1 files changed, 70 insertions, 62 deletions

diff --git a/meta/recipes-devtools/python/python/CVE-2016-1000110.patch b/meta/recipes-devtools/python/python/CVE-2016-1000110.patch
index 071175acec..71e00e752e 100644
--- a/meta/recipes-devtools/python/python/CVE-2016-1000110.patch
+++ b/meta/recipes-devtools/python/python/CVE-2016-1000110.patch
@@ -1,21 +1,26 @@
-From 5be8d3e97b1d2e526548cb346fd5f8980d31616a Mon Sep 17 00:00:00 2001
+From cb25fbd5abc0f4eb07dbb8ea819e9c26bda4fc99 Mon Sep 17 00:00:00 2001
 From: Senthil Kumaran <senthil@uthcode.com>
 Date: Sat, 30 Jul 2016 05:49:53 -0700
-Subject: [PATCH] Prevent HTTPoxy attack (CVE-2016-1000110)
+Subject: [PATCH] python: fix CVE-2016-1000110
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
+Prevent HTTPoxy attack (CVE-2016-1000110)
+
 Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which
 indicates that the script is in CGI mode.
 
 Issue reported and patch contributed by Rémi Rampin.
 
+Backport patch from https://hg.python.org/cpython/rev/ba915d561667/
+
 Upstream-Status: Backport
 CVE: CVE-2016-1000110
+Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
 
-Signed-off-by: Armin Kuster <akuster@mvista.com>
-
+Copied this file from morty since the old one didn't apply to python 2.7.12.
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
 ---
  Doc/howto/urllib2.rst   |  5 +++++
  Doc/library/urllib.rst  | 10 ++++++++++
@@ -26,11 +31,11 @@ Signed-off-by: Armin Kuster <akuster@mvista.com>
  Misc/NEWS               |  4 ++++
  7 files changed, 46 insertions(+)
 
-Index: Python-2.7.11/Doc/howto/urllib2.rst
-===================================================================
---- Python-2.7.11.orig/Doc/howto/urllib2.rst
-+++ Python-2.7.11/Doc/howto/urllib2.rst
-@@ -523,6 +523,11 @@ setting up a `Basic Authentication`_ han
+diff --git a/Doc/howto/urllib2.rst b/Doc/howto/urllib2.rst
+index 6bb06d4..5cf2c0c 100644
+--- a/Doc/howto/urllib2.rst
++++ b/Doc/howto/urllib2.rst
+@@ -525,6 +525,11 @@ setting up a `Basic Authentication`_ handler: ::
      through a proxy.  However, this can be enabled by extending urllib2 as
      shown in the recipe [#]_.
  
@@ -42,13 +47,13 @@ Index: Python-2.7.11/Doc/howto/urllib2.rst
  
  Sockets and Layers
  ==================
-Index: Python-2.7.11/Doc/library/urllib.rst
-===================================================================
---- Python-2.7.11.orig/Doc/library/urllib.rst
-+++ Python-2.7.11/Doc/library/urllib.rst
-@@ -293,6 +293,16 @@ Utility functions
-    find it, looks for proxy information from Mac OSX System Configuration for
-    Mac OS X and Windows Systems Registry for Windows.
+diff --git a/Doc/library/urllib.rst b/Doc/library/urllib.rst
+index 3b5dc16..bddcba9 100644
+--- a/Doc/library/urllib.rst
++++ b/Doc/library/urllib.rst
+@@ -295,6 +295,16 @@ Utility functions
+    If both lowercase and uppercase environment variables exist (and disagree),
+    lowercase is preferred.
  
 +    .. note::
 +
@@ -62,11 +67,11 @@ Index: Python-2.7.11/Doc/library/urllib.rst
 +
  .. note::
      urllib also exposes certain utility functions like splittype, splithost and
-     others parsing url into various components. But it is recommended to use
-Index: Python-2.7.11/Doc/library/urllib2.rst
-===================================================================
---- Python-2.7.11.orig/Doc/library/urllib2.rst
-+++ Python-2.7.11/Doc/library/urllib2.rst
+     others parsing URL into various components. But it is recommended to use
+diff --git a/Doc/library/urllib2.rst b/Doc/library/urllib2.rst
+index 8a4c80e..b808b98 100644
+--- a/Doc/library/urllib2.rst
++++ b/Doc/library/urllib2.rst
 @@ -229,6 +229,11 @@ The following classes are provided:
  
     To disable autodetected proxy pass an empty dictionary.
@@ -79,25 +84,13 @@ Index: Python-2.7.11/Doc/library/urllib2.rst
  
  .. class:: HTTPPasswordMgr()
  
-Index: Python-2.7.11/Misc/ACKS
-===================================================================
---- Python-2.7.11.orig/Misc/ACKS
-+++ Python-2.7.11/Misc/ACKS
-@@ -1110,6 +1110,7 @@ Jérôme Radix
- Burton Radons
- Jeff Ramnani
- Brodie Rao
-+Rémi Rampin
- Senko Rasic
- Antti Rasinen
- Nikolaus Rath
-Index: Python-2.7.11/Lib/test/test_urllib.py
-===================================================================
---- Python-2.7.11.orig/Lib/test/test_urllib.py
-+++ Python-2.7.11/Lib/test/test_urllib.py
-@@ -162,6 +162,18 @@ class ProxyTests(unittest.TestCase):
-         self.assertTrue(urllib.proxy_bypass_environment('anotherdomain.com'))
- 
+diff --git a/Lib/test/test_urllib.py b/Lib/test/test_urllib.py
+index 434d533..27a1d38 100644
+--- a/Lib/test/test_urllib.py
++++ b/Lib/test/test_urllib.py
+@@ -170,6 +170,18 @@ class ProxyTests(unittest.TestCase):
+         self.assertTrue(urllib.proxy_bypass_environment('anotherdomain.com:8888'))
+         self.assertTrue(urllib.proxy_bypass_environment('newdomain.com:1234'))
  
 +    def test_proxy_cgi_ignore(self):
 +        try:
@@ -111,16 +104,16 @@ Index: Python-2.7.11/Lib/test/test_urllib.py
 +            self.env.unset('REQUEST_METHOD')
 +            self.env.unset('HTTP_PROXY')
 +
- class urlopen_HttpTests(unittest.TestCase, FakeHTTPMixin):
-     """Test urlopen() opening a fake http connection."""
- 
-Index: Python-2.7.11/Lib/urllib.py
-===================================================================
---- Python-2.7.11.orig/Lib/urllib.py
-+++ Python-2.7.11/Lib/urllib.py
-@@ -1382,11 +1382,21 @@ def getproxies_environment():
+     def test_proxy_bypass_environment_host_match(self):
+         bypass = urllib.proxy_bypass_environment
+         self.env.set('NO_PROXY',
+diff --git a/Lib/urllib.py b/Lib/urllib.py
+index 139fab9..c3ba2c9 100644
+--- a/Lib/urllib.py
++++ b/Lib/urllib.py
+@@ -1380,12 +1380,21 @@ def getproxies_environment():
+     If you need a different way, you can pass a proxies dictionary to the
      [Fancy]URLopener constructor.
- 
      """
 +    # Get all variables
      proxies = {}
@@ -128,7 +121,7 @@ Index: Python-2.7.11/Lib/urllib.py
          name = name.lower()
          if value and name[-6:] == '_proxy':
              proxies[name[:-6]] = value
-+
+ 
 +    # CVE-2016-1000110 - If we are running as CGI script, forget HTTP_PROXY
 +    # (non-all-lowercase) as it may be set from the web server by a "Proxy:"
 +    # header from the client
@@ -137,21 +130,36 @@ Index: Python-2.7.11/Lib/urllib.py
 +        proxies.pop('http', None)
 +
 +    # Get lowercase variables
-     return proxies
- 
- def proxy_bypass_environment(host):
-Index: Python-2.7.11/Misc/NEWS
-===================================================================
---- Python-2.7.11.orig/Misc/NEWS
-+++ Python-2.7.11/Misc/NEWS
-@@ -10,6 +10,10 @@ What's New in Python 2.7.11?
- Library
- -------
+     for name, value in os.environ.items():
+         if name[-6:] == '_proxy':
+             name = name.lower()
+diff --git a/Misc/ACKS b/Misc/ACKS
+index ee3a465..9c374b7 100644
+--- a/Misc/ACKS
++++ b/Misc/ACKS
+@@ -1121,6 +1121,7 @@ Burton Radons
+ Jeff Ramnani
+ Varpu Rantala
+ Brodie Rao
++Rémi Rampin
+ Senko Rasic
+ Antti Rasinen
+ Nikolaus Rath
+diff --git a/Misc/NEWS b/Misc/NEWS
+index 4ab3a70..cc2f65b 100644
+--- a/Misc/NEWS
++++ b/Misc/NEWS
+@@ -187,6 +187,10 @@ Library
+ - Issue #26644: Raise ValueError rather than SystemError when a negative
+   length is passed to SSLSocket.recv() or read().
  
 +- Issue #27568: Prevent HTTPoxy attack (CVE-2016-1000110). Ignore the
 +  HTTP_PROXY variable when REQUEST_METHOD environment is set, which indicates
 +  that the script is in CGI mode.
 +
- - Issue #25624: ZipFile now always writes a ZIP_STORED header for directory
-   entries.  Patch by Dingyuan Wang.
+ - Issue #23804: Fix SSL recv(0) and read(0) methods to return zero bytes
+   instead of up to 1024.
  
+-- 
+2.8.1
+