Update to 2.31.0
This commit is contained in:
Tomáš Hrnčiar
parent
ab88e0da15
commit
46169880a4
1
.gitignore
vendored
1
.gitignore
vendored
@ -51,3 +51,4 @@
|
||||
/requests-v2.27.1.tar.gz
|
||||
/requests-v2.28.1.tar.gz
|
||||
/requests-v2.28.2.tar.gz
|
||||
/requests-v2.31.0.tar.gz
|
||||
|
||||
@ -1,56 +0,0 @@
|
||||
From 74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5 Mon Sep 17 00:00:00 2001
|
||||
From: Nate Prewitt <nate.prewitt@gmail.com>
|
||||
Date: Mon, 22 May 2023 08:08:57 -0700
|
||||
Subject: [PATCH] Merge pull request from GHSA-j8r2-6x86-q33q
|
||||
|
||||
---
|
||||
requests/sessions.py | 4 +++-
|
||||
tests/test_requests.py | 20 ++++++++++++++++++++
|
||||
2 files changed, 23 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/requests/sessions.py b/requests/sessions.py
|
||||
index 6cb3b4dae3..dbcf2a7b0e 100644
|
||||
--- a/requests/sessions.py
|
||||
+++ b/requests/sessions.py
|
||||
@@ -324,7 +324,9 @@ def rebuild_proxies(self, prepared_request, proxies):
|
||||
except KeyError:
|
||||
username, password = None, None
|
||||
|
||||
- if username and password:
|
||||
+ # urllib3 handles proxy authorization for us in the standard adapter.
|
||||
+ # Avoid appending this to TLS tunneled requests where it may be leaked.
|
||||
+ if not scheme.startswith('https') and username and password:
|
||||
headers["Proxy-Authorization"] = _basic_auth_str(username, password)
|
||||
|
||||
return new_proxies
|
||||
diff --git a/tests/test_requests.py b/tests/test_requests.py
|
||||
index b1c8dd4534..b420c44d73 100644
|
||||
--- a/tests/test_requests.py
|
||||
+++ b/tests/test_requests.py
|
||||
@@ -647,6 +647,26 @@ def test_proxy_authorization_preserved_on_request(self, httpbin):
|
||||
|
||||
assert sent_headers.get("Proxy-Authorization") == proxy_auth_value
|
||||
|
||||
+
|
||||
+ @pytest.mark.parametrize(
|
||||
+ "url,has_proxy_auth",
|
||||
+ (
|
||||
+ ('http://example.com', True),
|
||||
+ ('https://example.com', False),
|
||||
+ ),
|
||||
+ )
|
||||
+ def test_proxy_authorization_not_appended_to_https_request(self, url, has_proxy_auth):
|
||||
+ session = requests.Session()
|
||||
+ proxies = {
|
||||
+ 'http': 'http://test:pass@localhost:8080',
|
||||
+ 'https': 'http://test:pass@localhost:8090',
|
||||
+ }
|
||||
+ req = requests.Request('GET', url)
|
||||
+ prep = req.prepare()
|
||||
+ session.rebuild_proxies(prep, proxies)
|
||||
+
|
||||
+ assert ('Proxy-Authorization' in prep.headers) is has_proxy_auth
|
||||
+
|
||||
def test_basicauth_with_netrc(self, httpbin):
|
||||
auth = ("user", "pass")
|
||||
wrong_auth = ("wronguser", "wrongpass")
|
||||
@ -5,8 +5,8 @@
|
||||
%bcond extras %{undefined rhel}
|
||||
|
||||
Name: python-requests
|
||||
Version: 2.28.2
|
||||
Release: 7%{?dist}
|
||||
Version: 2.31.0
|
||||
Release: 1%{?dist}
|
||||
Summary: HTTP library, written in Python, for human beings
|
||||
|
||||
License: Apache-2.0
|
||||
@ -17,9 +17,6 @@ Source: https://github.com/requests/requests/archive/v%{version}/request
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=904614
|
||||
Patch: system-certs.patch
|
||||
|
||||
# Security fix for CVE-2023-32681
|
||||
Patch: https://github.com/psf/requests/commit/74ea7cf7a6.patch#/CVE-2023-32681.patch
|
||||
|
||||
BuildArch: noarch
|
||||
BuildRequires: python%{python3_pkgversion}-devel
|
||||
%if %{with tests}
|
||||
@ -80,7 +77,7 @@ sed -i 's/ --doctest-modules//' pyproject.toml
|
||||
%pyproject_check_import
|
||||
%if %{with tests}
|
||||
# test_use_proxy_from_environment needs pysocks
|
||||
%pytest -v %{!?with_extras:-k "not test_use_proxy_from_environment"}
|
||||
%pytest -v tests %{!?with_extras:-k "not test_use_proxy_from_environment"}
|
||||
%endif
|
||||
|
||||
|
||||
@ -90,6 +87,10 @@ sed -i 's/ --doctest-modules//' pyproject.toml
|
||||
|
||||
|
||||
%changelog
|
||||
* Mon Oct 16 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 2.31.0-1
|
||||
- Update to 2.31.0
|
||||
- Fixes: rhbz#2189970
|
||||
|
||||
* Tue Oct 10 2023 Miro Hrončok <mhroncok@redhat.com> - 2.28.2-7
|
||||
- Do not package requests[security] and requests[socks] on RHEL
|
||||
- Make the package build even when urllib3 won't pull in pysocks
|
||||
|
||||
2
sources
2
sources
@ -1 +1 @@
|
||||
SHA512 (requests-v2.28.2.tar.gz) = 88c5a92ea51cd18e7edd49a6259d7b56bc0c17f86067f796b5f668ed35202b8bc1395e4811ee2089350e08893dcd304c9801dbf087abfaff1d14859e31bce8ac
|
||||
SHA512 (requests-v2.31.0.tar.gz) = 43f536bdb2360fcceb24ef98e995ffa66cdefc2c502629f17a5722445bfa9ad8489201958c846c2aaef37e427f95a4d56e321a91095c69754680abfd83b39150
|
||||
|
||||
@ -1,8 +1,9 @@
|
||||
From f21606c102368ad7a6e8bcab5a0c65dcddbbf9e5 Mon Sep 17 00:00:00 2001
|
||||
From: Lumir Balhar <lbalhar@redhat.com>
|
||||
Date: Thu, 19 Jan 2023 17:35:02 +0100
|
||||
From fbe9d1e38da72d8caac365841794b06614523ac9 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
|
||||
Date: Tue, 17 Oct 2023 10:44:42 +0200
|
||||
Subject: [PATCH] system certs
|
||||
|
||||
Co-authored-by: Lumir Balhar <lbalhar@redhat.com>
|
||||
---
|
||||
requests/certs.py | 7 ++++++-
|
||||
setup.cfg | 1 -
|
||||
@ -41,17 +42,17 @@ index bf21c81..906c0f1 100644
|
||||
idna>=2.5,<4
|
||||
urllib3>=1.21.1,<1.27
|
||||
diff --git a/setup.py b/setup.py
|
||||
index 092b40d..c6c0ad5 100755
|
||||
index 0123545..ec3fd1d 100755
|
||||
--- a/setup.py
|
||||
+++ b/setup.py
|
||||
@@ -62,7 +62,6 @@ requires = [
|
||||
"charset_normalizer>=2,<4",
|
||||
"idna>=2.5,<4",
|
||||
"urllib3>=1.21.1,<1.27",
|
||||
"urllib3>=1.21.1,<3",
|
||||
- "certifi>=2017.4.17",
|
||||
]
|
||||
test_requirements = [
|
||||
"pytest-httpbin==0.0.7",
|
||||
"pytest-httpbin==2.0.0",
|
||||
--
|
||||
2.39.0
|
||||
2.41.0
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user