import sources
This commit is contained in:
Adam Samalik
commit
3615869ee0
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
@ -0,0 +1 @@
|
||||
/bottle-0.12.13.tar.gz
|
||||
33
0001-bottle-0.12.13-CVE-2020-28473.patch
Normal file
33
0001-bottle-0.12.13-CVE-2020-28473.patch
Normal file
@ -0,0 +1,33 @@
|
||||
From 6406338d47034d3d2e6678bdbdafafa6a6e35b2c Mon Sep 17 00:00:00 2001
|
||||
From: Marcel Hellkamp <marc@gsites.de>
|
||||
Date: Wed, 11 Nov 2020 19:24:29 +0100
|
||||
Subject: [PATCH] Do not split query strings on `;` anymore.
|
||||
|
||||
Using `;` as a separator instead of `&` was allowed a long time ago,
|
||||
but is now obsolete and actually invalid according to the 2014 W3C
|
||||
recommendations. Even if this change is technically backwards-incompatible,
|
||||
no real-world application should depend on broken behavior. If you REALLY
|
||||
need this functionality, monkey-patch the _parse_qsl() function.
|
||||
|
||||
Upstream-commit: 57a2f22e0c1d2b328c4f54bf75741d74f47f1a6b
|
||||
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
||||
---
|
||||
bottle.py | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/bottle.py b/bottle.py
|
||||
index 250a925..94fe8a6 100644
|
||||
--- a/bottle.py
|
||||
+++ b/bottle.py
|
||||
@@ -2576,7 +2576,7 @@ def parse_range_header(header, maxlen=0):
|
||||
|
||||
def _parse_qsl(qs):
|
||||
r = []
|
||||
- for pair in qs.replace(';','&').split('&'):
|
||||
+ for pair in qs.split('&'):
|
||||
if not pair: continue
|
||||
nv = pair.split('=', 1)
|
||||
if len(nv) != 2: nv.append('')
|
||||
--
|
||||
2.26.3
|
||||
|
||||
45
0002-bottle-0.12.13-CVE-2022-31799.patch
Normal file
45
0002-bottle-0.12.13-CVE-2022-31799.patch
Normal file
@ -0,0 +1,45 @@
|
||||
From db0c0e711b0eb95df592d22890a043e2c0dd741e Mon Sep 17 00:00:00 2001
|
||||
From: Marcel Hellkamp <marc@gsites.de>
|
||||
Date: Thu, 26 May 2022 14:49:32 +0200
|
||||
Subject: [PATCH] Gracefully handle errors during early request binding.
|
||||
|
||||
Upstream-commit: e140e1b54da721a660f2eb9d58a106b7b3ff2f00
|
||||
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
||||
---
|
||||
bottle.py | 16 +++++++++-------
|
||||
1 file changed, 9 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/bottle.py b/bottle.py
|
||||
index 94fe8a6..74cb169 100644
|
||||
--- a/bottle.py
|
||||
+++ b/bottle.py
|
||||
@@ -841,17 +841,19 @@ class Bottle(object):
|
||||
return tob(template(ERROR_PAGE_TEMPLATE, e=res))
|
||||
|
||||
def _handle(self, environ):
|
||||
- path = environ['bottle.raw_path'] = environ['PATH_INFO']
|
||||
- if py3k:
|
||||
- try:
|
||||
- environ['PATH_INFO'] = path.encode('latin1').decode('utf8')
|
||||
- except UnicodeError:
|
||||
- return HTTPError(400, 'Invalid path string. Expected UTF-8')
|
||||
-
|
||||
try:
|
||||
+
|
||||
environ['bottle.app'] = self
|
||||
request.bind(environ)
|
||||
response.bind()
|
||||
+
|
||||
+ path = environ['bottle.raw_path'] = environ['PATH_INFO']
|
||||
+ if py3k:
|
||||
+ try:
|
||||
+ environ['PATH_INFO'] = path.encode('latin1').decode('utf8')
|
||||
+ except UnicodeError:
|
||||
+ return HTTPError(400, 'Invalid path string. Expected UTF-8')
|
||||
+
|
||||
try:
|
||||
self.trigger_hook('before_request')
|
||||
route, args = self.router.match(environ)
|
||||
--
|
||||
2.37.1
|
||||
|
||||
184
python-bottle.spec
Normal file
184
python-bottle.spec
Normal file
@ -0,0 +1,184 @@
|
||||
%global srcname bottle
|
||||
|
||||
%if 0%{?rhel} > 7
|
||||
# Disable python2 build by default
|
||||
%bcond_with python2
|
||||
%else
|
||||
%bcond_without python2
|
||||
%endif
|
||||
|
||||
Name: python-%{srcname}
|
||||
Version: 0.12.13
|
||||
Release: 7%{?dist}
|
||||
Summary: Fast and simple WSGI-framework for small web-applications
|
||||
|
||||
Group: Development/Languages
|
||||
License: MIT
|
||||
URL: http://bottlepy.org
|
||||
Source0: https://github.com/bottlepy/%{srcname}/archive/%{version}.tar.gz#/%{srcname}-%{version}.tar.gz
|
||||
|
||||
# Do not split query strings on `;` anymore (CVE-2020-28473)
|
||||
Patch1: 0001-bottle-0.12.13-CVE-2020-28473.patch
|
||||
|
||||
# Gracefully handle errors during early request binding (CVE-2022-31799)
|
||||
Patch2: 0002-bottle-0.12.13-CVE-2022-31799.patch
|
||||
|
||||
BuildArch: noarch
|
||||
%if %{with python2}
|
||||
BuildRequires: python2-devel
|
||||
BuildRequires: python2-setuptools
|
||||
%endif # with python2
|
||||
|
||||
BuildRequires: python%{python3_pkgversion}-devel
|
||||
BuildRequires: python%{python3_pkgversion}-setuptools
|
||||
|
||||
%description
|
||||
Bottle is a fast and simple micro-framework for small web-applications.
|
||||
It offers request dispatching (Routes) with URL parameter support, Templates,
|
||||
a built-in HTTP Server and adapters for many third party WSGI/HTTP-server and
|
||||
template engines. All in a single file and with no dependencies other than the
|
||||
Python Standard Library.
|
||||
|
||||
%if %{with python2}
|
||||
%package -n python2-%{srcname}
|
||||
Summary: Fast and simple WSGI-framework for small web-applications
|
||||
%{?python_provide:%python_provide python2-%{srcname}}
|
||||
|
||||
%description -n python2-%{srcname}
|
||||
Bottle is a fast and simple micro-framework for small web-applications.
|
||||
It offers request dispatching (Routes) with URL parameter support, Templates,
|
||||
a built-in HTTP Server and adapters for many third party WSGI/HTTP-server and
|
||||
template engines. All in a single file and with no dependencies other than the
|
||||
Python Standard Library.
|
||||
%endif # with python2
|
||||
|
||||
%package -n python%{python3_pkgversion}-%{srcname}
|
||||
Summary: Fast and simple WSGI-framework for small web-applications
|
||||
%{?python_provide:%python_provide python%{python3_pkgversion}-%{srcname}}
|
||||
|
||||
%description -n python%{python3_pkgversion}-%{srcname}
|
||||
Bottle is a fast and simple micro-framework for small web-applications.
|
||||
It offers request dispatching (Routes) with URL parameter support, Templates,
|
||||
a built-in HTTP Server and adapters for many third party WSGI/HTTP-server and
|
||||
template engines. All in a single file and with no dependencies other than the
|
||||
Python Standard Library.
|
||||
|
||||
%prep
|
||||
%setup -q -n %{srcname}-%{version}
|
||||
sed -i '/^#!/d' bottle.py
|
||||
%patch1 -p1
|
||||
%patch2 -p1
|
||||
|
||||
%build
|
||||
%if %{with python2}
|
||||
%py2_build
|
||||
%endif # with python2
|
||||
%py3_build
|
||||
|
||||
%install
|
||||
%if %{with python2}
|
||||
%py2_install
|
||||
%endif # with python2
|
||||
%py3_install
|
||||
rm %{buildroot}%{_bindir}/bottle.py
|
||||
|
||||
%check
|
||||
%if %{with python2}
|
||||
%__python2 test/testall.py verbose
|
||||
%endif # with python2
|
||||
# Fails
|
||||
# FAIL: test_delete_cookie (test_environ.TestResponse)
|
||||
%__python3 test/testall.py verbose || :
|
||||
|
||||
%if %{with python2}
|
||||
%files -n python2-%{srcname}
|
||||
%license LICENSE
|
||||
%doc AUTHORS README.rst
|
||||
%{python2_sitelib}/*
|
||||
%endif # with python2
|
||||
|
||||
%files -n python%{python3_pkgversion}-%{srcname}
|
||||
%license LICENSE
|
||||
%doc AUTHORS README.rst
|
||||
%{python3_sitelib}/__pycache__/*
|
||||
%{python3_sitelib}/*.egg-info
|
||||
%{python3_sitelib}/*.py
|
||||
|
||||
%changelog
|
||||
* Tue Aug 23 2022 Kamil Dudka <kdudka@redhat.com> - 0.12.13-7
|
||||
- Gracefully handle errors during early request binding (CVE-2022-31799)
|
||||
|
||||
* Fri Mar 26 2021 Kamil Dudka <kdudka@redhat.com> - 0.12.13-6
|
||||
- Do not split query strings on `;` anymore (CVE-2020-28473)
|
||||
|
||||
* Fri Jun 08 2018 Charalampos Stratakis <cstratak@redhat.com> - 0.12.13-3
|
||||
- Conditionalize the python2 subpackage
|
||||
|
||||
* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.12.13-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
|
||||
|
||||
* Tue Jan 09 2018 Stratakis Charalampos <cstratak@redhat.com> - 0.12.13-1
|
||||
- Update to 0.12.13
|
||||
|
||||
* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.12.9-6
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
|
||||
|
||||
* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.12.9-5
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
|
||||
|
||||
* Mon Dec 12 2016 Stratakis Charalampos <cstratak@redhat.com> - 0.12.9-4
|
||||
- Rebuild for Python 3.6
|
||||
|
||||
* Wed Nov 16 2016 Orion Poplawski <orion@cora.nwra.com> - 0.12.9-3
|
||||
- Do not own __pycache__ dir
|
||||
|
||||
* Tue Jul 19 2016 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.12.9-2
|
||||
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
|
||||
|
||||
* Tue Jul 12 2016 Orion Poplawski <orion@cora.nwra.com> - 0.12.9-1
|
||||
- Update to 0.12.9
|
||||
- Run tests but ignore python3 failure for now
|
||||
|
||||
* Tue Jul 12 2016 Orion Poplawski <orion@cora.nwra.com> - 0.12.6-5
|
||||
- Use modern python packaging guidelines
|
||||
|
||||
* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 0.12.6-4
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
|
||||
|
||||
* Tue Nov 10 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.12.6-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5
|
||||
|
||||
* Thu Jun 18 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.12.6-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
|
||||
|
||||
* Sat Jul 12 2014 Rahul Sundaram <sundaram@fedoraproject.org> - 0.12.6-1
|
||||
- resolves rhbz#1093257 - JSON content type not restrictive enough
|
||||
|
||||
* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.11.6-4
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
|
||||
|
||||
* Mon May 19 2014 Bohuslav Kabrda <bkabrda@redhat.com> - 0.11.6-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Changes/Python_3.4
|
||||
|
||||
* Sun Aug 04 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.11.6-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
|
||||
|
||||
* Tue Apr 23 2013 Rahul Sundaram <sundaram@fedoraproject.org> - 0.11.6-1
|
||||
- upstream release 0.11.6
|
||||
- add python3 subpackage. resolves rhbz#949240
|
||||
- spec file patch from Haïkel Guémar <hguemar@fedoraproject.org>
|
||||
|
||||
* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.10.7-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
|
||||
|
||||
* Sat Jul 21 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.10.7-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
|
||||
|
||||
* Wed Feb 01 2012 Ian Weller <iweller@redhat.com> - 0.10.7-1
|
||||
- Update to 0.10.7 (required by python-mwlib)
|
||||
|
||||
* Sat Jan 14 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.9.5-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
|
||||
|
||||
* Mon Jul 18 2011 Rahul Sundaram <sundaram@fedoraproject.org> - 0.9.5-1
|
||||
- Initial spec
|
||||
Loading…
Reference in New Issue
Block a user