Rebase patch for CVE-2007-4559

.python-pip.metadata

@@ -0,0 +1 @@
+5f98a502c4ae2fec713eda155bf5994196d97cd9 pip-21.3.1.tar.gz

cve-2007-4559-tarfile.patch

@@ -1,9 +1,20 @@
-Minimal patch for pip
+From 1819805f2019c731bcaefd6b12fd814790f88fcd Mon Sep 17 00:00:00 2001
+From: Lumir Balhar <lbalhar@redhat.com>
+Date: Tue, 19 Mar 2024 12:43:07 +0100
+Subject: [PATCH] cve-2007-4559-tarfile
 
-diff -rU3 pip-orig/src/pip/_internal/utils/unpacking.py pip/src/pip/_internal/utils/unpacking.py
---- pip-orig/src/pip/_internal/utils/unpacking.py	2022-11-05 16:25:43.000000000 +0100
-+++ pip/src/pip/_internal/utils/unpacking.py	2023-08-08 13:17:47.705613554 +0200
-@@ -184,6 +184,13 @@
+Minimal patch for pip
+---
+ src/pip/_internal/utils/unpacking.py |  7 +++++++
+ src/pip/_vendor/distlib/util.py      | 13 +++++++++++++
+ tests/unit/test_utils_unpacking.py   | 17 +++++++++++++++++
+ 3 files changed, 37 insertions(+)
+
+diff --git a/src/pip/_internal/utils/unpacking.py b/src/pip/_internal/utils/unpacking.py
+index 5f63f97..c31542f 100644
+--- a/src/pip/_internal/utils/unpacking.py
++++ b/src/pip/_internal/utils/unpacking.py
+@@ -184,6 +184,13 @@ def untar_file(filename: str, location: str) -> None:
                      "outside target directory ({})"
                  )
                  raise InstallationError(message.format(filename, path, location))
@@ -17,15 +28,36 @@ diff -rU3 pip-orig/src/pip/_internal/utils/unpacking.py pip/src/pip/_internal/ut
              if member.isdir():
                  ensure_dir(path)
              elif member.issym():
-
-
-Test from https://github.com/pypa/pip/pull/12214
-
-diff -rU3 pip-orig/tests/unit/test_utils_unpacking.py pip/tests/unit/test_utils_unpacking.py
---- pip-orig/tests/unit/test_utils_unpacking.py	2022-11-05 16:25:43.000000000 +0100
-+++ pip/tests/unit/test_utils_unpacking.py	2023-08-08 13:17:35.151540108 +0200
-@@ -167,6 +167,23 @@
-         test_tar = self.make_tar_file('test_tar.tar', files)
+diff --git a/src/pip/_vendor/distlib/util.py b/src/pip/_vendor/distlib/util.py
+index 80bfc86..7e0941a 100644
+--- a/src/pip/_vendor/distlib/util.py
++++ b/src/pip/_vendor/distlib/util.py
+@@ -1249,6 +1249,19 @@ def unarchive(archive_filename, dest_dir, format=None, check=True):
+             for tarinfo in archive.getmembers():
+                 if not isinstance(tarinfo.name, text_type):
+                     tarinfo.name = tarinfo.name.decode('utf-8')
++
++        # Limit extraction of dangerous items, if this Python
++        # allows it easily. If not, just trust the input.
++        # See: https://docs.python.org/3/library/tarfile.html#extraction-filters
++        def extraction_filter(member, path):
++            """Run tarfile.tar_fillter, but raise the expected ValueError"""
++            # This is only called if the current Python has tarfile filters
++            try:
++                return tarfile.tar_filter(member, path)
++            except tarfile.FilterError as exc:
++                raise ValueError(str(exc))
++        archive.extraction_filter = extraction_filter
++
+         archive.extractall(dest_dir)
+ 
+     finally:
+diff --git a/tests/unit/test_utils_unpacking.py b/tests/unit/test_utils_unpacking.py
+index ccb7a30..05324ad 100644
+--- a/tests/unit/test_utils_unpacking.py
++++ b/tests/unit/test_utils_unpacking.py
+@@ -171,6 +171,23 @@ class TestUnpackArchives:
+         test_tar = self.make_tar_file("test_tar.tar", files)
          untar_file(test_tar, self.tempdir)
  
 +    def test_unpack_tar_filter(self) -> None:
@@ -46,33 +78,8 @@ diff -rU3 pip-orig/tests/unit/test_utils_unpacking.py pip/tests/unit/test_utils_
 +
 +
  
- def test_unpack_tar_unicode(tmpdir):
+ def test_unpack_tar_unicode(tmpdir: Path) -> None:
      test_tar = tmpdir / "test.tar"
+-- 
+2.44.0
 
-
-Patch for vendored distlib from https://github.com/pypa/distlib/pull/201
-
-diff --git a/distlib/util.py b/distlib/util.py
-index e0622e4..4349d0b 100644
---- a/src/pip/_vendor/distlib/util.py
-+++ b/src/pip/_vendor/distlib/util.py
-@@ -1249,6 +1249,19 @@ def check_path(path):
-             for tarinfo in archive.getmembers():
-                 if not isinstance(tarinfo.name, text_type):
-                     tarinfo.name = tarinfo.name.decode('utf-8')
-+
-+        # Limit extraction of dangerous items, if this Python
-+        # allows it easily. If not, just trust the input.
-+        # See: https://docs.python.org/3/library/tarfile.html#extraction-filters
-+        def extraction_filter(member, path):
-+            """Run tarfile.tar_fillter, but raise the expected ValueError"""
-+            # This is only called if the current Python has tarfile filters
-+            try:
-+                return tarfile.tar_filter(member, path)
-+            except tarfile.FilterError as exc:
-+                raise ValueError(str(exc))
-+        archive.extraction_filter = extraction_filter
-+
-         archive.extractall(dest_dir)
- 
-     finally: