8 changed files with 97 additions and 63 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +1 @@
-SOURCES/lxml-4.2.3.tgz
+/lxml-4.4.1.tgz
--- a/.python-lxml.metadata
+++ b/.python-lxml.metadata
@ -1 +0,0 @@
-536c9ced5d03e8d871ebf21748ed36a2f7ddf668 SOURCES/lxml-4.2.3.tgz
--- a/SOURCES/CVE-2020-27783.patch
+++ b/SOURCES/CVE-2020-27783.patch
@ -1,5 +1,19 @@
+From db649273fd6a2e3a624545b6fd14e8d8029198f8 Mon Sep 17 00:00:00 2001
+From: Lumir Balhar <lbalhar@redhat.com>
+Date: Thu, 3 Dec 2020 11:53:15 +0100
+Subject: [PATCH] CVE-2020-27783
+
+Combines fixes for the CVE from two versions:
+- Version 4.6.1: https://github.com/lxml/lxml/commit/89e7aad6e7ff9ecd88678ff25f885988b184b26e
+- Version 4.6.2: https://github.com/lxml/lxml/commit/a105ab8dc262ec6735977c25c13f0bdfcdec72a7
+---
+ src/lxml/html/clean.py             | 25 +++++++++++++++++--------
+ src/lxml/html/tests/test_clean.py  | 21 +++++++++++++++++++++
+ src/lxml/html/tests/test_clean.txt | 12 ++++++++++--
+ 3 files changed, 48 insertions(+), 10 deletions(-)
+
 diff --git a/src/lxml/html/clean.py b/src/lxml/html/clean.py
-index adc3f45..6f3f7de 100644
+index aa9fc57..15298b5 100644
 --- a/src/lxml/html/clean.py
 +++ b/src/lxml/html/clean.py
@@ -61,12 +61,15 @@ __all__ = ['clean_html', 'clean', 'Cleaner', 'autolink', 'autolink_html',
@ -59,13 +73,13 @@ index adc3f45..6f3f7de 100644
 
     def clean_html(self, html):
 diff --git a/src/lxml/html/tests/test_clean.py b/src/lxml/html/tests/test_clean.py
-index 3bcaaf5..451eec2 100644
+index a193d99..ea7487c 100644
 --- a/src/lxml/html/tests/test_clean.py
 +++ b/src/lxml/html/tests/test_clean.py
-@@ -69,6 +69,26 @@ class CleanerTest(unittest.TestCase):
-         s = lxml.html.fromstring('<invalid tag>child</another>')
+@@ -69,6 +69,27 @@ class CleanerTest(unittest.TestCase):
         self.assertEqual('child', clean_html(s).text_content())
 
+ 
 +    def test_sneaky_noscript_in_style(self):
 +        # This gets parsed as <noscript> -> <style>"...</noscript>..."</style>
 +        # thus passing the </noscript> through into the output.
@ -86,11 +100,12 @@ index 3bcaaf5..451eec2 100644
 +            b'<math><style>/* deleted */</style></math>',
 +            lxml.html.tostring(clean_html(s)))
 +
- 
+
 def test_suite():
     suite = unittest.TestSuite()
+     suite.addTests([make_doctest('test_clean.txt')])
 diff --git a/src/lxml/html/tests/test_clean.txt b/src/lxml/html/tests/test_clean.txt
-index c78ab4f..c901871 100644
+index 2824f64..7df1f1d 100644
 --- a/src/lxml/html/tests/test_clean.txt
 +++ b/src/lxml/html/tests/test_clean.txt
@@ -104,7 +104,11 @@
@ -119,3 +134,6 @@ index c78ab4f..c901871 100644
   </head>
   <body>
     <a href="">a link</a>
+-- 
+2.28.0
+
--- a/SOURCES/CVE-2021-28957.patch
+++ b/SOURCES/CVE-2021-28957.patch
--- a/SOURCES/CVE-2021-43818.patch
+++ b/SOURCES/CVE-2021-43818.patch
@ -1,5 +1,5 @@
 diff --git a/src/lxml/html/clean.py b/src/lxml/html/clean.py
-index 6f3f7de..da5af16 100644
+index 15298b5..ee2f0f8 100644
 --- a/src/lxml/html/clean.py
 +++ b/src/lxml/html/clean.py
@@ -73,18 +73,25 @@ _looks_like_tag_content = re.compile(
@ -46,15 +46,15 @@ index 6f3f7de..da5af16 100644
             # e.g. '<noscript><style><a title="</noscript><img src=x onerror=alert(1)>">'
             return True
 diff --git a/src/lxml/html/tests/test_clean.py b/src/lxml/html/tests/test_clean.py
-index e40cdad..ad9a598 100644
+index d8df527..7021e48 100644
 --- a/src/lxml/html/tests/test_clean.py
 +++ b/src/lxml/html/tests/test_clean.py
@@ -1,3 +1,5 @@
 +import base64
 +import gzip
- import unittest, sys
+ import unittest
 from lxml.tests.common_imports import make_doctest
- from lxml.etree import LIBXML_VERSION
+ 
@@ -89,6 +91,69 @@ class CleanerTest(unittest.TestCase):
             b'<math><style>/* deleted */</style></math>',
             lxml.html.tostring(clean_html(s)))
--- a/SOURCES/fix-threading-tests.patch
+++ b/SOURCES/fix-threading-tests.patch
@ -1,26 +0,0 @@
-diff --git a/src/lxml/tests/test_threading.py b/src/lxml/tests/test_threading.py
-index 8948c3e..5ede3f8 100644
--- a/src/lxml/tests/test_threading.py
-+++ b/src/lxml/tests/test_threading.py
-@@ -130,7 +130,7 @@ class ThreadingTestCase(HelperTestCase):
-     <xsl:template match="tag" />
-     <!-- extend time for parsing + transform -->
- ''' + '\n'.join('<xsl:template match="tag%x" />' % i for i in range(200)) + '''
-    <xsl:foo />
-+    <xsl:UnExpectedElement />
- </xsl:stylesheet>''')
-         self.assertRaises(etree.XSLTParseError,
-                           etree.XSLT, style)
-@@ -153,9 +153,10 @@ class ThreadingTestCase(HelperTestCase):
-             self.assertTrue(len(log))
-             if last_log is not None:
-                 self.assertEqual(len(last_log), len(log))
-            self.assertEqual(4, len(log))
-+            self.assertTrue(len(log) >= 2, len(log))
-             for error in log:
-                self.assertTrue(':ERROR:XSLT:' in str(error))
-+                self.assertTrue(':ERROR:XSLT:' in str(error), str(error))
-+            self.assertTrue(any('UnExpectedElement' in str(error) for error in log), log)
-             last_log = log
- 
-     def test_thread_xslt_apply_error_log(self):
--- a/SPECS/python-lxml.spec
+++ b/SPECS/python-lxml.spec
@ -1,13 +1,15 @@
 %global modname lxml

+%bcond_with python2
+
 Name:           python-%{modname}
-Version:        4.2.3
-Release:        4%{?dist}
+Version:        4.4.1
+Release:        7%{?dist}
 Summary:        XML processing library combining libxml2/libxslt with the ElementTree API

 License:        BSD
-URL:            http://lxml.de
-Source0:        http://lxml.de/files/%{modname}-%{version}.tgz
+URL:            https://github.com/lxml/lxml
+Source0:        https://lxml.de/files/%{modname}-%{version}.tgz

 # Fix for CVE-2020-27783: mXSS due to the use of improper parser
 # Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1901633
@ -28,9 +30,10 @@ Patch1: CVE-2021-28957.patch
 # https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0
 Patch2: CVE-2021-43818.patch

-# Make test more resilient against changes in latest libxslt releases
-# Fixed upstream: https://github.com/lxml/lxml/commit/acef361ca80ff9afd828d91c98ea91c92f9d09af
-Patch3: fix-threading-tests.patch
+# Exclude i686 arch. Due to a modularity issue it's being added to the
+# x86_64 compose of CRB, but we don't want to ship it at all.
+# See: https://projects.engineering.redhat.com/browse/RCM-72605
+ExcludeArch: i686

 BuildRequires:  gcc
 BuildRequires:  libxml2-devel
@ -45,22 +48,25 @@ home page < or see our bug tracker at case you want to use the current ...

 %description %{_description}

-%package -n     python3-%{modname}
+%package -n     python%{python3_pkgversion}-%{modname}
 Summary:        %{summary}
-BuildRequires:  python3-devel
-BuildRequires:  python3-setuptools
-BuildRequires:  python3-Cython
-Recommends:     python3-cssselect
-Recommends:     python3-html5lib
-Recommends:     python3-beautifulsoup4
-%{?python_provide:%python_provide python3-%{modname}}
+BuildRequires:  python%{python3_pkgversion}-devel
+BuildRequires:  python%{python3_pkgversion}-setuptools
+BuildRequires:  python%{python3_pkgversion}-Cython
+BuildRequires:  python%{python3_pkgversion}-rpm-macros
+Suggests:       python%{python3_version}dist(cssselect) >= 0.7
+Suggests:       python%{python3_version}dist(html5lib)
+Suggests:       python%{python3_version}dist(beautifulsoup4)
+%{?python_provide:%python_provide python%{python3_pkgversion}-%{modname}}

-%description -n python3-%{modname} %{_description}
+%description -n python%{python3_pkgversion}-%{modname} %{_description}

 Python 3 version.

 %prep
-%autosetup -n %{modname}-%{version} -p1
+%autosetup -p1 -n %{modname}-%{version}
+# Remove pregenerated Cython C sources
+find -type f -name '*.c' -print -delete

 %build
 export WITH_CYTHON=true
@ -76,30 +82,66 @@ cp -a build/lib.%{python3_platform}-%{python3_version}/* src/
 # The options are: verbose, unit, functional
 %{python3} test.py -vuf

-%files -n python3-%{modname}
+%files -n python%{python3_pkgversion}-%{modname}
 %license doc/licenses/ZopePublicLicense.txt LICENSES.txt
 %doc README.rst src/lxml/isoschematron/resources/xsl/iso-schematron-xslt1/readme.txt
 %{python3_sitearch}/%{modname}/
 %{python3_sitearch}/%{modname}-*.egg-info/

 %changelog
-* Thu Jan 06 2022 Charalampos Stratakis <cstratak@redhat.com> - 4.2.3-4
+* Thu Jan 06 2022 Charalampos Stratakis <cstratak@redhat.com> - 4.4.1-7
 - Security fix for CVE-2021-43818
 Resolves: rhbz#2032569

-* Wed Mar 24 2021 Charalampos Stratakis <cstratak@redhat.com> - 4.2.3-3
+* Wed Mar 24 2021 Charalampos Stratakis <cstratak@redhat.com> - 4.4.1-6
 - Security fix for CVE-2021-28957
 Resolves: rhbz#1941534

-* Tue Dec 08 2020 Charalampos Stratakis <cstratak@redhat.com> - 4.2.3-2
+* Thu Dec 03 2020 Lumír Balhar <lbalhar@redhat.com> - 4.4.1-5
 - Security fix for CVE-2020-27783: mXSS due to the use of improper parser
 Resolves: rhbz#1901633

-* Thu Aug 02 2018 Sebastian Kisela <skisela@redhat.com> - 4.2.3-1
- New upstream release 4.2.3
+* Thu Dec 12 2019 Tomas Orsava <torsava@redhat.com> - 4.4.1-4
+- Exclude unsupported i686 arch

-* Sun Jul 22 2018 Charalampos Stratakis <cstratak@redhat.com> - 4.1.1-3
- Conditionalize the python2 subpackage
+* Wed Nov 20 2019 Lumír Balhar <lbalhar@redhat.com> - 4.4.1-3
+- Adjusted for Python 3.8 module in RHEL 8
+
+* Sat Sep 07 2019 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 4.4.1-2
+- Generate C files using py3 Cython
+
+* Sat Sep 07 2019 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 4.4.1-1
+- Update to 4.4.1
+
+* Fri Aug 16 2019 Miro Hrončok <mhroncok@redhat.com> - 4.4.0-2
+- Rebuilt for Python 3.8
+
+* Sat Aug 03 2019 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 4.4.0-1
+- Update to 4.4.0
+
+* Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 4.2.5-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Sat Feb 02 2019 Fedora Release Engineering <releng@fedoraproject.org> - 4.2.5-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Tue Dec 18 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 4.2.5-1
+- Update to 4.2.5
+
+* Sun Sep 02 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 4.2.4-1
+- Update to 4.2.4
+
+* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 4.2.3-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Sat Jul 07 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 4.2.3-1
+- Update to 4.2.3
+
+* Sun Jun 17 2018 Miro Hrončok <mhroncok@redhat.com> - 4.2.1-2
+- Rebuilt for Python 3.7
+
+* Wed Apr 25 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 4.2.1-1
+- Update to 4.2.1

 * Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 4.1.1-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
--- a/1
+++ b/1
@ -0,0 +1 @@
+SHA512 (lxml-4.4.1.tgz) = 3f11469290868f5bd30631020ac170c40da7348853609edf6fc6b00437b053fd774e0dfc6e711703ac5d05398dfa1f31e59a185935c3dc8ef0e1914a518bd049
				`@ -1 +0,0 @@`
				`536c9ced5d03e8d871ebf21748ed36a2f7ddf668 SOURCES/lxml-4.2.3.tgz`
				`@ -0,0 +1 @@`
				`SHA512 (lxml-4.4.1.tgz) = 3f11469290868f5bd30631020ac170c40da7348853609edf6fc6b00437b053fd774e0dfc6e711703ac5d05398dfa1f31e59a185935c3dc8ef0e1914a518bd049`