summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools
diff options
context:
space:
mode:
authorNarpat Mali <narpat.mali@windriver.com>2023-08-29 14:57:53 +0000
committerSteve Sakoman <steve@sakoman.com>2023-09-04 04:13:24 -1000
commit7b65658ede3253a6d22297a6c5550f1400274632 (patch)
tree49154bfede28b2981c7acbf8060f1946a02ef16d /meta/recipes-devtools
parentcccf6723f3188ebe1da2a85c14f63e8a9a33e776 (diff)
downloadpoky-7b65658ede3253a6d22297a6c5550f1400274632.tar.gz
python3-pygments: fix for CVE-2022-40896
A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer. The CVE issue is fixed by these 3 different commits in different version: 1. Improve the Smithy metadata matcher (These changes are already available as part of current python3-pygments_2.14.0 version): https://github.com/pygments/pygments/commit/dd52102c38ebe78cd57748e09f38929fd283ad04 (2.14.0) 2. SQL+Jinja: use a simpler regex in analyse_text: https://github.com/pygments/pygments/commit/97eb3d5ec7c1b3ea4fcf9dee30a2309cf92bd194 (2.15.0) 3. Improve Java properties lexer (#2404): https://github.com/pygments/pygments/commit/fdf182a7af85b1deeeb637ca970d31935e7c9d52 (2.15.1) References: https://nvd.nist.gov/vuln/detail/CVE-2022-40896 https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2/ (From OE-Core rev: 5a02307af5e593be864423a9f3ab309703d61dbf) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat (limited to 'meta/recipes-devtools')
-rw-r--r--meta/recipes-devtools/python/python3-pygments/CVE-2022-40896-0001.patch49
-rw-r--r--meta/recipes-devtools/python/python3-pygments/CVE-2022-40896-0002.patch301
-rw-r--r--meta/recipes-devtools/python/python3-pygments_2.14.0.bb4
3 files changed, 354 insertions, 0 deletions
diff --git a/meta/recipes-devtools/python/python3-pygments/CVE-2022-40896-0001.patch b/meta/recipes-devtools/python/python3-pygments/CVE-2022-40896-0001.patch
new file mode 100644
index 0000000000..d7fc87fec8
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-pygments/CVE-2022-40896-0001.patch
@@ -0,0 +1,49 @@
1From 9a73f2a80e5cf869d473ddcbfceaab229fb99b5e Mon Sep 17 00:00:00 2001
2From: Narpat Mali <narpat.mali@windriver.com>
3Date: Mon, 28 Aug 2023 15:04:14 +0000
4Subject: [PATCH] SQL+Jinja: use a simpler regex in analyse_text
5
6Fixes catastrophic backtracking
7
8Fixes #2355
9
10CVE: CVE-2022-40896
11
12Upstream-Status: Backport [https://github.com/pygments/pygments/commit/97eb3d5ec7c1b3ea4fcf9dee30a2309cf92bd194]
13
14Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
15---
16 CHANGES | 1 +
17 pygments/lexers/templates.py | 6 +-----
18 2 files changed, 2 insertions(+), 5 deletions(-)
19
20diff --git a/CHANGES b/CHANGES
21index 2aa54fa..4c84fa6 100644
22--- a/CHANGES
23+++ b/CHANGES
24@@ -61,6 +61,7 @@ Version 2.14.0
25 * Spice: Add ``enum`` keyword and fix a bug regarding binary,
26 hexadecimal and octal number tokens (#2227)
27 * YAML: Accept colons in key names (#2277)
28+ * SQL+Jinja (``analyse_text`` method): fix catastrophic backtracking [Backported]
29
30 - Fix `make mapfiles` when Pygments is not installed in editable mode
31 (#2223)
32diff --git a/pygments/lexers/templates.py b/pygments/lexers/templates.py
33index 1fcf708..1066294 100644
34--- a/pygments/lexers/templates.py
35+++ b/pygments/lexers/templates.py
36@@ -2291,10 +2291,6 @@ class SqlJinjaLexer(DelegatingLexer):
37 if re.search(r'\{\{\s*source\(.*\)\s*\}\}', text):
38 rv += 0.25
39 # Jinja macro
40- if re.search(
41- r'\{%-?\s*macro \w+\(.*\)\s*-?%\}\s+.*\s+\{%-?\s*endmacro\s*-?%\}',
42- text,
43- re.S,
44- ):
45+ if re.search(r'\{%-?\s*macro \w+\(.*\)\s*-?%\}', text):
46 rv += 0.15
47 return rv
48--
492.40.0
diff --git a/meta/recipes-devtools/python/python3-pygments/CVE-2022-40896-0002.patch b/meta/recipes-devtools/python/python3-pygments/CVE-2022-40896-0002.patch
new file mode 100644
index 0000000000..61ebe5dad5
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-pygments/CVE-2022-40896-0002.patch
@@ -0,0 +1,301 @@
1From 45ff8eabe0363f829c397372aefc3b23aeb135b3 Mon Sep 17 00:00:00 2001
2From: Narpat Mali <narpat.mali@windriver.com>
3Date: Tue, 29 Aug 2023 10:45:34 +0000
4Subject: [PATCH] Improve Java properties lexer (#2404)
5
6Use special lexer rules for escapes; fixes catastrophic backtracking,
7and highlights them too.
8
9Fixes #2356
10
11CVE: CVE-2022-40896
12
13Upstream-Status: Backport [https://github.com/pygments/pygments/commit/fdf182a7af85b1deeeb637ca970d31935e7c9d52]
14
15Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
16---
17 pygments/lexers/configs.py | 50 +++++---
18 tests/examplefiles/properties/java.properties | 11 ++
19 .../properties/java.properties.output | 110 +++++++++++++++---
20 .../test_escaped_space_in_value.txt | 4 +-
21 .../properties/test_just_key_with_space.txt | 4 +-
22 5 files changed, 143 insertions(+), 36 deletions(-)
23
24diff --git a/pygments/lexers/configs.py b/pygments/lexers/configs.py
25index e04c722..b28b56a 100644
26--- a/pygments/lexers/configs.py
27+++ b/pygments/lexers/configs.py
28@@ -129,26 +129,42 @@ class PropertiesLexer(RegexLexer):
29
30 tokens = {
31 'root': [
32- (r'\s+', Whitespace),
33+ # comments
34 (r'[!#].*|/{2}.*', Comment.Single),
35- # search for first separator
36- (r'([^\\\n]|\\.)*?(?=[ \f\t=:])', Name.Attribute, "separator"),
37- # empty key
38- (r'.+?$', Name.Attribute),
39+ # ending a comment or whitespace-only line
40+ (r'\n', Whitespace),
41+ # eat whitespace at the beginning of a line
42+ (r'^[^\S\n]+', Whitespace),
43+ # start lexing a key
44+ default('key'),
45 ],
46- 'separator': [
47- # search for line continuation escape
48- (r'([ \f\t]*)([=:]*)([ \f\t]*)(.*(?<!\\)(?:\\{2})*)(\\)(?!\\)$',
49- bygroups(Whitespace, Operator, Whitespace, String, Text), "value", "#pop"),
50- (r'([ \f\t]*)([=:]*)([ \f\t]*)(.*)',
51- bygroups(Whitespace, Operator, Whitespace, String), "#pop"),
52+ 'key': [
53+ # non-escaped key characters
54+ (r'[^\\:=\s]+', Name.Attribute),
55+ # escapes
56+ include('escapes'),
57+ # separator is the first non-escaped whitespace or colon or '=' on the line;
58+ # if it's whitespace, = and : are gobbled after it
59+ (r'([^\S\n]*)([:=])([^\S\n]*)',
60+ bygroups(Whitespace, Operator, Whitespace),
61+ ('#pop', 'value')),
62+ (r'[^\S\n]+', Whitespace, ('#pop', 'value')),
63+ # maybe we got no value after all
64+ (r'\n', Whitespace, '#pop'),
65 ],
66- 'value': [ # line continuation
67- (r'\s+', Whitespace),
68- # search for line continuation escape
69- (r'(\s*)(.*(?<!\\)(?:\\{2})*)(\\)(?!\\)([ \t]*)',
70- bygroups(Whitespace, String, Text, Whitespace)),
71- (r'.*$', String, "#pop"),
72+ 'value': [
73+ # non-escaped value characters
74+ (r'[^\\\n]+', String),
75+ # escapes
76+ include('escapes'),
77+ # end the value on an unescaped newline
78+ (r'\n', Whitespace, '#pop'),
79+ ],
80+ 'escapes': [
81+ # line continuations; these gobble whitespace at the beginning of the next line
82+ (r'(\\\n)([^\S\n]*)', bygroups(String.Escape, Whitespace)),
83+ # other escapes
84+ (r'\\(.|\n)', String.Escape),
85 ],
86 }
87
88diff --git a/tests/examplefiles/properties/java.properties b/tests/examplefiles/properties/java.properties
89index d5b594e..7fe915c 100644
90--- a/tests/examplefiles/properties/java.properties
91+++ b/tests/examplefiles/properties/java.properties
92@@ -14,6 +14,8 @@ key = \
93 and value2\\
94 key\ 2 = value
95 key\\ 3 = value3
96+key \
97+ = value
98
99 ! empty keys and edge cases
100 key1 =
101@@ -22,3 +24,12 @@ key3 the value3
102 key4 the:value4
103 key5 the=value5
104 key6=the value6
105+
106+! escapes in keys
107+key\ with\ spaces = value
108+key\nwith\nnewlines = value\nwith\nnewlines
109+
110+ ! indented comment
111+
112+! line continuations do \
113+not = work for comments
114diff --git a/tests/examplefiles/properties/java.properties.output b/tests/examplefiles/properties/java.properties.output
115index 0c1fdee..4822575 100644
116--- a/tests/examplefiles/properties/java.properties.output
117+++ b/tests/examplefiles/properties/java.properties.output
118@@ -2,13 +2,17 @@
119 '\n' Text.Whitespace
120
121 '# mixing spaces' Comment.Single
122-'\n\t' Text.Whitespace
123+'\n' Text.Whitespace
124+
125+'\t' Text.Whitespace
126 'Truth' Name.Attribute
127 ' ' Text.Whitespace
128 '=' Operator
129 ' ' Text.Whitespace
130 'Beauty' Literal.String
131-'\n ' Text.Whitespace
132+'\n' Text.Whitespace
133+
134+' ' Text.Whitespace
135 'Truth' Name.Attribute
136 ':' Operator
137 'Beauty' Literal.String
138@@ -23,18 +27,24 @@
139 ' ' Text.Whitespace
140 ':' Operator
141 'Beauty' Literal.String
142-'\n \n' Text.Whitespace
143+'\n' Text.Whitespace
144+
145+'\n' Text.Whitespace
146
147 '! line continuations and escapes' Comment.Single
148-'\n ' Text.Whitespace
149+'\n' Text.Whitespace
150+
151+' ' Text.Whitespace
152 'fruits' Name.Attribute
153 ' ' Text.Whitespace
154 'apple, banana, pear, ' Literal.String
155-'\\' Text
156-'\n ' Text.Whitespace
157+'\\\n' Literal.String.Escape
158+
159+' ' Text.Whitespace
160 'cantaloupe, watermelon, ' Literal.String
161-'\\' Text
162-'\n ' Text.Whitespace
163+'\\\n' Literal.String.Escape
164+
165+' ' Text.Whitespace
166 'kiwi, mango' Literal.String
167 '\n' Text.Whitespace
168
169@@ -42,25 +52,42 @@
170 ' ' Text.Whitespace
171 '=' Operator
172 ' ' Text.Whitespace
173-'\\' Text
174-'\n ' Text.Whitespace
175-'value1 \\\\' Literal.String
176-'\\' Text
177-'\n ' Text.Whitespace
178-'and value2\\\\' Literal.String
179+'\\\n' Literal.String.Escape
180+
181+' ' Text.Whitespace
182+'value1 ' Literal.String
183+'\\\\' Literal.String.Escape
184+'\\\n' Literal.String.Escape
185+
186+' ' Text.Whitespace
187+'and value2' Literal.String
188+'\\\\' Literal.String.Escape
189 '\n' Text.Whitespace
190
191-'key\\ 2' Name.Attribute
192+'key' Name.Attribute
193+'\\ ' Literal.String.Escape
194+'2' Name.Attribute
195 ' ' Text.Whitespace
196 '=' Operator
197 ' ' Text.Whitespace
198 'value' Literal.String
199 '\n' Text.Whitespace
200
201-'key\\\\' Name.Attribute
202+'key' Name.Attribute
203+'\\\\' Literal.String.Escape
204 ' ' Text.Whitespace
205 '3 = value3' Literal.String
206-'\n\n' Text.Whitespace
207+'\n' Text.Whitespace
208+
209+'key' Name.Attribute
210+' ' Text.Whitespace
211+'\\\n' Literal.String.Escape
212+
213+' ' Text.Whitespace
214+'= value' Literal.String
215+'\n' Text.Whitespace
216+
217+'\n' Text.Whitespace
218
219 '! empty keys and edge cases' Comment.Single
220 '\n' Text.Whitespace
221@@ -92,3 +119,52 @@
222 '=' Operator
223 'the value6' Literal.String
224 '\n' Text.Whitespace
225+
226+'\n' Text.Whitespace
227+
228+'! escapes in keys' Comment.Single
229+'\n' Text.Whitespace
230+
231+'key' Name.Attribute
232+'\\ ' Literal.String.Escape
233+'with' Name.Attribute
234+'\\ ' Literal.String.Escape
235+'spaces' Name.Attribute
236+' ' Text.Whitespace
237+'=' Operator
238+' ' Text.Whitespace
239+'value' Literal.String
240+'\n' Text.Whitespace
241+
242+'key' Name.Attribute
243+'\\n' Literal.String.Escape
244+'with' Name.Attribute
245+'\\n' Literal.String.Escape
246+'newlines' Name.Attribute
247+' ' Text.Whitespace
248+'=' Operator
249+' ' Text.Whitespace
250+'value' Literal.String
251+'\\n' Literal.String.Escape
252+'with' Literal.String
253+'\\n' Literal.String.Escape
254+'newlines' Literal.String
255+'\n' Text.Whitespace
256+
257+'\n' Text.Whitespace
258+
259+' ' Text.Whitespace
260+'! indented comment' Comment.Single
261+'\n' Text.Whitespace
262+
263+'\n' Text.Whitespace
264+
265+'! line continuations do \\' Comment.Single
266+'\n' Text.Whitespace
267+
268+'not' Name.Attribute
269+' ' Text.Whitespace
270+'=' Operator
271+' ' Text.Whitespace
272+'work for comments' Literal.String
273+'\n' Text.Whitespace
274diff --git a/tests/snippets/properties/test_escaped_space_in_value.txt b/tests/snippets/properties/test_escaped_space_in_value.txt
275index f76507f..44772d8 100644
276--- a/tests/snippets/properties/test_escaped_space_in_value.txt
277+++ b/tests/snippets/properties/test_escaped_space_in_value.txt
278@@ -6,5 +6,7 @@ key = doubleword\ value
279 ' ' Text.Whitespace
280 '=' Operator
281 ' ' Text.Whitespace
282-'doubleword\\ value' Literal.String
283+'doubleword' Literal.String
284+'\\ ' Literal.String.Escape
285+'value' Literal.String
286 '\n' Text.Whitespace
287diff --git a/tests/snippets/properties/test_just_key_with_space.txt b/tests/snippets/properties/test_just_key_with_space.txt
288index 660c37c..833fe40 100644
289--- a/tests/snippets/properties/test_just_key_with_space.txt
290+++ b/tests/snippets/properties/test_just_key_with_space.txt
291@@ -2,5 +2,7 @@
292 just\ key
293
294 ---tokens---
295-'just\\ key' Name.Attribute
296+'just' Name.Attribute
297+'\\ ' Literal.String.Escape
298+'key' Name.Attribute
299 '\n' Text.Whitespace
300--
3012.40.0
diff --git a/meta/recipes-devtools/python/python3-pygments_2.14.0.bb b/meta/recipes-devtools/python/python3-pygments_2.14.0.bb
index 16769e9263..b5b8abc113 100644
--- a/meta/recipes-devtools/python/python3-pygments_2.14.0.bb
+++ b/meta/recipes-devtools/python/python3-pygments_2.14.0.bb
@@ -7,6 +7,10 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=36a13c90514e2899f1eba7f41c3ee592"
7inherit setuptools3 7inherit setuptools3
8SRC_URI[sha256sum] = "b3ed06a9e8ac9a9aae5a6f5dbe78a8a58655d17b43b93c078f094ddc476ae297" 8SRC_URI[sha256sum] = "b3ed06a9e8ac9a9aae5a6f5dbe78a8a58655d17b43b93c078f094ddc476ae297"
9 9
10SRC_URI += "file://CVE-2022-40896-0001.patch \
11 file://CVE-2022-40896-0002.patch \
12 "
13
10DEPENDS += "\ 14DEPENDS += "\
11 ${PYTHON_PN} \ 15 ${PYTHON_PN} \
12 " 16 "
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-14 20:09:10 +0000