summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/python/python3-pygments/CVE-2022-40896-0002.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-devtools/python/python3-pygments/CVE-2022-40896-0002.patch')
-rw-r--r--meta/recipes-devtools/python/python3-pygments/CVE-2022-40896-0002.patch301
1 files changed, 301 insertions, 0 deletions
diff --git a/meta/recipes-devtools/python/python3-pygments/CVE-2022-40896-0002.patch b/meta/recipes-devtools/python/python3-pygments/CVE-2022-40896-0002.patch
new file mode 100644
index 0000000000..61ebe5dad5
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-pygments/CVE-2022-40896-0002.patch
@@ -0,0 +1,301 @@
1From 45ff8eabe0363f829c397372aefc3b23aeb135b3 Mon Sep 17 00:00:00 2001
2From: Narpat Mali <narpat.mali@windriver.com>
3Date: Tue, 29 Aug 2023 10:45:34 +0000
4Subject: [PATCH] Improve Java properties lexer (#2404)
5
6Use special lexer rules for escapes; fixes catastrophic backtracking,
7and highlights them too.
8
9Fixes #2356
10
11CVE: CVE-2022-40896
12
13Upstream-Status: Backport [https://github.com/pygments/pygments/commit/fdf182a7af85b1deeeb637ca970d31935e7c9d52]
14
15Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
16---
17 pygments/lexers/configs.py | 50 +++++---
18 tests/examplefiles/properties/java.properties | 11 ++
19 .../properties/java.properties.output | 110 +++++++++++++++---
20 .../test_escaped_space_in_value.txt | 4 +-
21 .../properties/test_just_key_with_space.txt | 4 +-
22 5 files changed, 143 insertions(+), 36 deletions(-)
23
24diff --git a/pygments/lexers/configs.py b/pygments/lexers/configs.py
25index e04c722..b28b56a 100644
26--- a/pygments/lexers/configs.py
27+++ b/pygments/lexers/configs.py
28@@ -129,26 +129,42 @@ class PropertiesLexer(RegexLexer):
29
30 tokens = {
31 'root': [
32- (r'\s+', Whitespace),
33+ # comments
34 (r'[!#].*|/{2}.*', Comment.Single),
35- # search for first separator
36- (r'([^\\\n]|\\.)*?(?=[ \f\t=:])', Name.Attribute, "separator"),
37- # empty key
38- (r'.+?$', Name.Attribute),
39+ # ending a comment or whitespace-only line
40+ (r'\n', Whitespace),
41+ # eat whitespace at the beginning of a line
42+ (r'^[^\S\n]+', Whitespace),
43+ # start lexing a key
44+ default('key'),
45 ],
46- 'separator': [
47- # search for line continuation escape
48- (r'([ \f\t]*)([=:]*)([ \f\t]*)(.*(?<!\\)(?:\\{2})*)(\\)(?!\\)$',
49- bygroups(Whitespace, Operator, Whitespace, String, Text), "value", "#pop"),
50- (r'([ \f\t]*)([=:]*)([ \f\t]*)(.*)',
51- bygroups(Whitespace, Operator, Whitespace, String), "#pop"),
52+ 'key': [
53+ # non-escaped key characters
54+ (r'[^\\:=\s]+', Name.Attribute),
55+ # escapes
56+ include('escapes'),
57+ # separator is the first non-escaped whitespace or colon or '=' on the line;
58+ # if it's whitespace, = and : are gobbled after it
59+ (r'([^\S\n]*)([:=])([^\S\n]*)',
60+ bygroups(Whitespace, Operator, Whitespace),
61+ ('#pop', 'value')),
62+ (r'[^\S\n]+', Whitespace, ('#pop', 'value')),
63+ # maybe we got no value after all
64+ (r'\n', Whitespace, '#pop'),
65 ],
66- 'value': [ # line continuation
67- (r'\s+', Whitespace),
68- # search for line continuation escape
69- (r'(\s*)(.*(?<!\\)(?:\\{2})*)(\\)(?!\\)([ \t]*)',
70- bygroups(Whitespace, String, Text, Whitespace)),
71- (r'.*$', String, "#pop"),
72+ 'value': [
73+ # non-escaped value characters
74+ (r'[^\\\n]+', String),
75+ # escapes
76+ include('escapes'),
77+ # end the value on an unescaped newline
78+ (r'\n', Whitespace, '#pop'),
79+ ],
80+ 'escapes': [
81+ # line continuations; these gobble whitespace at the beginning of the next line
82+ (r'(\\\n)([^\S\n]*)', bygroups(String.Escape, Whitespace)),
83+ # other escapes
84+ (r'\\(.|\n)', String.Escape),
85 ],
86 }
87
88diff --git a/tests/examplefiles/properties/java.properties b/tests/examplefiles/properties/java.properties
89index d5b594e..7fe915c 100644
90--- a/tests/examplefiles/properties/java.properties
91+++ b/tests/examplefiles/properties/java.properties
92@@ -14,6 +14,8 @@ key = \
93 and value2\\
94 key\ 2 = value
95 key\\ 3 = value3
96+key \
97+ = value
98
99 ! empty keys and edge cases
100 key1 =
101@@ -22,3 +24,12 @@ key3 the value3
102 key4 the:value4
103 key5 the=value5
104 key6=the value6
105+
106+! escapes in keys
107+key\ with\ spaces = value
108+key\nwith\nnewlines = value\nwith\nnewlines
109+
110+ ! indented comment
111+
112+! line continuations do \
113+not = work for comments
114diff --git a/tests/examplefiles/properties/java.properties.output b/tests/examplefiles/properties/java.properties.output
115index 0c1fdee..4822575 100644
116--- a/tests/examplefiles/properties/java.properties.output
117+++ b/tests/examplefiles/properties/java.properties.output
118@@ -2,13 +2,17 @@
119 '\n' Text.Whitespace
120
121 '# mixing spaces' Comment.Single
122-'\n\t' Text.Whitespace
123+'\n' Text.Whitespace
124+
125+'\t' Text.Whitespace
126 'Truth' Name.Attribute
127 ' ' Text.Whitespace
128 '=' Operator
129 ' ' Text.Whitespace
130 'Beauty' Literal.String
131-'\n ' Text.Whitespace
132+'\n' Text.Whitespace
133+
134+' ' Text.Whitespace
135 'Truth' Name.Attribute
136 ':' Operator
137 'Beauty' Literal.String
138@@ -23,18 +27,24 @@
139 ' ' Text.Whitespace
140 ':' Operator
141 'Beauty' Literal.String
142-'\n \n' Text.Whitespace
143+'\n' Text.Whitespace
144+
145+'\n' Text.Whitespace
146
147 '! line continuations and escapes' Comment.Single
148-'\n ' Text.Whitespace
149+'\n' Text.Whitespace
150+
151+' ' Text.Whitespace
152 'fruits' Name.Attribute
153 ' ' Text.Whitespace
154 'apple, banana, pear, ' Literal.String
155-'\\' Text
156-'\n ' Text.Whitespace
157+'\\\n' Literal.String.Escape
158+
159+' ' Text.Whitespace
160 'cantaloupe, watermelon, ' Literal.String
161-'\\' Text
162-'\n ' Text.Whitespace
163+'\\\n' Literal.String.Escape
164+
165+' ' Text.Whitespace
166 'kiwi, mango' Literal.String
167 '\n' Text.Whitespace
168
169@@ -42,25 +52,42 @@
170 ' ' Text.Whitespace
171 '=' Operator
172 ' ' Text.Whitespace
173-'\\' Text
174-'\n ' Text.Whitespace
175-'value1 \\\\' Literal.String
176-'\\' Text
177-'\n ' Text.Whitespace
178-'and value2\\\\' Literal.String
179+'\\\n' Literal.String.Escape
180+
181+' ' Text.Whitespace
182+'value1 ' Literal.String
183+'\\\\' Literal.String.Escape
184+'\\\n' Literal.String.Escape
185+
186+' ' Text.Whitespace
187+'and value2' Literal.String
188+'\\\\' Literal.String.Escape
189 '\n' Text.Whitespace
190
191-'key\\ 2' Name.Attribute
192+'key' Name.Attribute
193+'\\ ' Literal.String.Escape
194+'2' Name.Attribute
195 ' ' Text.Whitespace
196 '=' Operator
197 ' ' Text.Whitespace
198 'value' Literal.String
199 '\n' Text.Whitespace
200
201-'key\\\\' Name.Attribute
202+'key' Name.Attribute
203+'\\\\' Literal.String.Escape
204 ' ' Text.Whitespace
205 '3 = value3' Literal.String
206-'\n\n' Text.Whitespace
207+'\n' Text.Whitespace
208+
209+'key' Name.Attribute
210+' ' Text.Whitespace
211+'\\\n' Literal.String.Escape
212+
213+' ' Text.Whitespace
214+'= value' Literal.String
215+'\n' Text.Whitespace
216+
217+'\n' Text.Whitespace
218
219 '! empty keys and edge cases' Comment.Single
220 '\n' Text.Whitespace
221@@ -92,3 +119,52 @@
222 '=' Operator
223 'the value6' Literal.String
224 '\n' Text.Whitespace
225+
226+'\n' Text.Whitespace
227+
228+'! escapes in keys' Comment.Single
229+'\n' Text.Whitespace
230+
231+'key' Name.Attribute
232+'\\ ' Literal.String.Escape
233+'with' Name.Attribute
234+'\\ ' Literal.String.Escape
235+'spaces' Name.Attribute
236+' ' Text.Whitespace
237+'=' Operator
238+' ' Text.Whitespace
239+'value' Literal.String
240+'\n' Text.Whitespace
241+
242+'key' Name.Attribute
243+'\\n' Literal.String.Escape
244+'with' Name.Attribute
245+'\\n' Literal.String.Escape
246+'newlines' Name.Attribute
247+' ' Text.Whitespace
248+'=' Operator
249+' ' Text.Whitespace
250+'value' Literal.String
251+'\\n' Literal.String.Escape
252+'with' Literal.String
253+'\\n' Literal.String.Escape
254+'newlines' Literal.String
255+'\n' Text.Whitespace
256+
257+'\n' Text.Whitespace
258+
259+' ' Text.Whitespace
260+'! indented comment' Comment.Single
261+'\n' Text.Whitespace
262+
263+'\n' Text.Whitespace
264+
265+'! line continuations do \\' Comment.Single
266+'\n' Text.Whitespace
267+
268+'not' Name.Attribute
269+' ' Text.Whitespace
270+'=' Operator
271+' ' Text.Whitespace
272+'work for comments' Literal.String
273+'\n' Text.Whitespace
274diff --git a/tests/snippets/properties/test_escaped_space_in_value.txt b/tests/snippets/properties/test_escaped_space_in_value.txt
275index f76507f..44772d8 100644
276--- a/tests/snippets/properties/test_escaped_space_in_value.txt
277+++ b/tests/snippets/properties/test_escaped_space_in_value.txt
278@@ -6,5 +6,7 @@ key = doubleword\ value
279 ' ' Text.Whitespace
280 '=' Operator
281 ' ' Text.Whitespace
282-'doubleword\\ value' Literal.String
283+'doubleword' Literal.String
284+'\\ ' Literal.String.Escape
285+'value' Literal.String
286 '\n' Text.Whitespace
287diff --git a/tests/snippets/properties/test_just_key_with_space.txt b/tests/snippets/properties/test_just_key_with_space.txt
288index 660c37c..833fe40 100644
289--- a/tests/snippets/properties/test_just_key_with_space.txt
290+++ b/tests/snippets/properties/test_just_key_with_space.txt
291@@ -2,5 +2,7 @@
292 just\ key
293
294 ---tokens---
295-'just\\ key' Name.Attribute
296+'just' Name.Attribute
297+'\\ ' Literal.String.Escape
298+'key' Name.Attribute
299 '\n' Text.Whitespace
300--
3012.40.0
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-25 11:57:46 +0000