8 changed files with 97 additions and 63 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +1 @@
-SOURCES/lxml-4.2.3.tgz
+/lxml-4.4.1.tgz
--- a/.python-lxml.metadata
+++ b/.python-lxml.metadata
@ -1 +0,0 @@
 536c9ced5d03e8d871ebf21748ed36a2f7ddf668 SOURCES/lxml-4.2.3.tgz
--- a/SOURCES/CVE-2020-27783.patch
+++ b/SOURCES/CVE-2020-27783.patch
@ -1,5 +1,19 @@
 From db649273fd6a2e3a624545b6fd14e8d8029198f8 Mon Sep 17 00:00:00 2001
 From: Lumir Balhar <lbalhar@redhat.com>
 Date: Thu, 3 Dec 2020 11:53:15 +0100
 Subject: [PATCH] CVE-2020-27783
 Combines fixes for the CVE from two versions:
 - Version 4.6.1: https://github.com/lxml/lxml/commit/89e7aad6e7ff9ecd88678ff25f885988b184b26e
 - Version 4.6.2: https://github.com/lxml/lxml/commit/a105ab8dc262ec6735977c25c13f0bdfcdec72a7
 ---
 src/lxml/html/clean.py             | 25 +++++++++++++++++--------
 src/lxml/html/tests/test_clean.py  | 21 +++++++++++++++++++++
 src/lxml/html/tests/test_clean.txt | 12 ++++++++++--
 3 files changed, 48 insertions(+), 10 deletions(-)
 diff --git a/src/lxml/html/clean.py b/src/lxml/html/clean.py
-index adc3f45..6f3f7de 100644
+index aa9fc57..15298b5 100644
 --- a/src/lxml/html/clean.py
 +++ b/src/lxml/html/clean.py
@@ -61,12 +61,15 @@ __all__ = ['clean_html', 'clean', 'Cleaner', 'autolink', 'autolink_html',
@ -59,13 +73,13 @@ index adc3f45..6f3f7de 100644
     def clean_html(self, html):
 diff --git a/src/lxml/html/tests/test_clean.py b/src/lxml/html/tests/test_clean.py
-index 3bcaaf5..451eec2 100644
+index a193d99..ea7487c 100644
 --- a/src/lxml/html/tests/test_clean.py
 +++ b/src/lxml/html/tests/test_clean.py
-@@ -69,6 +69,26 @@ class CleanerTest(unittest.TestCase):
+@@ -69,6 +69,27 @@ class CleanerTest(unittest.TestCase):
         s = lxml.html.fromstring('<invalid tag>child</another>')
         self.assertEqual('child', clean_html(s).text_content())
 +    def test_sneaky_noscript_in_style(self):
 +        # This gets parsed as <noscript> -> <style>"...</noscript>..."</style>
 +        # thus passing the </noscript> through into the output.
@ -86,11 +100,12 @@ index 3bcaaf5..451eec2 100644
 +            b'<math><style>/* deleted */</style></math>',
 +            lxml.html.tostring(clean_html(s)))
 +
- 
+
 def test_suite():
     suite = unittest.TestSuite()
     suite.addTests([make_doctest('test_clean.txt')])
 diff --git a/src/lxml/html/tests/test_clean.txt b/src/lxml/html/tests/test_clean.txt
-index c78ab4f..c901871 100644
+index 2824f64..7df1f1d 100644
 --- a/src/lxml/html/tests/test_clean.txt
 +++ b/src/lxml/html/tests/test_clean.txt
@@ -104,7 +104,11 @@
@ -119,3 +134,6 @@ index c78ab4f..c901871 100644
   </head>
   <body>
     <a href="">a link</a>
 -- 
 2.28.0
--- a/SOURCES/CVE-2021-28957.patch
+++ b/SOURCES/CVE-2021-28957.patch
--- a/SOURCES/CVE-2021-43818.patch
+++ b/SOURCES/CVE-2021-43818.patch
@ -1,5 +1,5 @@
 diff --git a/src/lxml/html/clean.py b/src/lxml/html/clean.py
-index 6f3f7de..da5af16 100644
+index 15298b5..ee2f0f8 100644
 --- a/src/lxml/html/clean.py
 +++ b/src/lxml/html/clean.py
@@ -73,18 +73,25 @@ _looks_like_tag_content = re.compile(
@ -46,15 +46,15 @@ index 6f3f7de..da5af16 100644
             # e.g. '<noscript><style><a title="</noscript><img src=x onerror=alert(1)>">'
             return True
 diff --git a/src/lxml/html/tests/test_clean.py b/src/lxml/html/tests/test_clean.py
-index e40cdad..ad9a598 100644
+index d8df527..7021e48 100644
 --- a/src/lxml/html/tests/test_clean.py
 +++ b/src/lxml/html/tests/test_clean.py
@@ -1,3 +1,5 @@
 +import base64
 +import gzip
- import unittest, sys
+ import unittest
 from lxml.tests.common_imports import make_doctest
- from lxml.etree import LIBXML_VERSION
+ 
@@ -89,6 +91,69 @@ class CleanerTest(unittest.TestCase):
             b'<math><style>/* deleted */</style></math>',
             lxml.html.tostring(clean_html(s)))
--- a/SOURCES/fix-threading-tests.patch
+++ b/SOURCES/fix-threading-tests.patch
@ -1,26 +0,0 @@
 diff --git a/src/lxml/tests/test_threading.py b/src/lxml/tests/test_threading.py
 index 8948c3e..5ede3f8 100644
 --- a/src/lxml/tests/test_threading.py
 +++ b/src/lxml/tests/test_threading.py
@@ -130,7 +130,7 @@ class ThreadingTestCase(HelperTestCase):
     <xsl:template match="tag" />
     <!-- extend time for parsing + transform -->
 ''' + '\n'.join('<xsl:template match="tag%x" />' % i for i in range(200)) + '''
 -    <xsl:foo />
 +    <xsl:UnExpectedElement />
 </xsl:stylesheet>''')
         self.assertRaises(etree.XSLTParseError,
                           etree.XSLT, style)
@@ -153,9 +153,10 @@ class ThreadingTestCase(HelperTestCase):
             self.assertTrue(len(log))
             if last_log is not None:
                 self.assertEqual(len(last_log), len(log))
 -            self.assertEqual(4, len(log))
 +            self.assertTrue(len(log) >= 2, len(log))
             for error in log:
 -                self.assertTrue(':ERROR:XSLT:' in str(error))
 +                self.assertTrue(':ERROR:XSLT:' in str(error), str(error))
 +            self.assertTrue(any('UnExpectedElement' in str(error) for error in log), log)
             last_log = log
     def test_thread_xslt_apply_error_log(self):
--- a/SPECS/python-lxml.spec
+++ b/SPECS/python-lxml.spec
@ -1,13 +1,15 @@
 %global modname lxml
 %bcond_with python2
 Name:           python-%{modname}
-Version:        4.2.3
+Version:        4.4.1
-Release:        4%{?dist}
+Release:        7%{?dist}
 Summary:        XML processing library combining libxml2/libxslt with the ElementTree API
 License:        BSD
-URL:            http://lxml.de
+URL:            https://github.com/lxml/lxml
-Source0:        http://lxml.de/files/%{modname}-%{version}.tgz
+Source0:        https://lxml.de/files/%{modname}-%{version}.tgz
 # Fix for CVE-2020-27783: mXSS due to the use of improper parser
 # Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1901633
@ -28,9 +30,10 @@ Patch1: CVE-2021-28957.patch
 # https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0
 Patch2: CVE-2021-43818.patch
-# Make test more resilient against changes in latest libxslt releases
+# Exclude i686 arch. Due to a modularity issue it's being added to the
-# Fixed upstream: https://github.com/lxml/lxml/commit/acef361ca80ff9afd828d91c98ea91c92f9d09af
+# x86_64 compose of CRB, but we don't want to ship it at all.
-Patch3: fix-threading-tests.patch
+# See: https://projects.engineering.redhat.com/browse/RCM-72605
 ExcludeArch: i686
 BuildRequires:  gcc
 BuildRequires:  libxml2-devel
@ -45,22 +48,25 @@ home page < or see our bug tracker at case you want to use the current ...
 %description %{_description}
-%package -n     python3-%{modname}
+%package -n     python%{python3_pkgversion}-%{modname}
 Summary:        %{summary}
-BuildRequires:  python3-devel
+BuildRequires:  python%{python3_pkgversion}-devel
-BuildRequires:  python3-setuptools
+BuildRequires:  python%{python3_pkgversion}-setuptools
-BuildRequires:  python3-Cython
+BuildRequires:  python%{python3_pkgversion}-Cython
-Recommends:     python3-cssselect
+BuildRequires:  python%{python3_pkgversion}-rpm-macros
-Recommends:     python3-html5lib
+Suggests:       python%{python3_version}dist(cssselect) >= 0.7
-Recommends:     python3-beautifulsoup4
+Suggests:       python%{python3_version}dist(html5lib)
-%{?python_provide:%python_provide python3-%{modname}}
+Suggests:       python%{python3_version}dist(beautifulsoup4)
 %{?python_provide:%python_provide python%{python3_pkgversion}-%{modname}}
-%description -n python3-%{modname} %{_description}
+%description -n python%{python3_pkgversion}-%{modname} %{_description}
 Python 3 version.
 %prep
-%autosetup -n %{modname}-%{version} -p1
+%autosetup -p1 -n %{modname}-%{version}
 # Remove pregenerated Cython C sources
 find -type f -name '*.c' -print -delete
 %build
 export WITH_CYTHON=true
@ -76,30 +82,66 @@ cp -a build/lib.%{python3_platform}-%{python3_version}/* src/
 # The options are: verbose, unit, functional
 %{python3} test.py -vuf
-%files -n python3-%{modname}
+%files -n python%{python3_pkgversion}-%{modname}
 %license doc/licenses/ZopePublicLicense.txt LICENSES.txt
 %doc README.rst src/lxml/isoschematron/resources/xsl/iso-schematron-xslt1/readme.txt
 %{python3_sitearch}/%{modname}/
 %{python3_sitearch}/%{modname}-*.egg-info/
 %changelog
-* Thu Jan 06 2022 Charalampos Stratakis <cstratak@redhat.com> - 4.2.3-4
+* Thu Jan 06 2022 Charalampos Stratakis <cstratak@redhat.com> - 4.4.1-7
 - Security fix for CVE-2021-43818
 Resolves: rhbz#2032569
-* Wed Mar 24 2021 Charalampos Stratakis <cstratak@redhat.com> - 4.2.3-3
+* Wed Mar 24 2021 Charalampos Stratakis <cstratak@redhat.com> - 4.4.1-6
 - Security fix for CVE-2021-28957
 Resolves: rhbz#1941534
-* Tue Dec 08 2020 Charalampos Stratakis <cstratak@redhat.com> - 4.2.3-2
+* Thu Dec 03 2020 Lumír Balhar <lbalhar@redhat.com> - 4.4.1-5
 - Security fix for CVE-2020-27783: mXSS due to the use of improper parser
 Resolves: rhbz#1901633
-* Thu Aug 02 2018 Sebastian Kisela <skisela@redhat.com> - 4.2.3-1
+* Thu Dec 12 2019 Tomas Orsava <torsava@redhat.com> - 4.4.1-4
- New upstream release 4.2.3
+- Exclude unsupported i686 arch
-* Sun Jul 22 2018 Charalampos Stratakis <cstratak@redhat.com> - 4.1.1-3
+* Wed Nov 20 2019 Lumír Balhar <lbalhar@redhat.com> - 4.4.1-3
- Conditionalize the python2 subpackage
+- Adjusted for Python 3.8 module in RHEL 8
 * Sat Sep 07 2019 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 4.4.1-2
 - Generate C files using py3 Cython
 * Sat Sep 07 2019 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 4.4.1-1
 - Update to 4.4.1
 * Fri Aug 16 2019 Miro Hrončok <mhroncok@redhat.com> - 4.4.0-2
 - Rebuilt for Python 3.8
 * Sat Aug 03 2019 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 4.4.0-1
 - Update to 4.4.0
 * Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 4.2.5-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
 * Sat Feb 02 2019 Fedora Release Engineering <releng@fedoraproject.org> - 4.2.5-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
 * Tue Dec 18 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 4.2.5-1
 - Update to 4.2.5
 * Sun Sep 02 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 4.2.4-1
 - Update to 4.2.4
 * Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 4.2.3-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
 * Sat Jul 07 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 4.2.3-1
 - Update to 4.2.3
 * Sun Jun 17 2018 Miro Hrončok <mhroncok@redhat.com> - 4.2.1-2
 - Rebuilt for Python 3.7
 * Wed Apr 25 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 4.2.1-1
 - Update to 4.2.1
 * Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 4.1.1-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
--- a/1
+++ b/1
@ -0,0 +1 @@
 SHA512 (lxml-4.4.1.tgz) = 3f11469290868f5bd30631020ac170c40da7348853609edf6fc6b00437b053fd774e0dfc6e711703ac5d05398dfa1f31e59a185935c3dc8ef0e1914a518bd049
		`@ -1 +0,0 @@`
			`536c9ced5d03e8d871ebf21748ed36a2f7ddf668 SOURCES/lxml-4.2.3.tgz`
		`@ -0,0 +1 @@`
							`SHA512 (lxml-4.4.1.tgz) = 3f11469290868f5bd30631020ac170c40da7348853609edf6fc6b00437b053fd774e0dfc6e711703ac5d05398dfa1f31e59a185935c3dc8ef0e1914a518bd049`