Compare commits
No commits in common. "c8-beta" and "c8s" have entirely different histories.
|
@ -1,78 +0,0 @@
|
||||||
Minimal patch for pip
|
|
||||||
|
|
||||||
diff -rU3 pip-22.3.1-orig/src/pip/_internal/utils/unpacking.py pip-22.3.1/src/pip/_internal/utils/unpacking.py
|
|
||||||
--- pip-22.3.1-orig/src/pip/_internal/utils/unpacking.py 2022-11-05 16:25:43.000000000 +0100
|
|
||||||
+++ pip-22.3.1/src/pip/_internal/utils/unpacking.py 2023-08-08 13:17:47.705613554 +0200
|
|
||||||
@@ -184,6 +184,13 @@
|
|
||||||
"outside target directory ({})"
|
|
||||||
)
|
|
||||||
raise InstallationError(message.format(filename, path, location))
|
|
||||||
+
|
|
||||||
+ # Call the `data` filter for its side effect (raising exception)
|
|
||||||
+ try:
|
|
||||||
+ tarfile.data_filter(member.replace(name=fn), location)
|
|
||||||
+ except tarfile.LinkOutsideDestinationError:
|
|
||||||
+ pass
|
|
||||||
+
|
|
||||||
if member.isdir():
|
|
||||||
ensure_dir(path)
|
|
||||||
elif member.issym():
|
|
||||||
|
|
||||||
|
|
||||||
Test from https://github.com/pypa/pip/pull/12214
|
|
||||||
|
|
||||||
diff -rU3 pip-22.3.1-orig/tests/unit/test_utils_unpacking.py pip-22.3.1/tests/unit/test_utils_unpacking.py
|
|
||||||
--- pip-22.3.1-orig/tests/unit/test_utils_unpacking.py 2022-11-05 16:25:43.000000000 +0100
|
|
||||||
+++ pip-22.3.1/tests/unit/test_utils_unpacking.py 2023-08-08 13:17:35.151540108 +0200
|
|
||||||
@@ -171,6 +171,23 @@
|
|
||||||
test_tar = self.make_tar_file("test_tar.tar", files)
|
|
||||||
untar_file(test_tar, self.tempdir)
|
|
||||||
|
|
||||||
+ def test_unpack_tar_filter(self) -> None:
|
|
||||||
+ """
|
|
||||||
+ Test that the tarfile.data_filter is used to disallow dangerous
|
|
||||||
+ behaviour (PEP-721)
|
|
||||||
+ """
|
|
||||||
+ test_tar = os.path.join(self.tempdir, "test_tar_filter.tar")
|
|
||||||
+ with tarfile.open(test_tar, "w") as mytar:
|
|
||||||
+ file_tarinfo = tarfile.TarInfo("bad-link")
|
|
||||||
+ file_tarinfo.type = tarfile.SYMTYPE
|
|
||||||
+ file_tarinfo.linkname = "../../../../pwn"
|
|
||||||
+ mytar.addfile(file_tarinfo, io.BytesIO(b""))
|
|
||||||
+ with pytest.raises(InstallationError) as e:
|
|
||||||
+ untar_file(test_tar, self.tempdir)
|
|
||||||
+
|
|
||||||
+ assert "is outside the destination" in str(e.value)
|
|
||||||
+
|
|
||||||
+
|
|
||||||
|
|
||||||
def test_unpack_tar_unicode(tmpdir: Path) -> None:
|
|
||||||
test_tar = tmpdir / "test.tar"
|
|
||||||
|
|
||||||
|
|
||||||
Patch for vendored distlib from https://github.com/pypa/distlib/pull/201
|
|
||||||
|
|
||||||
diff --git a/distlib/util.py b/distlib/util.py
|
|
||||||
index e0622e4..4349d0b 100644
|
|
||||||
--- a/src/pip/_vendor/distlib/util.py
|
|
||||||
+++ b/src/pip/_vendor/distlib/util.py
|
|
||||||
@@ -1249,6 +1249,19 @@ def check_path(path):
|
|
||||||
for tarinfo in archive.getmembers():
|
|
||||||
if not isinstance(tarinfo.name, text_type):
|
|
||||||
tarinfo.name = tarinfo.name.decode('utf-8')
|
|
||||||
+
|
|
||||||
+ # Limit extraction of dangerous items, if this Python
|
|
||||||
+ # allows it easily. If not, just trust the input.
|
|
||||||
+ # See: https://docs.python.org/3/library/tarfile.html#extraction-filters
|
|
||||||
+ def extraction_filter(member, path):
|
|
||||||
+ """Run tarfile.tar_fillter, but raise the expected ValueError"""
|
|
||||||
+ # This is only called if the current Python has tarfile filters
|
|
||||||
+ try:
|
|
||||||
+ return tarfile.tar_filter(member, path)
|
|
||||||
+ except tarfile.FilterError as exc:
|
|
||||||
+ raise ValueError(str(exc))
|
|
||||||
+ archive.extraction_filter = extraction_filter
|
|
||||||
+
|
|
||||||
archive.extractall(dest_dir)
|
|
||||||
|
|
||||||
finally:
|
|
|
@ -12,7 +12,7 @@
|
||||||
|
|
||||||
Name: python%{python3_pkgversion}-%{srcname}
|
Name: python%{python3_pkgversion}-%{srcname}
|
||||||
Version: %{base_version}%{?prerel:~%{prerel}}
|
Version: %{base_version}%{?prerel:~%{prerel}}
|
||||||
Release: 5%{?dist}
|
Release: 2%{?dist}
|
||||||
Summary: A tool for installing and managing Python packages
|
Summary: A tool for installing and managing Python packages
|
||||||
|
|
||||||
# We bundle a lot of libraries with pip, which itself is under MIT license.
|
# We bundle a lot of libraries with pip, which itself is under MIT license.
|
||||||
|
@ -81,14 +81,6 @@ Patch2: nowarn-pip._internal.main.patch
|
||||||
# Upstream issue: https://github.com/pypa/packaging/issues/368
|
# Upstream issue: https://github.com/pypa/packaging/issues/368
|
||||||
Patch3: no-version-warning.patch
|
Patch3: no-version-warning.patch
|
||||||
|
|
||||||
# CVE-2007-4559, PEP-721, PEP-706: Use tarfile.data_filter for extracting
|
|
||||||
# - Minimal downstream-only patch, to be replaced by upstream solution
|
|
||||||
# proposed in https://github.com/pypa/pip/pull/12214
|
|
||||||
# - Test patch submitted upstream in the above pull request
|
|
||||||
# - Patch for vendored distlib, accepted upstream:
|
|
||||||
# https://github.com/pypa/distlib/pull/201
|
|
||||||
Patch4: cve-2007-4559-tarfile.patch
|
|
||||||
|
|
||||||
# Downstream only patch
|
# Downstream only patch
|
||||||
# Users might have local installations of pip from using
|
# Users might have local installations of pip from using
|
||||||
# `pip install --user --upgrade pip` on older/newer versions.
|
# `pip install --user --upgrade pip` on older/newer versions.
|
||||||
|
@ -207,9 +199,7 @@ Recommends: python%{python3_pkgversion}-setuptools
|
||||||
Requires(postun): alternatives >= 1.19.1-1
|
Requires(postun): alternatives >= 1.19.1-1
|
||||||
|
|
||||||
# python3.11 installs the alternatives master symlink to which we attach a slave
|
# python3.11 installs the alternatives master symlink to which we attach a slave
|
||||||
# pip has to require explicit version of python that provides
|
Requires: python%{python3_pkgversion}
|
||||||
# filters in tarfile module (fix for CVE-2007-4559).
|
|
||||||
Requires: python%{python3_pkgversion} >= 3.11.4-3
|
|
||||||
Requires(post): python%{python3_pkgversion}
|
Requires(post): python%{python3_pkgversion}
|
||||||
Requires(postun): python%{python3_pkgversion}
|
Requires(postun): python%{python3_pkgversion}
|
||||||
|
|
||||||
|
@ -227,8 +217,6 @@ Packages" or "Pip Installs Python".
|
||||||
%package -n %{python_wheel_pkg_prefix}-%{srcname}-wheel
|
%package -n %{python_wheel_pkg_prefix}-%{srcname}-wheel
|
||||||
Summary: The pip wheel
|
Summary: The pip wheel
|
||||||
Requires: ca-certificates
|
Requires: ca-certificates
|
||||||
# Older Python does not provide tarfile filters (fix for CVE-2007-4559).
|
|
||||||
Conflicts: python%{python3_pkgversion} < 3.11.4-3
|
|
||||||
|
|
||||||
# Virtual provides for the packages bundled by pip:
|
# Virtual provides for the packages bundled by pip:
|
||||||
%{bundled %{python3_pkgversion}}
|
%{bundled %{python3_pkgversion}}
|
||||||
|
@ -401,46 +389,34 @@ fi
|
||||||
%{python_wheel_dir}/%{python_wheel_name}
|
%{python_wheel_dir}/%{python_wheel_name}
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
* Wed Feb 14 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 22.3.1-5
|
|
||||||
- Require Python with tarfile filters
|
|
||||||
Resolves: RHEL-25453
|
|
||||||
|
|
||||||
* Tue Aug 08 2023 Petr Viktorin <pviktori@redhat.com> - 22.3.1-4
|
|
||||||
- Use tarfile.data_filter for extracting (CVE-2007-4559, PEP-721, PEP-706)
|
|
||||||
Resolves: RHBZ#2218249
|
|
||||||
|
|
||||||
* Mon Mar 06 2023 Lumír Balhar <lbalhar@redhat.com> - 22.3.1-3
|
|
||||||
- Fix changelog to contain Fedora contributors
|
|
||||||
Resolves: RHEL-232
|
|
||||||
|
|
||||||
* Mon Jan 30 2023 Charalampos Stratakis <cstratak@redhat.com> - 22.3.1-2
|
* Mon Jan 30 2023 Charalampos Stratakis <cstratak@redhat.com> - 22.3.1-2
|
||||||
- Add BuildRequires on python3.11-rpm-macros
|
- Add BuildRequires on python3.11-rpm-macros
|
||||||
|
|
||||||
* Wed Aug 03 2022 Charalampos Stratakis <cstratak@redhat.com> - 22.3.1-1
|
* Wed Aug 03 2022 Charalampos Stratakis <cstratak@redhat.com> - 22.3.1-1
|
||||||
- Initial package
|
- Initial package
|
||||||
- Fedora contributions by:
|
- Fedora contributions by:
|
||||||
Bill Nottingham <notting@fedoraproject.org>
|
# Bill Nottingham <notting@fedoraproject.org>
|
||||||
Charalampos Stratakis <cstratak@redhat.com>
|
# Charalampos Stratakis <cstratak@redhat.com>
|
||||||
David Malcolm <dmalcolm@redhat.com>
|
# David Malcolm <dmalcolm@redhat.com>
|
||||||
Dennis Gilmore <dennis@ausil.us>
|
# Dennis Gilmore <dennis@ausil.us>
|
||||||
Jon Ciesla <limburgher@gmail.com>
|
# Jon Ciesla <limburgher@gmail.com>
|
||||||
Karolina Surma <ksurma@redhat.com>
|
# Karolina Surma <ksurma@redhat.com>
|
||||||
Kevin Fenzi <kevin@fedoraproject.org>
|
# Kevin Fenzi <kevin@fedoraproject.org>
|
||||||
Kevin Kofler <Kevin@tigcc.ticalc.org>
|
# Kevin Kofler <Kevin@tigcc.ticalc.org>
|
||||||
Luke Macken <lmacken@redhat.com>
|
# Luke Macken <lmacken@redhat.com>
|
||||||
Lumir Balhar <lbalhar@redhat.com>
|
# Lumir Balhar <lbalhar@redhat.com>
|
||||||
Marcel Plch <mplch@redhat.com>
|
# Marcel Plch <mplch@redhat.com>
|
||||||
Matej Stuchlik <mstuchli@redhat.com>
|
# Matej Stuchlik <mstuchli@redhat.com>
|
||||||
Michal Cyprian <m.cyprian@gmail.com>
|
# Michal Cyprian <m.cyprian@gmail.com>
|
||||||
Miro Hrončok <miro@hroncok.cz>
|
# Miro Hrončok <miro@hroncok.cz>
|
||||||
Orion Poplawski <orion@cora.nwra.com>
|
# Orion Poplawski <orion@cora.nwra.com>
|
||||||
Pádraig Brady <P@draigBrady.com>
|
# Pádraig Brady <P@draigBrady.com>
|
||||||
Peter Halliday <hoangelos@fedoraproject.org>
|
# Peter Halliday <hoangelos@fedoraproject.org>
|
||||||
Petr Viktorin <pviktori@redhat.com>
|
# Petr Viktorin <pviktori@redhat.com>
|
||||||
Robert Kuska <rkuska@redhat.com>
|
# Robert Kuska <rkuska@redhat.com>
|
||||||
Slavek Kabrda <bkabrda@redhat.com>
|
# Slavek Kabrda <bkabrda@redhat.com>
|
||||||
Tim Flink <tflink@fedoraproject.org>
|
# Tim Flink <tflink@fedoraproject.org>
|
||||||
Tomáš Hrnčiar <thrnciar@redhat.com>
|
# Tomáš Hrnčiar <thrnciar@redhat.com>
|
||||||
Tomas Orsava <torsava@redhat.com>
|
# Tomas Orsava <torsava@redhat.com>
|
||||||
Toshio Kuratomi <toshio@fedoraproject.org>
|
# Toshio Kuratomi <toshio@fedoraproject.org>
|
||||||
Ville Skyttä <ville.skytta@iki.fi>
|
# Ville Skyttä <ville.skytta@iki.fi>
|
||||||
|
|
Loading…
Reference in New Issue