From 6839ef4a3b4ff10ea1cf7894f3b7a9e8a56bbfae Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Wed, 5 Aug 2015 18:26:43 +0200 Subject: [PATCH] Add patches from Avram Lubkin --- python-defusedxml-entity_loop.patch | 52 +++++++++++++++++++++ python-defusedxml-format_strings.patch | 63 ++++++++++++++++++++++++++ python-defusedxml.spec | 15 +++++- 3 files changed, 129 insertions(+), 1 deletion(-) create mode 100644 python-defusedxml-entity_loop.patch create mode 100644 python-defusedxml-format_strings.patch diff --git a/python-defusedxml-entity_loop.patch b/python-defusedxml-entity_loop.patch new file mode 100644 index 0000000..9db8c55 --- /dev/null +++ b/python-defusedxml-entity_loop.patch @@ -0,0 +1,52 @@ +diff -ru defusedxml-0.4.1-orig/tests.py defusedxml-0.4.1/tests.py +--- defusedxml-0.4.1-orig/tests.py 2015-07-17 05:28:36.501213026 +0000 ++++ defusedxml-0.4.1/tests.py 2015-07-17 05:21:51.633843568 +0000 +@@ -133,11 +133,12 @@ + self.iterparse(self.xml_simple_ns) + + def test_entities_forbidden(self): +- self.assertRaises(EntitiesForbidden, self.parse, self.xml_bomb) ++ self.assertRaises((EntitiesForbidden, XMLSyntaxError), ++ self.parse, self.xml_bomb) + self.assertRaises(EntitiesForbidden, self.parse, self.xml_quadratic) + self.assertRaises(EntitiesForbidden, self.parse, self.xml_external) + +- self.assertRaises(EntitiesForbidden, self.parseString, ++ self.assertRaises((EntitiesForbidden, XMLSyntaxError), self.parseString, + self.get_content(self.xml_bomb)) + self.assertRaises(EntitiesForbidden, self.parseString, + self.get_content(self.xml_quadratic)) +@@ -157,8 +158,8 @@ + forbid_entities=False) + + def test_dtd_forbidden(self): +- self.assertRaises(DTDForbidden, self.parse, self.xml_bomb, +- forbid_dtd=True) ++ self.assertRaises((DTDForbidden, XMLSyntaxError), self.parse, ++ self.xml_bomb, forbid_dtd=True) + self.assertRaises(DTDForbidden, self.parse, self.xml_quadratic, + forbid_dtd=True) + self.assertRaises(DTDForbidden, self.parse, self.xml_external, +@@ -166,7 +167,7 @@ + self.assertRaises(DTDForbidden, self.parse, self.xml_dtd, + forbid_dtd=True) + +- self.assertRaises(DTDForbidden, self.parseString, ++ self.assertRaises((DTDForbidden, XMLSyntaxError), self.parseString, + self.get_content(self.xml_bomb), + forbid_dtd=True) + self.assertRaises(DTDForbidden, self.parseString, +@@ -355,8 +356,11 @@ + pass + + def test_restricted_element1(self): +- tree = self.module.parse(self.xml_bomb, forbid_dtd=False, +- forbid_entities=False) ++ try: ++ tree = self.module.parse(self.xml_bomb, forbid_dtd=False, ++ forbid_entities=False) ++ except XMLSyntaxError: ++ return + root = tree.getroot() + self.assertEqual(root.text, None) + diff --git a/python-defusedxml-format_strings.patch b/python-defusedxml-format_strings.patch new file mode 100644 index 0000000..67a6f71 --- /dev/null +++ b/python-defusedxml-format_strings.patch @@ -0,0 +1,63 @@ +diff -ru defusedxml-0.4.1-orig/defusedxml/common.py defusedxml-0.4.1/defusedxml/common.py +--- defusedxml-0.4.1-orig/defusedxml/common.py 2015-07-17 05:28:36.502213030 +0000 ++++ defusedxml-0.4.1/defusedxml/common.py 2015-07-22 11:22:24.203648541 +0000 +@@ -30,7 +30,7 @@ + self.pubid = pubid + + def __str__(self): +- tpl = "DTDForbidden(name='{}', system_id={!r}, public_id={!r})" ++ tpl = "DTDForbidden(name='{0}', system_id={1!r}, public_id={2!r})" + return tpl.format(self.name, self.sysid, self.pubid) + + +@@ -47,7 +47,7 @@ + self.notation_name = notation_name + + def __str__(self): +- tpl = "EntitiesForbidden(name='{}', system_id={!r}, public_id={!r})" ++ tpl = "EntitiesForbidden(name='{0}', system_id={1!r}, public_id={2!r})" + return tpl.format(self.name, self.sysid, self.pubid) + + +@@ -62,7 +62,7 @@ + self.pubid = pubid + + def __str__(self): +- tpl = "ExternalReferenceForbidden(system_id='{}', public_id={})" ++ tpl = "ExternalReferenceForbidden(system_id='{0}', public_id={1})" + return tpl.format(self.sysid, self.pubid) + + +diff -ru defusedxml-0.4.1-orig/other/exploit_webdav.py defusedxml-0.4.1/other/exploit_webdav.py +--- defusedxml-0.4.1-orig/other/exploit_webdav.py 2015-07-17 05:28:36.503213033 +0000 ++++ defusedxml-0.4.1/other/exploit_webdav.py 2015-07-22 11:23:15.893964297 +0000 +@@ -9,7 +9,7 @@ + import httplib + + if len(sys.argv) != 2: +- sys.exit("{} http://user:password@host:port/".format(sys.argv[0])) ++ sys.exit("{0} http://user:password@host:port/".format(sys.argv[0])) + + url = urlparse.urlparse(sys.argv[1]) + +diff -ru defusedxml-0.4.1-orig/other/exploit_xmlrpc.py defusedxml-0.4.1/other/exploit_xmlrpc.py +--- defusedxml-0.4.1-orig/other/exploit_xmlrpc.py 2015-07-17 05:28:36.502213030 +0000 ++++ defusedxml-0.4.1/other/exploit_xmlrpc.py 2015-07-22 11:23:59.536230889 +0000 +@@ -7,7 +7,7 @@ + import urllib2 + + if len(sys.argv) != 2: +- sys.exit("{} url".format(sys.argv[0])) ++ sys.exit("{0} url".format(sys.argv[0])) + + url = sys.argv[1] + +@@ -32,7 +32,7 @@ + + req = urllib2.Request(url, data=xml, headers=headers) + +-print("Sending request to {}".format(url)) ++print("Sending request to {0}".format(url)) + + resp = urllib2.urlopen(req) + diff --git a/python-defusedxml.spec b/python-defusedxml.spec index e2749db..3e68a29 100644 --- a/python-defusedxml.spec +++ b/python-defusedxml.spec @@ -3,11 +3,17 @@ Name: python-%{pypi_name} Version: 0.4.1 -Release: 3%{?dist} +Release: 4%{?dist} Summary: XML bomb protection for Python stdlib modules License: Python URL: https://bitbucket.org/tiran/defusedxml Source0: http://pypi.python.org/packages/source/d/%{pypi_name}/%{pypi_name}-%{version}.tar.gz + +# https://bugzilla.redhat.com/show_bug.cgi?id=927883#c14 +Patch0: %{name}-entity_loop.patch +Patch1: %{name}-format_strings.patch + + BuildArch: noarch BuildRequires: python2-devel @@ -40,6 +46,9 @@ module. %prep %setup -q -n %{pypi_name}-%{version} +%patch0 -p1 +%patch1 -p1 + %if 0%{?with_python3} rm -rf %{py3dir} cp -a . %{py3dir} @@ -83,6 +92,10 @@ popd %endif # with_python3 %changelog +* Wed Aug 05 2015 Miro Hrončok - 0.4.1-4 +- Add patches by Avram Lubkin +- https://bugzilla.redhat.com/show_bug.cgi?id=927883#c14 + * Thu Jun 18 2015 Fedora Release Engineering - 0.4.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild