SOURCES/CVE-2023-32681.patch

@@ -1,59 +0,0 @@
-From 88313c734876b90c266d183d07d26338a14bc54c Mon Sep 17 00:00:00 2001
-From: Nate Prewitt <nate.prewitt@gmail.com>
-Date: Mon, 22 May 2023 08:08:57 -0700
-Subject: [PATCH] Merge pull request from GHSA-j8r2-6x86-q33q
-
----
- requests/sessions.py   |  4 +++-
- tests/test_requests.py | 20 ++++++++++++++++++++
- 2 files changed, 23 insertions(+), 1 deletion(-)
-
-diff --git a/requests/sessions.py b/requests/sessions.py
-index 45ab8a5..db9c594 100644
---- a/requests/sessions.py
-+++ b/requests/sessions.py
-@@ -306,7 +306,9 @@ class SessionRedirectMixin(object):
-         except KeyError:
-             username, password = None, None
- 
--        if username and password:
-+        # urllib3 handles proxy authorization for us in the standard adapter.
-+        # Avoid appending this to TLS tunneled requests where it may be leaked.
-+        if not scheme.startswith('https') and username and password:
-             headers['Proxy-Authorization'] = _basic_auth_str(username, password)
- 
-         return new_proxies
-diff --git a/tests/test_requests.py b/tests/test_requests.py
-index 5e721cb..c70706f 100644
---- a/tests/test_requests.py
-+++ b/tests/test_requests.py
-@@ -551,6 +551,26 @@ class TestRequests:
-         with pytest.raises(InvalidProxyURL):
-             requests.get(httpbin(), proxies={'http': 'http:///example.com:8080'})
- 
-+
-+    @pytest.mark.parametrize(
-+        "url,has_proxy_auth",
-+        (
-+            ('http://example.com', True),
-+            ('https://example.com', False),
-+        ),
-+    )
-+    def test_proxy_authorization_not_appended_to_https_request(self, url, has_proxy_auth):
-+        session = requests.Session()
-+        proxies = {
-+            'http': 'http://test:pass@localhost:8080',
-+            'https': 'http://test:pass@localhost:8090',
-+        }
-+        req = requests.Request('GET', url)
-+        prep = req.prepare()
-+        session.rebuild_proxies(prep, proxies)
-+
-+        assert ('Proxy-Authorization' in prep.headers) is has_proxy_auth
-+
-     def test_basicauth_with_netrc(self, httpbin):
-         auth = ('user', 'pass')
-         wrong_auth = ('wronguser', 'wrongpass')
--- 
-2.40.1
-

SPECS/python-requests.spec

@@ -1,16 +1,9 @@
-%if 0%{?_module_build}
-# Don't run tests on module-build for now
-# See: https://bugzilla.redhat.com/show_bug.cgi?id=1450608
-%bcond_with tests
-%else
-# When bootstrapping Python, we cannot test this yet
 %bcond_without tests
-%endif
+%bcond_without python3
-
 
 Name:           python-requests
 Version:        2.20.0
-Release:        4%{?dist}
+Release:        3%{?dist}
 Summary:        HTTP library, written in Python, for human beings
 
 License:        ASL 2.0
@@ -41,15 +34,9 @@ Patch5:         Skip-all-tests-needing-httpbin.patch
 # Properly handle default ports when stripping the authorization header.
 # This fixes a regression introduced with fixing CVE-2018-18074.
 # Fixed upstream: https://github.com/psf/requests/pull/4851
-# Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1752799
+# Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1762422
 Patch6:         properly-handle-default-ports-in-auth-stripping.patch
 
-# Security fix for CVE-2023-32681
-# Unintended leak of Proxy-Authorization header
-# Resolved upstream: https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5
-# Tracking bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2209469
-Patch7:         CVE-2023-32681.patch
-
 BuildArch:      noarch
 
 %description
@@ -58,6 +45,37 @@ cumbersome. Python’s built-in urllib2 module provides most of the HTTP
 capabilities you should need, but the API is thoroughly broken. This library is
 designed to make HTTP requests easy for developers.
 
+%package -n python2-requests
+Summary: HTTP library, written in Python, for human beings
+%{?python_provide:%python_provide python2-requests}
+
+BuildRequires:  python2-devel
+BuildRequires:  python2-chardet
+BuildRequires:  python2-urllib3
+BuildRequires:  python2-idna
+%if %{with tests}
+BuildRequires:  python2-pytest
+BuildRequires:  python2-pytest-mock
+%endif
+
+
+Requires:       ca-certificates
+Requires:       python2-chardet
+Requires:       python2-urllib3
+Requires:       python2-idna
+
+%if 0%{?rhel} && 0%{?rhel} <= 6
+BuildRequires:  python-ordereddict
+Requires:       python-ordereddict
+%endif
+
+%description -n python2-requests
+Most existing Python modules for sending HTTP requests are extremely verbose and
+cumbersome. Python’s built-in urllib2 module provides most of the HTTP
+capabilities you should need, but the API is thoroughly broken. This library is
+designed to make HTTP requests easy for developers.
+
+%if %{with python3}
 %package -n python%{python3_pkgversion}-requests
 Summary: HTTP library, written in Python, for human beings
 
@@ -82,6 +100,8 @@ cumbersome. Python’s built-in urllib2 module provides most of the HTTP
 capabilities you should need, but the API is thoroughly broken. This library is
 designed to make HTTP requests easy for developers.
 
+%endif
+
 %prep
 %autosetup -p1 -n requests-%{version}
 
@@ -92,45 +112,58 @@ rm -rf requests/cacert.pem
 sed -i '/#!\/usr\/.*python/d' requests/certs.py
 
 %build
+%py2_build
+%if %{with python3}
 %py3_build
-
+%endif
 
 %install
+%py2_install
+%if %{with python3}
 %py3_install
-
+%endif
 
 %if %{with tests}
 %check
+PYTHONPATH=%{buildroot}%{python2_sitelib} %{__python2} -m pytest -v
+%if %{with python3}
 PYTHONPATH=%{buildroot}%{python3_sitelib} %{__python3} -m pytest -v
+%endif
 %endif # tests
 
+
+%files -n python2-requests
+%license LICENSE
+%doc README.md HISTORY.md
+%{python2_sitelib}/*.egg-info
+%{python2_sitelib}/requests/
+
+%if %{with python3}
 %files -n python%{python3_pkgversion}-requests
 %license LICENSE
 %doc README.md HISTORY.md
 %{python3_sitelib}/*.egg-info
 %{python3_sitelib}/requests/
+%endif
 
 
 %changelog
-* Mon Jun 26 2023 Lumír Balhar <lbalhar@redhat.com> - 2.20.0-4
+* Fri Nov 1 2019 Charalampos Stratakis <cstratak@redhat.com> - 2.20.0-3
-- Bump release to fix upgrade path
-  from 2.20.0-2.1.el8_1 via 2.20.0-3.el8_8 to 2.20.0-4.el8
-Related: rhbz#2209469
-
-* Wed Jun 21 2023 Lumír Balhar <lbalhar@redhat.com> - 2.20.0-3
-- Security fix for CVE-2023-32681
-Resolves: rhbz#2209469
-
-* Mon Oct 14 2019 Charalampos Stratakis <cstratak@redhat.com> - 2.20.0-2
 - Properly handle default ports when stripping the authorization header
-Resolves: rhbz#1752799
+Resolves: rhbz#1762422
+
+* Thu Apr 25 2019 Tomas Orsava <torsava@redhat.com> - 2.20.0-2
+- Bumping due to problems with modular RPM upgrade path
+- Resolves: rhbz#1695587
 
 * Mon Oct 29 2018 Jeremy Cline <jeremy@jcline.org> - 2.20.0-1
 - Update to v2.20.0 for CVE-2018-18074.
 
-* Wed Jul 11 2018 Petr Viktorin <pviktori@redhat.com> - 2.19.1-4
+* Tue Jul 31 2018 Lumír Balhar <lbalhar@redhat.com> - 2.19.1-5
-- Remove the Python 2 subpackage
+- Make possible to disable python3 subpackage
-  https://bugzilla.redhat.com/show_bug.cgi?id=1590396
+
+* Mon Jul 16 2018 Lumír Balhar <lbalhar@redhat.com> - 2.19.1-4
+- First version for python27 module
 
 * Thu Jun 21 2018 Lumír Balhar <lbalhar@redhat.com> - 2.19.1-3
 - Allow build with Python 2