.patch
  * openssl-cert-size.patch
  * skip-failing-tests.patch
  * tornado-testsuite_timeout.patch

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=2
2019-10-01 13:30:32 +00:00
Tomáš Chvátal
9e9667542f osc copypac from project:devel:languages:python package:python-tornado revision:115, using expand
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-tornado6?expand=0&rev=1
2019-10-01 13:26:17 +00:00
11 changed files with 400 additions and 101 deletions

113
CVE-2025-67724.patch Normal file
View File

@@ -0,0 +1,113 @@
From 9c163aebeaad9e6e7d28bac1f33580eb00b0e421 Mon Sep 17 00:00:00 2001
From: Ben Darnell <ben@bendarnell.com>
Date: Wed, 10 Dec 2025 15:15:25 -0500
Subject: [PATCH] web: Harden against invalid HTTP reason phrases
We allow applications to set custom reason phrases for the HTTP status
line (to support custom status codes), but if this were exposed to
untrusted data it could be exploited in various ways. This commit
guards against invalid reason phrases in both HTTP headers and in
error pages.
---
tornado/test/web_test.py | 15 ++++++++++++++-
tornado/web.py | 25 +++++++++++++++++++------
2 files changed, 33 insertions(+), 7 deletions(-)
Index: tornado-6.5/tornado/test/web_test.py
===================================================================
--- tornado-6.5.orig/tornado/test/web_test.py
+++ tornado-6.5/tornado/test/web_test.py
@@ -1746,7 +1746,7 @@ class StatusReasonTest(SimpleHandlerTest
class Handler(RequestHandler):
def get(self):
reason = self.request.arguments.get("reason", [])
- self.set_status(
+ raise HTTPError(
int(self.get_argument("code")),
reason=to_unicode(reason[0]) if reason else None,
)
@@ -1769,6 +1769,19 @@ class StatusReasonTest(SimpleHandlerTest
self.assertEqual(response.code, 682)
self.assertEqual(response.reason, "Unknown")
+ def test_header_injection(self):
+ response = self.fetch("/?code=200&reason=OK%0D%0AX-Injection:injected")
+ self.assertEqual(response.code, 200)
+ self.assertEqual(response.reason, "Unknown")
+ self.assertNotIn("X-Injection", response.headers)
+
+ def test_reason_xss(self):
+ response = self.fetch("/?code=400&reason=<script>alert(1)</script>")
+ self.assertEqual(response.code, 400)
+ self.assertEqual(response.reason, "Unknown")
+ self.assertNotIn(b"script", response.body)
+ self.assertIn(b"Unknown", response.body)
+
class DateHeaderTest(SimpleHandlerTestCase):
class Handler(RequestHandler):
Index: tornado-6.5/tornado/web.py
===================================================================
--- tornado-6.5.orig/tornado/web.py
+++ tornado-6.5/tornado/web.py
@@ -359,8 +359,10 @@ class RequestHandler:
:arg int status_code: Response status code.
:arg str reason: Human-readable reason phrase describing the status
- code. If ``None``, it will be filled in from
- `http.client.responses` or "Unknown".
+ code (for example, the "Not Found" in ``HTTP/1.1 404 Not Found``).
+ Normally determined automatically from `http.client.responses`; this
+ argument should only be used if you need to use a non-standard
+ status code.
.. versionchanged:: 5.0
@@ -369,6 +371,14 @@ class RequestHandler:
"""
self._status_code = status_code
if reason is not None:
+ if "<" in reason or not httputil._ABNF.reason_phrase.fullmatch(reason):
+ # Logically this would be better as an exception, but this method
+ # is called on error-handling paths that would need some refactoring
+ # to tolerate internal errors cleanly.
+ #
+ # The check for "<" is a defense-in-depth against XSS attacks (we also
+ # escape the reason when rendering error pages).
+ reason = "Unknown"
self._reason = escape.native_str(reason)
else:
self._reason = httputil.responses.get(status_code, "Unknown")
@@ -1345,7 +1355,8 @@ class RequestHandler:
reason = exception.reason
self.set_status(status_code, reason=reason)
try:
- self.write_error(status_code, **kwargs)
+ if status_code != 304:
+ self.write_error(status_code, **kwargs)
except Exception:
app_log.error("Uncaught exception in write_error", exc_info=True)
if not self._finished:
@@ -1373,7 +1384,7 @@ class RequestHandler:
self.finish(
"<html><title>%(code)d: %(message)s</title>"
"<body>%(code)d: %(message)s</body></html>"
- % {"code": status_code, "message": self._reason}
+ % {"code": status_code, "message": escape.xhtml_escape(self._reason)}
)
@property
@@ -2520,9 +2531,11 @@ class HTTPError(Exception):
mode). May contain ``%s``-style placeholders, which will be filled
in with remaining positional parameters.
:arg str reason: Keyword-only argument. The HTTP "reason" phrase
- to pass in the status line along with ``status_code``. Normally
+ to pass in the status line along with ``status_code`` (for example,
+ the "Not Found" in ``HTTP/1.1 404 Not Found``). Normally
determined automatically from ``status_code``, but can be used
- to use a non-standard numeric code.
+ to use a non-standard numeric code. This is not a general-purpose
+ error message.
"""
def __init__(

124
CVE-2025-67725.patch Normal file
View File

@@ -0,0 +1,124 @@
From 68e81b4a3385161877408a7a49c7ed12b45a614d Mon Sep 17 00:00:00 2001
From: Ben Darnell <ben@bendarnell.com>
Date: Tue, 9 Dec 2025 13:27:27 -0500
Subject: [PATCH] httputil: Fix quadratic performance of repeated header lines
Previouisly, when many header lines with the same name were found
in an HTTP request or response, repeated string concatenation would
result in quadratic performance. This change does the concatenation
lazily (with a cache) so that repeated headers can be processed
efficiently.
Security: The previous behavior allowed a denial of service attack
via a maliciously crafted HTTP message, but only if the
max_header_size was increased from its default of 64kB.
---
tornado/httputil.py | 36 ++++++++++++++++++++++++-----------
tornado/test/httputil_test.py | 15 +++++++++++++++
2 files changed, 40 insertions(+), 11 deletions(-)
Index: tornado-6.5/tornado/httputil.py
===================================================================
--- tornado-6.5.orig/tornado/httputil.py
+++ tornado-6.5/tornado/httputil.py
@@ -183,8 +183,14 @@ class HTTPHeaders(StrMutableMapping):
pass
def __init__(self, *args: typing.Any, **kwargs: str) -> None: # noqa: F811
- self._dict = {} # type: typing.Dict[str, str]
- self._as_list = {} # type: typing.Dict[str, typing.List[str]]
+ # Formally, HTTP headers are a mapping from a field name to a "combined field value",
+ # which may be constructed from multiple field lines by joining them with commas.
+ # In practice, however, some headers (notably Set-Cookie) do not follow this convention,
+ # so we maintain a mapping from field name to a list of field lines in self._as_list.
+ # self._combined_cache is a cache of the combined field values derived from self._as_list
+ # on demand (and cleared whenever the list is modified).
+ self._as_list: dict[str, list[str]] = {}
+ self._combined_cache: dict[str, str] = {}
self._last_key = None # type: Optional[str]
if len(args) == 1 and len(kwargs) == 0 and isinstance(args[0], HTTPHeaders):
# Copy constructor
@@ -207,9 +213,7 @@ class HTTPHeaders(StrMutableMapping):
norm_name = _normalize_header(name)
self._last_key = norm_name
if norm_name in self:
- self._dict[norm_name] = (
- native_str(self[norm_name]) + "," + native_str(value)
- )
+ self._combined_cache.pop(norm_name, None)
self._as_list[norm_name].append(value)
else:
self[norm_name] = value
@@ -266,7 +270,7 @@ class HTTPHeaders(StrMutableMapping):
if not _ABNF.field_value.fullmatch(new_part[1:]):
raise HTTPInputError("Invalid header continuation %r" % new_part)
self._as_list[self._last_key][-1] += new_part
- self._dict[self._last_key] += new_part
+ self._combined_cache.pop(self._last_key, None)
else:
try:
name, value = line.split(":", 1)
@@ -305,22 +309,32 @@ class HTTPHeaders(StrMutableMapping):
def __setitem__(self, name: str, value: str) -> None:
norm_name = _normalize_header(name)
- self._dict[norm_name] = value
+ self._combined_cache[norm_name] = value
self._as_list[norm_name] = [value]
+ def __contains__(self, name: object) -> bool:
+ # This is an important optimization to avoid the expensive concatenation
+ # in __getitem__ when it's not needed.
+ if not isinstance(name, str):
+ return False
+ return name in self._as_list
+
def __getitem__(self, name: str) -> str:
- return self._dict[_normalize_header(name)]
+ header = _normalize_header(name)
+ if header not in self._combined_cache:
+ self._combined_cache[header] = ",".join(self._as_list[header])
+ return self._combined_cache[header]
def __delitem__(self, name: str) -> None:
norm_name = _normalize_header(name)
- del self._dict[norm_name]
+ del self._combined_cache[norm_name]
del self._as_list[norm_name]
def __len__(self) -> int:
- return len(self._dict)
+ return len(self._as_list)
def __iter__(self) -> Iterator[typing.Any]:
- return iter(self._dict)
+ return iter(self._as_list)
def copy(self) -> "HTTPHeaders":
# defined in dict but not in MutableMapping.
Index: tornado-6.5/tornado/test/httputil_test.py
===================================================================
--- tornado-6.5.orig/tornado/test/httputil_test.py
+++ tornado-6.5/tornado/test/httputil_test.py
@@ -534,6 +534,21 @@ class ParseRequestStartLineTest(unittest
self.assertEqual(parsed_start_line.path, self.PATH)
self.assertEqual(parsed_start_line.version, self.VERSION)
+ def test_linear_performance(self):
+ def f(n):
+ start = time.time()
+ headers = HTTPHeaders()
+ for i in range(n):
+ headers.add("X-Foo", "bar")
+ return time.time() - start
+
+ # This runs under 50ms on my laptop as of 2025-12-09.
+ d1 = f(10_000)
+ d2 = f(100_000)
+ if d2 / d1 > 20:
+ # d2 should be about 10x d1 but allow a wide margin for variability.
+ self.fail(f"HTTPHeaders.add() does not scale linearly: {d1=} vs {d2=}")
+
class ParseCookieTest(unittest.TestCase):
# These tests copied from Django:

94
CVE-2025-67726.patch Normal file
View File

@@ -0,0 +1,94 @@
From 771472cfdaeebc0d89a9cc46e249f8891a6b29cd Mon Sep 17 00:00:00 2001
From: Ben Darnell <ben@bendarnell.com>
Date: Wed, 10 Dec 2025 10:55:02 -0500
Subject: [PATCH] httputil: Fix quadratic behavior in _parseparam
Prior to this change, _parseparam had O(n^2) behavior when parsing
certain inputs, which could be a DoS vector. This change adapts
logic from the equivalent function in the python standard library
in https://github.com/python/cpython/pull/136072/files
---
tornado/httputil.py | 29 ++++++++++++++++++++++-------
tornado/test/httputil_test.py | 23 +++++++++++++++++++++++
2 files changed, 45 insertions(+), 7 deletions(-)
Index: tornado-6.5/tornado/httputil.py
===================================================================
--- tornado-6.5.orig/tornado/httputil.py
+++ tornado-6.5/tornado/httputil.py
@@ -1062,19 +1062,34 @@ def parse_response_start_line(line: str)
# It has also been modified to support valueless parameters as seen in
# websocket extension negotiations, and to support non-ascii values in
# RFC 2231/5987 format.
+#
+# _parseparam has been further modified with the logic from
+# https://github.com/python/cpython/pull/136072/files
+# to avoid quadratic behavior when parsing semicolons in quoted strings.
+#
+# TODO: See if we can switch to email.message.Message for this functionality.
+# This is the suggested replacement for the cgi.py module now that cgi has
+# been removed from recent versions of Python. We need to verify that
+# the email module is consistent with our existing behavior (and all relevant
+# RFCs for multipart/form-data) before making this change.
def _parseparam(s: str) -> Generator[str, None, None]:
- while s[:1] == ";":
- s = s[1:]
- end = s.find(";")
- while end > 0 and (s.count('"', 0, end) - s.count('\\"', 0, end)) % 2:
- end = s.find(";", end + 1)
+ start = 0
+ while s.find(";", start) == start:
+ start += 1
+ end = s.find(";", start)
+ ind, diff = start, 0
+ while end > 0:
+ diff += s.count('"', ind, end) - s.count('\\"', ind, end)
+ if diff % 2 == 0:
+ break
+ end, ind = ind, s.find(";", end + 1)
if end < 0:
end = len(s)
- f = s[:end]
+ f = s[start:end]
yield f.strip()
- s = s[end:]
+ start = end
def _parse_header(line: str) -> Tuple[str, Dict[str, str]]:
Index: tornado-6.5/tornado/test/httputil_test.py
===================================================================
--- tornado-6.5.orig/tornado/test/httputil_test.py
+++ tornado-6.5/tornado/test/httputil_test.py
@@ -262,6 +262,29 @@ Foo
self.assertEqual(file["filename"], "ab.txt")
self.assertEqual(file["body"], b"Foo")
+ def test_disposition_param_linear_performance(self):
+ # This is a regression test for performance of parsing parameters
+ # to the content-disposition header, specifically for semicolons within
+ # quoted strings.
+ def f(n):
+ start = time.time()
+ message = (
+ b"--1234\r\nContent-Disposition: form-data; "
+ + b'x="'
+ + b";" * n
+ + b'"; '
+ + b'name="files"; filename="a.txt"\r\n\r\nFoo\r\n--1234--\r\n'
+ )
+ args: dict[str, list[bytes]] = {}
+ files: dict[str, list[HTTPFile]] = {}
+ parse_multipart_form_data(b"1234", message, args, files)
+ return time.time() - start
+
+ d1 = f(1_000)
+ d2 = f(10_000)
+ if d2 / d1 > 20:
+ self.fail(f"Disposition param parsing is not linear: {d1=} vs {d2=}")
+
class HTTPHeadersTest(unittest.TestCase):
def test_multi_line(self):

View File

@@ -1,8 +1,8 @@
Index: tornado-6.0.4/tornado/util.py
Index: tornado-6.5/tornado/util.py
===================================================================
--- tornado-6.0.4.orig/tornado/util.py 2020-03-11 11:42:49.610254636 +0100
+++ tornado-6.0.4/tornado/util.py 2020-03-11 11:43:51.470603323 +0100
@@ -468,5 +468,7 @@ else:
--- tornado-6.5.orig/tornado/util.py
+++ tornado-6.5/tornado/util.py
@@ -441,5 +441,7 @@ else:
def doctests():
# type: () -> unittest.TestSuite
import doctest
@@ -10,11 +10,11 @@ Index: tornado-6.0.4/tornado/util.py
+ warnings.simplefilter("ignore", ResourceWarning)
return doctest.DocTestSuite()
Index: tornado-6.0.4/tornado/httputil.py
Index: tornado-6.5/tornado/httputil.py
===================================================================
--- tornado-6.0.4.orig/tornado/httputil.py 2020-03-11 11:42:49.610254636 +0100
+++ tornado-6.0.4/tornado/httputil.py 2020-03-11 11:44:46.178911693 +0100
@@ -1032,6 +1032,8 @@ def encode_username_password(
--- tornado-6.5.orig/tornado/httputil.py
+++ tornado-6.5/tornado/httputil.py
@@ -1137,6 +1137,8 @@ def encode_username_password(
def doctests():
# type: () -> unittest.TestSuite
import doctest
@@ -23,11 +23,11 @@ Index: tornado-6.0.4/tornado/httputil.py
return doctest.DocTestSuite()
Index: tornado-6.0.4/tornado/iostream.py
Index: tornado-6.5/tornado/iostream.py
===================================================================
--- tornado-6.0.4.orig/tornado/iostream.py 2020-03-11 11:42:49.610254636 +0100
+++ tornado-6.0.4/tornado/iostream.py 2020-03-11 11:45:31.015164413 +0100
@@ -1677,5 +1677,7 @@ class PipeIOStream(BaseIOStream):
--- tornado-6.5.orig/tornado/iostream.py
+++ tornado-6.5/tornado/iostream.py
@@ -1613,5 +1613,7 @@ class PipeIOStream(BaseIOStream):
def doctests() -> Any:
import doctest

View File

@@ -1,13 +0,0 @@
Index: tornado-6.4/tornado/iostream.py
===================================================================
--- tornado-6.4.orig/tornado/iostream.py
+++ tornado-6.4/tornado/iostream.py
@@ -1374,7 +1374,7 @@ class SSLIOStream(IOStream):
return
elif err.args[0] in (ssl.SSL_ERROR_EOF, ssl.SSL_ERROR_ZERO_RETURN):
return self.close(exc_info=err)
- elif err.args[0] == ssl.SSL_ERROR_SSL:
+ elif err.args[0] in (ssl.SSL_ERROR_SSL, ssl.SSL_ERROR_SYSCALL):
try:
peer = self.socket.getpeername()
except Exception:

View File

@@ -1,3 +1,48 @@
-------------------------------------------------------------------
Mon Dec 15 15:35:32 UTC 2025 - Nico Krapp <nico.krapp@suse.com>
- Add security patches:
* CVE-2025-67724.patch (bsc#1254903)
* CVE-2025-67725.patch (bsc#1254905)
* CVE-2025-67726.patch (bsc#1254904)
-------------------------------------------------------------------
Fri May 16 09:23:08 UTC 2025 - Daniel Garcia <daniel.garcia@suse.com>
- Update to 6.5.0 (CVE-2025-47287, bsc#1243268):
* Security Improvements:
- Previously, malformed multipart-form-data requests could log
multiple warnings and constitute a denial-of-service attack. Now
an exception is raised at the first error, so there is only one
log message per request. This fixes CVE-2025-47287.
* General Changes:
- Python 3.14 is now supported. Older versions of Tornado will
work on Python 3.14 but may log deprecation warnings.
- The free-threading mode of Python 3.13 is now supported on an
experimental basis. Prebuilt wheels are not yet available for
this configuration, but it can be built from source.
- The minimum supported Python version is 3.9.
* Deprecation Notices:
- Support for obs-fold continuation lines in HTTP headers is
deprecated and will be removed in Tornado 7.0, as is the use of
carriage returns without line feeds as header separators.
- The callback argument to websocket_connect is deprecated and
will be removed in Tornado 7.0. Note that on_message_callback is
not deprecated.
- The log_message and args attributes of tornado.web.HTTPError are
deprecated. Use the new get_message method instead.
-------------------------------------------------------------------
Mon Nov 25 03:19:20 UTC 2024 - Steve Kowalik <steven.kowalik@suse.com>
- Update to 6.4.2:
+ Security Improvements:
* Parsing of the cookie header is now much more efficient. The older
algorithm sometimes had quadratic performance which allowed for a
denial-of-service attack in which the server would spend excessive
CPU time parsing cookies and block the event loop.
(CVE-2024-52804, bsc#1233668)
-------------------------------------------------------------------
Wed Jul 31 09:32:23 UTC 2024 - Dominique Leuenberger <dimstar@opensuse.org>

View File

@@ -1,7 +1,7 @@
#
# spec file for package python-tornado6
#
# Copyright (c) 2024 SUSE LLC
# Copyright (c) 2025 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -17,9 +17,8 @@
%{?sle15_python_module_pythons}
%define skip_python2 1
Name: python-tornado6
Version: 6.4.1
Version: 6.5
Release: 0
Summary: Open source version of scalable, non-blocking web server that power FriendFeed
License: Apache-2.0
@@ -28,6 +27,12 @@ Source: https://files.pythonhosted.org/packages/source/t/tornado/tornado
Source99: python-tornado6-rpmlintrc
# PATCH-FIX-OPENSUSE ignore-resourcewarning-doctests.patch -- ignore resource warnings on OBS
Patch0: ignore-resourcewarning-doctests.patch
# PATCH-FIX-UPSTREAM CVE-2025-67724.patch bsc#1254903
Patch1: CVE-2025-67724.patch
# PATCH-FIX-UPSTREAM CVE-2025-67725.patch bsc#1254905
Patch2: CVE-2025-67725.patch
# PATCH-FIX-UPSTREAM CVE-2025-67726.patch bsc#1254904
Patch3: CVE-2025-67726.patch
BuildRequires: %{python_module base >= 3.8}
BuildRequires: %{python_module devel}
BuildRequires: %{python_module pip}
@@ -104,6 +109,6 @@ export TRAVIS=1
%license LICENSE
%doc %{_docdir}/%{python_prefix}-tornado6
%{python_sitearch}/tornado
%{python_sitearch}/tornado-%{version}*-info
%{python_sitearch}/tornado-%{version}.dist-info
%changelog

View File

@@ -1,66 +0,0 @@
From c851aa8a949524b35f72c82b45a52353aa3c0558 Mon Sep 17 00:00:00 2001
From: Ran Benita <ran@unusedvar.com>
Date: Sun, 28 Apr 2024 14:17:54 +0300
Subject: [PATCH] testing: allow to instantiate an empty AsyncTestCase
`unittest.TestCase` has a feature where it allows instantiating
`MyTestClass()` with the default method name `runTest` even if a
`runTest` method doesn't actually exist. This is documented in
`TestCase`'s docs under "Changed in version 3.2"[0].
Since version 8.2, pytest relies on this, and started breaking on
Tornado's `AsyncTestCase`[1].
Change `AsyncTestCase` to allow empty instatiation, by matching the
upstream code.
[0] https://docs.python.org/3/library/unittest.html#unittest.TestCase
[1] https://github.com/pytest-dev/pytest/issues/12263
---
tornado/test/testing_test.py | 9 +++++++++
tornado/testing.py | 12 +++++++++++-
2 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/tornado/test/testing_test.py b/tornado/test/testing_test.py
index 0429feee83..8e2b8db428 100644
--- a/tornado/test/testing_test.py
+++ b/tornado/test/testing_test.py
@@ -61,6 +61,15 @@ def test_subsequent_wait_calls(self):
self.io_loop.add_timeout(self.io_loop.time() + 0.2, self.stop)
self.wait(timeout=0.4)
+ def test_empty_instantation_is_allowed(self):
+ """
+ Test that empty instatiation of an AsyncTestCase is allowed.
+
+ unittest.TestCase docs guarantee this working, and pytest's unittest
+ support relies on it.
+ """
+ AsyncTestCaseTest()
+
class LeakTest(AsyncTestCase):
def tearDown(self):
diff --git a/tornado/testing.py b/tornado/testing.py
index bdbff87bc3..9455411a6d 100644
--- a/tornado/testing.py
+++ b/tornado/testing.py
@@ -177,7 +177,17 @@ def __init__(self, methodName: str = "runTest") -> None:
# the test will silently be ignored because nothing will consume
# the generator. Replace the test method with a wrapper that will
# make sure it's not an undecorated generator.
- setattr(self, methodName, _TestMethodWrapper(getattr(self, methodName)))
+ try:
+ test_method = getattr(self, methodName)
+ except AttributeError:
+ if methodName != "runTest":
+ # We allow instantiation with no explicit method name
+ # but not an *incorrect* or missing method name.
+ raise ValueError(
+ "no such test method in %s: %s" % (self.__class__, methodName)
+ )
+ else:
+ setattr(self, methodName, _TestMethodWrapper(test_method))
# Not used in this class itself, but used by @gen_test
self._test_generator = None # type: Optional[Union[Generator, Coroutine]]

View File

@@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:92d3ab53183d8c50f8204a51e6f91d18a15d5ef261e84d452800d4ff6fc504e9
size 500623

Binary file not shown.

BIN
tornado-6.5.tar.gz LFS Normal file

Binary file not shown.