forked from pool/python
- fixed a security flaw where malicious sites could redirect
Python application from http to a local file (CVE-2011-1521, bnc#682554) - fixed race condition in Makefile which randomly failed parallel builds ( http://bugs.python.org/issue10013 ) OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python?expand=0&rev=94
This commit is contained in:
Jan Matejek
Git OBS Bridge
parent
238d8e6b32
commit
ef4beb4804
106
python-2.7-CVE-2011-1521-fileurl.patch
Normal file
106
python-2.7-CVE-2011-1521-fileurl.patch
Normal file
@ -0,0 +1,106 @@
|
|||||||
|
|
||||||
|
# HG changeset patch
|
||||||
|
# User Guido van Rossum <guido@python.org>
|
||||||
|
# Date 1301428435 25200
|
||||||
|
# Node ID b2934d98dac1f7b13cc6cc280f06d1aec3f6e80d
|
||||||
|
# Parent 1a5aab273332a7a379e35ed6f88400a110b5de0c# Parent 9eeda8e3a13f107a698f10b0a45ffc2c6bd710fb
|
||||||
|
Merge issue 11662 from 2.6.
|
||||||
|
|
||||||
|
diff --git a/Lib/test/test_urllib.py b/Lib/test/test_urllib.py
|
||||||
|
--- a/Lib/test/test_urllib.py
|
||||||
|
+++ b/Lib/test/test_urllib.py
|
||||||
|
@@ -161,6 +161,20 @@ Content-Type: text/html; charset=iso-885
|
||||||
|
finally:
|
||||||
|
self.unfakehttp()
|
||||||
|
|
||||||
|
+ def test_invalid_redirect(self):
|
||||||
|
+ # urlopen() should raise IOError for many error codes.
|
||||||
|
+ self.fakehttp("""HTTP/1.1 302 Found
|
||||||
|
+Date: Wed, 02 Jan 2008 03:03:54 GMT
|
||||||
|
+Server: Apache/1.3.33 (Debian GNU/Linux) mod_ssl/2.8.22 OpenSSL/0.9.7e
|
||||||
|
+Location: file:README
|
||||||
|
+Connection: close
|
||||||
|
+Content-Type: text/html; charset=iso-8859-1
|
||||||
|
+""")
|
||||||
|
+ try:
|
||||||
|
+ self.assertRaises(IOError, urllib.urlopen, "http://python.org/")
|
||||||
|
+ finally:
|
||||||
|
+ self.unfakehttp()
|
||||||
|
+
|
||||||
|
def test_empty_socket(self):
|
||||||
|
# urlopen() raises IOError if the underlying socket does not send any
|
||||||
|
# data. (#1680230)
|
||||||
|
diff --git a/Lib/test/test_urllib2.py b/Lib/test/test_urllib2.py
|
||||||
|
--- a/Lib/test/test_urllib2.py
|
||||||
|
+++ b/Lib/test/test_urllib2.py
|
||||||
|
@@ -969,6 +969,27 @@ class HandlerTests(unittest.TestCase):
|
||||||
|
self.assertEqual(count,
|
||||||
|
urllib2.HTTPRedirectHandler.max_redirections)
|
||||||
|
|
||||||
|
+ def test_invalid_redirect(self):
|
||||||
|
+ from_url = "http://example.com/a.html"
|
||||||
|
+ valid_schemes = ['http', 'https', 'ftp']
|
||||||
|
+ invalid_schemes = ['file', 'imap', 'ldap']
|
||||||
|
+ schemeless_url = "example.com/b.html"
|
||||||
|
+ h = urllib2.HTTPRedirectHandler()
|
||||||
|
+ o = h.parent = MockOpener()
|
||||||
|
+ req = Request(from_url)
|
||||||
|
+
|
||||||
|
+ for scheme in invalid_schemes:
|
||||||
|
+ invalid_url = scheme + '://' + schemeless_url
|
||||||
|
+ self.assertRaises(urllib2.HTTPError, h.http_error_302,
|
||||||
|
+ req, MockFile(), 302, "Security Loophole",
|
||||||
|
+ MockHeaders({"location": invalid_url}))
|
||||||
|
+
|
||||||
|
+ for scheme in valid_schemes:
|
||||||
|
+ valid_url = scheme + '://' + schemeless_url
|
||||||
|
+ h.http_error_302(req, MockFile(), 302, "That's fine",
|
||||||
|
+ MockHeaders({"location": valid_url}))
|
||||||
|
+ self.assertEqual(o.req.get_full_url(), valid_url)
|
||||||
|
+
|
||||||
|
def test_cookie_redirect(self):
|
||||||
|
# cookies shouldn't leak into redirected requests
|
||||||
|
from cookielib import CookieJar
|
||||||
|
diff --git a/Lib/urllib.py b/Lib/urllib.py
|
||||||
|
--- a/Lib/urllib.py
|
||||||
|
+++ b/Lib/urllib.py
|
||||||
|
@@ -644,6 +644,18 @@ class FancyURLopener(URLopener):
|
||||||
|
fp.close()
|
||||||
|
# In case the server sent a relative URL, join with original:
|
||||||
|
newurl = basejoin(self.type + ":" + url, newurl)
|
||||||
|
+
|
||||||
|
+ # For security reasons we do not allow redirects to protocols
|
||||||
|
+ # other than HTTP, HTTPS or FTP.
|
||||||
|
+ newurl_lower = newurl.lower()
|
||||||
|
+ if not (newurl_lower.startswith('http://') or
|
||||||
|
+ newurl_lower.startswith('https://') or
|
||||||
|
+ newurl_lower.startswith('ftp://')):
|
||||||
|
+ raise IOError('redirect error', errcode,
|
||||||
|
+ errmsg + " - Redirection to url '%s' is not allowed" %
|
||||||
|
+ newurl,
|
||||||
|
+ headers)
|
||||||
|
+
|
||||||
|
return self.open(newurl)
|
||||||
|
|
||||||
|
def http_error_301(self, url, fp, errcode, errmsg, headers, data=None):
|
||||||
|
diff --git a/Lib/urllib2.py b/Lib/urllib2.py
|
||||||
|
--- a/Lib/urllib2.py
|
||||||
|
+++ b/Lib/urllib2.py
|
||||||
|
@@ -578,6 +578,17 @@ class HTTPRedirectHandler(BaseHandler):
|
||||||
|
|
||||||
|
newurl = urlparse.urljoin(req.get_full_url(), newurl)
|
||||||
|
|
||||||
|
+ # For security reasons we do not allow redirects to protocols
|
||||||
|
+ # other than HTTP, HTTPS or FTP.
|
||||||
|
+ newurl_lower = newurl.lower()
|
||||||
|
+ if not (newurl_lower.startswith('http://') or
|
||||||
|
+ newurl_lower.startswith('https://') or
|
||||||
|
+ newurl_lower.startswith('ftp://')):
|
||||||
|
+ raise HTTPError(newurl, code,
|
||||||
|
+ msg + " - Redirection to url '%s' is not allowed" %
|
||||||
|
+ newurl,
|
||||||
|
+ headers, fp)
|
||||||
|
+
|
||||||
|
# XXX Probably want to forget about the state of the current
|
||||||
|
# request, although that might interact poorly with other
|
||||||
|
# handlers that also use handler-specific request attributes
|
||||||
37
python-2.7-fix-parallel-make.patch
Normal file
37
python-2.7-fix-parallel-make.patch
Normal file
@ -0,0 +1,37 @@
|
|||||||
|
diff -up Python-2.7/Makefile.pre.in.fix-parallel-make Python-2.7/Makefile.pre.in
|
||||||
|
--- Python-2.7/Makefile.pre.in.fix-parallel-make 2010-07-22 15:01:39.567996932 -0400
|
||||||
|
+++ Python-2.7/Makefile.pre.in 2010-07-22 15:47:02.437998509 -0400
|
||||||
|
@@ -207,6 +207,7 @@ SIGNAL_OBJS= @SIGNAL_OBJS@
|
||||||
|
|
||||||
|
##########################################################################
|
||||||
|
# Grammar
|
||||||
|
+GRAMMAR_STAMP= $(srcdir)/grammar-stamp
|
||||||
|
GRAMMAR_H= $(srcdir)/Include/graminit.h
|
||||||
|
GRAMMAR_C= $(srcdir)/Python/graminit.c
|
||||||
|
GRAMMAR_INPUT= $(srcdir)/Grammar/Grammar
|
||||||
|
@@ -530,10 +531,24 @@ Modules/getpath.o: $(srcdir)/Modules/get
|
||||||
|
Modules/python.o: $(srcdir)/Modules/python.c
|
||||||
|
$(MAINCC) -c $(PY_CFLAGS) -o $@ $(srcdir)/Modules/python.c
|
||||||
|
|
||||||
|
+# GNU "make" interprets rules with two dependents as two copies of the rule.
|
||||||
|
+#
|
||||||
|
+# In a parallel build this can lead to pgen being run twice, once for each of
|
||||||
|
+# GRAMMAR_H and GRAMMAR_C, leading to race conditions in which the compiler
|
||||||
|
+# reads a partially-overwritten copy of one of these files, leading to syntax
|
||||||
|
+# errors (or linker errors if the fragment happens to be syntactically valid C)
|
||||||
|
+#
|
||||||
|
+# See http://www.gnu.org/software/hello/manual/automake/Multiple-Outputs.html
|
||||||
|
+# for more information
|
||||||
|
+#
|
||||||
|
+# Introduce ".grammar-stamp" as a contrived single output from PGEN to avoid
|
||||||
|
+# this:
|
||||||
|
+$(GRAMMAR_H) $(GRAMMAR_C): $(GRAMMAR_STAMP)
|
||||||
|
|
||||||
|
-$(GRAMMAR_H) $(GRAMMAR_C): $(PGEN) $(GRAMMAR_INPUT)
|
||||||
|
+$(GRAMMAR_STAMP): $(PGEN) $(GRAMMAR_INPUT)
|
||||||
|
-@$(INSTALL) -d Include
|
||||||
|
-$(PGEN) $(GRAMMAR_INPUT) $(GRAMMAR_H) $(GRAMMAR_C)
|
||||||
|
+ touch $(GRAMMAR_STAMP)
|
||||||
|
|
||||||
|
$(PGEN): $(PGENOBJS)
|
||||||
|
$(CC) $(OPT) $(LDFLAGS) $(PGENOBJS) $(LIBS) -o $(PGEN)
|
||||||
@ -1,3 +1,12 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Mon May 2 16:04:49 UTC 2011 - jmatejek@novell.com
|
||||||
|
|
||||||
|
- fixed a security flaw where malicious sites could redirect
|
||||||
|
Python application from http to a local file
|
||||||
|
(CVE-2011-1521, bnc#682554)
|
||||||
|
- fixed race condition in Makefile which randomly failed
|
||||||
|
parallel builds ( http://bugs.python.org/issue10013 )
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Thu Feb 17 17:37:09 CET 2011 - pth@suse.de
|
Thu Feb 17 17:37:09 CET 2011 - pth@suse.de
|
||||||
|
|
||||||
|
|||||||
@ -53,6 +53,8 @@ Patch10: urllib2-AbstractBasicAuthHandler_reset_attr.diff
|
|||||||
Patch11: smtpd-dos.patch
|
Patch11: smtpd-dos.patch
|
||||||
Patch12: http://psf.upfronthosting.co.za/roundup/tracker/file19029/python-test_structmembers.patch
|
Patch12: http://psf.upfronthosting.co.za/roundup/tracker/file19029/python-test_structmembers.patch
|
||||||
Patch13: python-fix_date_time_compiler.patch
|
Patch13: python-fix_date_time_compiler.patch
|
||||||
|
Patch14: python-2.7-CVE-2011-1521-fileurl.patch
|
||||||
|
Patch15: python-2.7-fix-parallel-make.patch
|
||||||
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
||||||
%define python_version %(echo %{version} | head -c 3)
|
%define python_version %(echo %{version} | head -c 3)
|
||||||
Provides: %{name} = %{python_version}
|
Provides: %{name} = %{python_version}
|
||||||
@ -145,8 +147,10 @@ Authors:
|
|||||||
%patch9 -p1
|
%patch9 -p1
|
||||||
%patch10
|
%patch10
|
||||||
%patch11
|
%patch11
|
||||||
%patch12 -p0
|
%patch12
|
||||||
%patch13
|
%patch13
|
||||||
|
%patch14 -p1
|
||||||
|
%patch15 -p1
|
||||||
|
|
||||||
# some cleanup
|
# some cleanup
|
||||||
find . -name .cvsignore -type f -print0 | xargs -0 rm -f
|
find . -name .cvsignore -type f -print0 | xargs -0 rm -f
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user