diff options
Diffstat (limited to 'meta/recipes-devtools/python/python3/CVE-2020-27619.patch')
-rw-r--r-- | meta/recipes-devtools/python/python3/CVE-2020-27619.patch | 69 |
1 files changed, 69 insertions, 0 deletions
diff --git a/meta/recipes-devtools/python/python3/CVE-2020-27619.patch b/meta/recipes-devtools/python/python3/CVE-2020-27619.patch new file mode 100644 index 0000000000..b2053e7a47 --- /dev/null +++ b/meta/recipes-devtools/python/python3/CVE-2020-27619.patch | |||
@@ -0,0 +1,69 @@ | |||
1 | From b664a1df4ee71d3760ab937653b10997081b1794 Mon Sep 17 00:00:00 2001 | ||
2 | From: "Miss Skeleton (bot)" <31488909+miss-islington@users.noreply.github.com> | ||
3 | Date: Tue, 6 Oct 2020 05:37:36 -0700 | ||
4 | Subject: [PATCH] bpo-41944: No longer call eval() on content received via HTTP | ||
5 | in the CJK codec tests (GH-22566) | ||
6 | |||
7 | (cherry picked from commit 2ef5caa58febc8968e670e39e3d37cf8eef3cab8) | ||
8 | |||
9 | Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> | ||
10 | |||
11 | Upstream-Status: Backport [https://github.com/python/cpython/commit/b664a1df4ee71d3760ab937653b10997081b1794] | ||
12 | CVE: CVE-2020-27619 | ||
13 | Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> | ||
14 | |||
15 | --- | ||
16 | Lib/test/multibytecodec_support.py | 22 +++++++------------ | ||
17 | .../2020-10-05-17-43-46.bpo-41944.rf1dYb.rst | 1 + | ||
18 | 2 files changed, 9 insertions(+), 14 deletions(-) | ||
19 | create mode 100644 Misc/NEWS.d/next/Tests/2020-10-05-17-43-46.bpo-41944.rf1dYb.rst | ||
20 | |||
21 | diff --git a/Lib/test/multibytecodec_support.py b/Lib/test/multibytecodec_support.py | ||
22 | index cca8af67d6d1d..f76c0153f5ecf 100644 | ||
23 | --- a/Lib/test/multibytecodec_support.py | ||
24 | +++ b/Lib/test/multibytecodec_support.py | ||
25 | @@ -305,29 +305,23 @@ def test_mapping_file(self): | ||
26 | self._test_mapping_file_plain() | ||
27 | |||
28 | def _test_mapping_file_plain(self): | ||
29 | - unichrs = lambda s: ''.join(map(chr, map(eval, s.split('+')))) | ||
30 | + def unichrs(s): | ||
31 | + return ''.join(chr(int(x, 16)) for x in s.split('+')) | ||
32 | + | ||
33 | urt_wa = {} | ||
34 | |||
35 | with self.open_mapping_file() as f: | ||
36 | for line in f: | ||
37 | if not line: | ||
38 | break | ||
39 | - data = line.split('#')[0].strip().split() | ||
40 | + data = line.split('#')[0].split() | ||
41 | if len(data) != 2: | ||
42 | continue | ||
43 | |||
44 | - csetval = eval(data[0]) | ||
45 | - if csetval <= 0x7F: | ||
46 | - csetch = bytes([csetval & 0xff]) | ||
47 | - elif csetval >= 0x1000000: | ||
48 | - csetch = bytes([(csetval >> 24), ((csetval >> 16) & 0xff), | ||
49 | - ((csetval >> 8) & 0xff), (csetval & 0xff)]) | ||
50 | - elif csetval >= 0x10000: | ||
51 | - csetch = bytes([(csetval >> 16), ((csetval >> 8) & 0xff), | ||
52 | - (csetval & 0xff)]) | ||
53 | - elif csetval >= 0x100: | ||
54 | - csetch = bytes([(csetval >> 8), (csetval & 0xff)]) | ||
55 | - else: | ||
56 | + if data[0][:2] != '0x': | ||
57 | + self.fail(f"Invalid line: {line!r}") | ||
58 | + csetch = bytes.fromhex(data[0][2:]) | ||
59 | + if len(csetch) == 1 and 0x80 <= csetch[0]: | ||
60 | continue | ||
61 | |||
62 | unich = unichrs(data[1]) | ||
63 | diff --git a/Misc/NEWS.d/next/Tests/2020-10-05-17-43-46.bpo-41944.rf1dYb.rst b/Misc/NEWS.d/next/Tests/2020-10-05-17-43-46.bpo-41944.rf1dYb.rst | ||
64 | new file mode 100644 | ||
65 | index 0000000000000..4f9782f1c85af | ||
66 | --- /dev/null | ||
67 | +++ b/Misc/NEWS.d/next/Tests/2020-10-05-17-43-46.bpo-41944.rf1dYb.rst | ||
68 | @@ -0,0 +1 @@ | ||
69 | +Tests for CJK codecs no longer call ``eval()`` on content received via HTTP. | ||