mirror of
https://github.com/archlinuxarm/PKGBUILDs.git
synced 2024-11-08 22:45:43 +00:00
extra/python to 3.2-2
This commit is contained in:
Kevin Mihelich
parent
d59aa32d20
commit
deb9b52044
2 changed files with 149 additions and 8 deletions
134
extra/python/CVE-2011-1521.patch
Normal file
134
extra/python/CVE-2011-1521.patch
Normal file
|
|
@ -0,0 +1,134 @@
|
|||
diff -Naur Python-3.2.ori/Doc/library/urllib.request.rst Python-3.2/Doc/library/urllib.request.rst
|
||||
--- Python-3.2.ori/Doc/library/urllib.request.rst 2011-02-11 03:25:47.000000000 -0800
|
||||
+++ Python-3.2/Doc/library/urllib.request.rst 2011-04-15 03:49:02.778745379 -0700
|
||||
@@ -650,6 +650,10 @@
|
||||
is the case, :exc:`HTTPError` is raised. See :rfc:`2616` for details of the
|
||||
precise meanings of the various redirection codes.
|
||||
|
||||
+ An :class:`HTTPError` exception raised as a security consideration if the
|
||||
+ HTTPRedirectHandler is presented with a redirected url which is not an HTTP,
|
||||
+ HTTPS or FTP url.
|
||||
+
|
||||
|
||||
.. method:: HTTPRedirectHandler.redirect_request(req, fp, code, msg, hdrs, newurl)
|
||||
|
||||
diff -Naur Python-3.2.ori/Lib/test/test_urllib2.py Python-3.2/Lib/test/test_urllib2.py
|
||||
--- Python-3.2.ori/Lib/test/test_urllib2.py 2011-02-11 03:25:47.000000000 -0800
|
||||
+++ Python-3.2/Lib/test/test_urllib2.py 2011-04-15 03:50:29.705417290 -0700
|
||||
@@ -8,6 +8,7 @@
|
||||
|
||||
import urllib.request
|
||||
from urllib.request import Request, OpenerDirector
|
||||
+import urllib.error
|
||||
|
||||
# XXX
|
||||
# Request
|
||||
@@ -1029,6 +1030,29 @@
|
||||
self.assertEqual(count,
|
||||
urllib.request.HTTPRedirectHandler.max_redirections)
|
||||
|
||||
+
|
||||
+ def test_invalid_redirect(self):
|
||||
+ from_url = "http://example.com/a.html"
|
||||
+ valid_schemes = ['http','https','ftp']
|
||||
+ invalid_schemes = ['file','imap','ldap']
|
||||
+ schemeless_url = "example.com/b.html"
|
||||
+ h = urllib.request.HTTPRedirectHandler()
|
||||
+ o = h.parent = MockOpener()
|
||||
+ req = Request(from_url)
|
||||
+ req.timeout = socket._GLOBAL_DEFAULT_TIMEOUT
|
||||
+
|
||||
+ for scheme in invalid_schemes:
|
||||
+ invalid_url = scheme + '://' + schemeless_url
|
||||
+ self.assertRaises(urllib.error.HTTPError, h.http_error_302,
|
||||
+ req, MockFile(), 302, "Security Loophole",
|
||||
+ MockHeaders({"location": invalid_url}))
|
||||
+
|
||||
+ for scheme in valid_schemes:
|
||||
+ valid_url = scheme + '://' + schemeless_url
|
||||
+ h.http_error_302(req, MockFile(), 302, "That's fine",
|
||||
+ MockHeaders({"location": valid_url}))
|
||||
+ self.assertEqual(o.req.get_full_url(), valid_url)
|
||||
+
|
||||
def test_cookie_redirect(self):
|
||||
# cookies shouldn't leak into redirected requests
|
||||
from http.cookiejar import CookieJar
|
||||
diff -Naur Python-3.2.ori/Lib/test/test_urllib.py Python-3.2/Lib/test/test_urllib.py
|
||||
--- Python-3.2.ori/Lib/test/test_urllib.py 2010-12-17 09:35:56.000000000 -0800
|
||||
+++ Python-3.2/Lib/test/test_urllib.py 2011-04-15 03:49:02.778745379 -0700
|
||||
@@ -2,6 +2,7 @@
|
||||
|
||||
import urllib.parse
|
||||
import urllib.request
|
||||
+import urllib.error
|
||||
import http.client
|
||||
import email.message
|
||||
import io
|
||||
@@ -198,6 +199,21 @@
|
||||
finally:
|
||||
self.unfakehttp()
|
||||
|
||||
+ def test_invalid_redirect(self):
|
||||
+ # urlopen() should raise IOError for many error codes.
|
||||
+ self.fakehttp(b'''HTTP/1.1 302 Found
|
||||
+Date: Wed, 02 Jan 2008 03:03:54 GMT
|
||||
+Server: Apache/1.3.33 (Debian GNU/Linux) mod_ssl/2.8.22 OpenSSL/0.9.7e
|
||||
+Location: file://guidocomputer.athome.com:/python/license
|
||||
+Connection: close
|
||||
+Content-Type: text/html; charset=iso-8859-1
|
||||
+''')
|
||||
+ try:
|
||||
+ self.assertRaises(urllib.error.HTTPError, urlopen,
|
||||
+ "http://python.org/")
|
||||
+ finally:
|
||||
+ self.unfakehttp()
|
||||
+
|
||||
def test_empty_socket(self):
|
||||
# urlopen() raises IOError if the underlying socket does not send any
|
||||
# data. (#1680230)
|
||||
diff -Naur Python-3.2.ori/Lib/urllib/request.py Python-3.2/Lib/urllib/request.py
|
||||
--- Python-3.2.ori/Lib/urllib/request.py 2011-02-11 03:25:47.000000000 -0800
|
||||
+++ Python-3.2/Lib/urllib/request.py 2011-04-15 03:49:02.778745379 -0700
|
||||
@@ -545,6 +545,17 @@
|
||||
|
||||
# fix a possible malformed URL
|
||||
urlparts = urlparse(newurl)
|
||||
+
|
||||
+ # For security reasons we don't allow redirection to anything other
|
||||
+ # than http, https or ftp.
|
||||
+
|
||||
+ if not urlparts.scheme in ('http', 'https', 'ftp'):
|
||||
+ raise HTTPError(newurl, code,
|
||||
+ msg +
|
||||
+ " - Redirection to url '%s' is not allowed" %
|
||||
+ newurl,
|
||||
+ headers, fp)
|
||||
+
|
||||
if not urlparts.path:
|
||||
urlparts = list(urlparts)
|
||||
urlparts[2] = "/"
|
||||
@@ -1897,8 +1908,24 @@
|
||||
return
|
||||
void = fp.read()
|
||||
fp.close()
|
||||
+
|
||||
# In case the server sent a relative URL, join with original:
|
||||
newurl = urljoin(self.type + ":" + url, newurl)
|
||||
+
|
||||
+ urlparts = urlparse(newurl)
|
||||
+
|
||||
+ # For security reasons, we don't allow redirection to anything other
|
||||
+ # than http, https and ftp.
|
||||
+
|
||||
+ # We are using newer HTTPError with older redirect_internal method
|
||||
+ # This older method will get deprecated in 3.3
|
||||
+
|
||||
+ if not urlparts.scheme in ('http', 'https', 'ftp'):
|
||||
+ raise HTTPError(newurl, errcode,
|
||||
+ errmsg +
|
||||
+ " Redirection to url '%s' is not allowed." % newurl,
|
||||
+ headers, fp)
|
||||
+
|
||||
return self.open(newurl)
|
||||
|
||||
def http_error_301(self, url, fp, errcode, errmsg, headers, data=None):
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# $Id: PKGBUILD 110651 2011-02-21 01:21:12Z stephane $
|
||||
# $Id: PKGBUILD 119805 2011-04-15 11:51:39Z stephane $
|
||||
# Maintainer: Stéphane Gaudreault <stephane@archlinux.org>
|
||||
# Maintainer: Allan McRae <allan@archlinux.org>
|
||||
# Contributer: Jason Chu <jason@archlinux.org>
|
||||
|
|
@ -11,7 +11,7 @@ plugrel=1
|
|||
|
||||
pkgname=python
|
||||
pkgver=3.2
|
||||
pkgrel=1
|
||||
pkgrel=2
|
||||
_pybasever=3.2
|
||||
pkgdesc="Next generation of the python high-level scripting language"
|
||||
arch=('i686' 'x86_64')
|
||||
|
|
@ -23,9 +23,10 @@ optdepends=('tk: for tkinter')
|
|||
provides=('python3')
|
||||
replaces=('python3')
|
||||
options=('!makeflags')
|
||||
source=(http://www.python.org/ftp/python/${_pybasever}/Python-${pkgver}.tar.xz)
|
||||
sha1sums=('55a3a9d39f31563370d0c494373bb6d38e4d1a00')
|
||||
|
||||
source=(http://www.python.org/ftp/python/${_pybasever}/Python-${pkgver}.tar.xz
|
||||
CVE-2011-1521.patch)
|
||||
sha1sums=('55a3a9d39f31563370d0c494373bb6d38e4d1a00'
|
||||
'561161ce5ae3a91254352c09a33e3e4434444e14')
|
||||
build() {
|
||||
cd "${srcdir}/Python-${pkgver}"
|
||||
|
||||
|
|
@ -35,6 +36,10 @@ build() {
|
|||
rm -r Modules/zlib
|
||||
rm -r Modules/_ctypes/{darwin,libffi}*
|
||||
|
||||
# urllib Security Vulnerability
|
||||
# http://blog.python.org/2011/04/urllib-security-vulnerability-fixed.html
|
||||
patch -Np1 -i ../CVE-2011-1521.patch
|
||||
|
||||
./configure --prefix=/usr \
|
||||
--enable-shared \
|
||||
--with-threads \
|
||||
|
|
@ -45,10 +50,12 @@ build() {
|
|||
--with-system-ffi
|
||||
|
||||
make
|
||||
}
|
||||
|
||||
# Run the upstream test suite
|
||||
# LD_LIBRARY_PATH="${srcdir}/Python-${pkgver}":${LD_LIBRARY_PATH} \
|
||||
# "${srcdir}/Python-${pkgver}/python" -m test.regrtest -x test_distutils
|
||||
check() {
|
||||
cd "${srcdir}/Python-${pkgver}"
|
||||
LD_LIBRARY_PATH="${srcdir}/Python-${pkgver}":${LD_LIBRARY_PATH} \
|
||||
"${srcdir}/Python-${pkgver}/python" -m test.regrtest -x test_distutils test_site
|
||||
}
|
||||
|
||||
package() {
|
||||
|
|
|
|||
Loading…
Reference in a new issue