summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/python
diff options
context:
space:
mode:
authorChen Qi <Qi.Chen@windriver.com>2019-10-24 12:19:14 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2019-10-28 05:31:42 +0000
commit423d32dae2e678e2bd57a30f2212331ca21cc968 (patch)
treedf467ae9346ebda12ed7364a086ac90b07116cfc /meta/recipes-devtools/python
parent6d77529d62248d77aff8e293905d9a156997a12c (diff)
downloadpoky-423d32dae2e678e2bd57a30f2212331ca21cc968.tar.gz
python3: fix CVE-2019-16935
(From OE-Core rev: 78846c823cbb662897ce85b061a745c1dd7deeab) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools/python')
-rw-r--r--meta/recipes-devtools/python/python3/0001-bpo-38243-xmlrpc.server-Escape-the-server_title-GH-1.patch86
-rw-r--r--meta/recipes-devtools/python/python3_3.7.4.bb1
2 files changed, 87 insertions, 0 deletions
diff --git a/meta/recipes-devtools/python/python3/0001-bpo-38243-xmlrpc.server-Escape-the-server_title-GH-1.patch b/meta/recipes-devtools/python/python3/0001-bpo-38243-xmlrpc.server-Escape-the-server_title-GH-1.patch
new file mode 100644
index 0000000000..1a4c932070
--- /dev/null
+++ b/meta/recipes-devtools/python/python3/0001-bpo-38243-xmlrpc.server-Escape-the-server_title-GH-1.patch
@@ -0,0 +1,86 @@
1From c25abd43e8877b4a7098f79eaacb248710731c2b Mon Sep 17 00:00:00 2001
2From: Dong-hee Na <donghee.na92@gmail.com>
3Date: Sat, 28 Sep 2019 04:59:37 +0900
4Subject: [PATCH] bpo-38243, xmlrpc.server: Escape the server_title (GH-16373)
5
6Escape the server title of xmlrpc.server.DocXMLRPCServer
7when rendering the document page as HTML.
8
9CVE: CVE-2019-16935
10
11Upstream-Status: Backport [https://github.com/python/cpython/commit/e8650a4f8c7fb76f570d4ca9c1fbe44e91c8dfaa]
12
13Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
14---
15 Lib/test/test_docxmlrpc.py | 16 ++++++++++++++++
16 Lib/xmlrpc/server.py | 3 ++-
17 .../2019-09-25-13-21-09.bpo-38243.1pfz24.rst | 3 +++
18 3 files changed, 21 insertions(+), 1 deletion(-)
19 create mode 100644 Misc/NEWS.d/next/Security/2019-09-25-13-21-09.bpo-38243.1pfz24.rst
20
21diff --git a/Lib/test/test_docxmlrpc.py b/Lib/test/test_docxmlrpc.py
22index f077f05f5b..38215659b6 100644
23--- a/Lib/test/test_docxmlrpc.py
24+++ b/Lib/test/test_docxmlrpc.py
25@@ -1,5 +1,6 @@
26 from xmlrpc.server import DocXMLRPCServer
27 import http.client
28+import re
29 import sys
30 import threading
31 from test import support
32@@ -193,6 +194,21 @@ class DocXMLRPCHTTPGETServer(unittest.TestCase):
33 b'method_annotation</strong></a>(x: bytes)</dt></dl>'),
34 response.read())
35
36+ def test_server_title_escape(self):
37+ # bpo-38243: Ensure that the server title and documentation
38+ # are escaped for HTML.
39+ self.serv.set_server_title('test_title<script>')
40+ self.serv.set_server_documentation('test_documentation<script>')
41+ self.assertEqual('test_title<script>', self.serv.server_title)
42+ self.assertEqual('test_documentation<script>',
43+ self.serv.server_documentation)
44+
45+ generated = self.serv.generate_html_documentation()
46+ title = re.search(r'<title>(.+?)</title>', generated).group()
47+ documentation = re.search(r'<p><tt>(.+?)</tt></p>', generated).group()
48+ self.assertEqual('<title>Python: test_title&lt;script&gt;</title>', title)
49+ self.assertEqual('<p><tt>test_documentation&lt;script&gt;</tt></p>', documentation)
50+
51
52 if __name__ == '__main__':
53 unittest.main()
54diff --git a/Lib/xmlrpc/server.py b/Lib/xmlrpc/server.py
55index f1c467eb1b..32aba4df4c 100644
56--- a/Lib/xmlrpc/server.py
57+++ b/Lib/xmlrpc/server.py
58@@ -108,6 +108,7 @@ from xmlrpc.client import Fault, dumps, loads, gzip_encode, gzip_decode
59 from http.server import BaseHTTPRequestHandler
60 from functools import partial
61 from inspect import signature
62+import html
63 import http.server
64 import socketserver
65 import sys
66@@ -894,7 +895,7 @@ class XMLRPCDocGenerator:
67 methods
68 )
69
70- return documenter.page(self.server_title, documentation)
71+ return documenter.page(html.escape(self.server_title), documentation)
72
73 class DocXMLRPCRequestHandler(SimpleXMLRPCRequestHandler):
74 """XML-RPC and documentation request handler class.
75diff --git a/Misc/NEWS.d/next/Security/2019-09-25-13-21-09.bpo-38243.1pfz24.rst b/Misc/NEWS.d/next/Security/2019-09-25-13-21-09.bpo-38243.1pfz24.rst
76new file mode 100644
77index 0000000000..98d7be1295
78--- /dev/null
79+++ b/Misc/NEWS.d/next/Security/2019-09-25-13-21-09.bpo-38243.1pfz24.rst
80@@ -0,0 +1,3 @@
81+Escape the server title of :class:`xmlrpc.server.DocXMLRPCServer`
82+when rendering the document page as HTML.
83+(Contributed by Dong-hee Na in :issue:`38243`.)
84--
852.17.1
86
diff --git a/meta/recipes-devtools/python/python3_3.7.4.bb b/meta/recipes-devtools/python/python3_3.7.4.bb
index 8c429e95c3..dd61c0aa45 100644
--- a/meta/recipes-devtools/python/python3_3.7.4.bb
+++ b/meta/recipes-devtools/python/python3_3.7.4.bb
@@ -30,6 +30,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
30 file://0001-test_locale.py-correct-the-test-output-format.patch \ 30 file://0001-test_locale.py-correct-the-test-output-format.patch \
31 file://0017-setup.py-do-not-report-missing-dependencies-for-disa.patch \ 31 file://0017-setup.py-do-not-report-missing-dependencies-for-disa.patch \
32 file://0001-bpo-34155-Dont-parse-domains-containing-GH-13079.patch \ 32 file://0001-bpo-34155-Dont-parse-domains-containing-GH-13079.patch \
33 file://0001-bpo-38243-xmlrpc.server-Escape-the-server_title-GH-1.patch \
33 " 34 "
34 35
35SRC_URI_append_class-native = " \ 36SRC_URI_append_class-native = " \