[arch-commits] Commit in python/trunk (CVE-2011-1521.patch PKGBUILD)
Stéphane Gaudreault
stephane at archlinux.org
Fri Apr 15 11:51:40 UTC 2011
Date: Friday, April 15, 2011 @ 07:51:39
Author: stephane
Revision: 119805
upgpkg: python 3.2-2
urllib security vulnerability fixed (CVE-2011-1521), use check() function
Added:
python/trunk/CVE-2011-1521.patch
Modified:
python/trunk/PKGBUILD
---------------------+
CVE-2011-1521.patch | 134 ++++++++++++++++++++++++++++++++++++++++++++++++++
PKGBUILD | 21 +++++--
2 files changed, 148 insertions(+), 7 deletions(-)
Added: CVE-2011-1521.patch
===================================================================
--- CVE-2011-1521.patch (rev 0)
+++ CVE-2011-1521.patch 2011-04-15 11:51:39 UTC (rev 119805)
@@ -0,0 +1,134 @@
+diff -Naur Python-3.2.ori/Doc/library/urllib.request.rst Python-3.2/Doc/library/urllib.request.rst
+--- Python-3.2.ori/Doc/library/urllib.request.rst 2011-02-11 03:25:47.000000000 -0800
++++ Python-3.2/Doc/library/urllib.request.rst 2011-04-15 03:49:02.778745379 -0700
+@@ -650,6 +650,10 @@
+ is the case, :exc:`HTTPError` is raised. See :rfc:`2616` for details of the
+ precise meanings of the various redirection codes.
+
++ An :class:`HTTPError` exception raised as a security consideration if the
++ HTTPRedirectHandler is presented with a redirected url which is not an HTTP,
++ HTTPS or FTP url.
++
+
+ .. method:: HTTPRedirectHandler.redirect_request(req, fp, code, msg, hdrs, newurl)
+
+diff -Naur Python-3.2.ori/Lib/test/test_urllib2.py Python-3.2/Lib/test/test_urllib2.py
+--- Python-3.2.ori/Lib/test/test_urllib2.py 2011-02-11 03:25:47.000000000 -0800
++++ Python-3.2/Lib/test/test_urllib2.py 2011-04-15 03:50:29.705417290 -0700
+@@ -8,6 +8,7 @@
+
+ import urllib.request
+ from urllib.request import Request, OpenerDirector
++import urllib.error
+
+ # XXX
+ # Request
+@@ -1029,6 +1030,29 @@
+ self.assertEqual(count,
+ urllib.request.HTTPRedirectHandler.max_redirections)
+
++
++ def test_invalid_redirect(self):
++ from_url = "http://example.com/a.html"
++ valid_schemes = ['http','https','ftp']
++ invalid_schemes = ['file','imap','ldap']
++ schemeless_url = "example.com/b.html"
++ h = urllib.request.HTTPRedirectHandler()
++ o = h.parent = MockOpener()
++ req = Request(from_url)
++ req.timeout = socket._GLOBAL_DEFAULT_TIMEOUT
++
++ for scheme in invalid_schemes:
++ invalid_url = scheme + '://' + schemeless_url
++ self.assertRaises(urllib.error.HTTPError, h.http_error_302,
++ req, MockFile(), 302, "Security Loophole",
++ MockHeaders({"location": invalid_url}))
++
++ for scheme in valid_schemes:
++ valid_url = scheme + '://' + schemeless_url
++ h.http_error_302(req, MockFile(), 302, "That's fine",
++ MockHeaders({"location": valid_url}))
++ self.assertEqual(o.req.get_full_url(), valid_url)
++
+ def test_cookie_redirect(self):
+ # cookies shouldn't leak into redirected requests
+ from http.cookiejar import CookieJar
+diff -Naur Python-3.2.ori/Lib/test/test_urllib.py Python-3.2/Lib/test/test_urllib.py
+--- Python-3.2.ori/Lib/test/test_urllib.py 2010-12-17 09:35:56.000000000 -0800
++++ Python-3.2/Lib/test/test_urllib.py 2011-04-15 03:49:02.778745379 -0700
+@@ -2,6 +2,7 @@
+
+ import urllib.parse
+ import urllib.request
++import urllib.error
+ import http.client
+ import email.message
+ import io
+@@ -198,6 +199,21 @@
+ finally:
+ self.unfakehttp()
+
++ def test_invalid_redirect(self):
++ # urlopen() should raise IOError for many error codes.
++ self.fakehttp(b'''HTTP/1.1 302 Found
++Date: Wed, 02 Jan 2008 03:03:54 GMT
++Server: Apache/1.3.33 (Debian GNU/Linux) mod_ssl/2.8.22 OpenSSL/0.9.7e
++Location: file://guidocomputer.athome.com:/python/license
++Connection: close
++Content-Type: text/html; charset=iso-8859-1
++''')
++ try:
++ self.assertRaises(urllib.error.HTTPError, urlopen,
++ "http://python.org/")
++ finally:
++ self.unfakehttp()
++
+ def test_empty_socket(self):
+ # urlopen() raises IOError if the underlying socket does not send any
+ # data. (#1680230)
+diff -Naur Python-3.2.ori/Lib/urllib/request.py Python-3.2/Lib/urllib/request.py
+--- Python-3.2.ori/Lib/urllib/request.py 2011-02-11 03:25:47.000000000 -0800
++++ Python-3.2/Lib/urllib/request.py 2011-04-15 03:49:02.778745379 -0700
+@@ -545,6 +545,17 @@
+
+ # fix a possible malformed URL
+ urlparts = urlparse(newurl)
++
++ # For security reasons we don't allow redirection to anything other
++ # than http, https or ftp.
++
++ if not urlparts.scheme in ('http', 'https', 'ftp'):
++ raise HTTPError(newurl, code,
++ msg +
++ " - Redirection to url '%s' is not allowed" %
++ newurl,
++ headers, fp)
++
+ if not urlparts.path:
+ urlparts = list(urlparts)
+ urlparts[2] = "/"
+@@ -1897,8 +1908,24 @@
+ return
+ void = fp.read()
+ fp.close()
++
+ # In case the server sent a relative URL, join with original:
+ newurl = urljoin(self.type + ":" + url, newurl)
++
++ urlparts = urlparse(newurl)
++
++ # For security reasons, we don't allow redirection to anything other
++ # than http, https and ftp.
++
++ # We are using newer HTTPError with older redirect_internal method
++ # This older method will get deprecated in 3.3
++
++ if not urlparts.scheme in ('http', 'https', 'ftp'):
++ raise HTTPError(newurl, errcode,
++ errmsg +
++ " Redirection to url '%s' is not allowed." % newurl,
++ headers, fp)
++
+ return self.open(newurl)
+
+ def http_error_301(self, url, fp, errcode, errmsg, headers, data=None):
Modified: PKGBUILD
===================================================================
--- PKGBUILD 2011-04-15 11:37:06 UTC (rev 119804)
+++ PKGBUILD 2011-04-15 11:51:39 UTC (rev 119805)
@@ -5,7 +5,7 @@
pkgname=python
pkgver=3.2
-pkgrel=1
+pkgrel=2
_pybasever=3.2
pkgdesc="Next generation of the python high-level scripting language"
arch=('i686' 'x86_64')
@@ -17,9 +17,10 @@
provides=('python3')
replaces=('python3')
options=('!makeflags')
-source=(http://www.python.org/ftp/python/${_pybasever}/Python-${pkgver}.tar.xz)
-sha1sums=('55a3a9d39f31563370d0c494373bb6d38e4d1a00')
-
+source=(http://www.python.org/ftp/python/${_pybasever}/Python-${pkgver}.tar.xz
+ CVE-2011-1521.patch)
+sha1sums=('55a3a9d39f31563370d0c494373bb6d38e4d1a00'
+ '561161ce5ae3a91254352c09a33e3e4434444e14')
build() {
cd "${srcdir}/Python-${pkgver}"
@@ -29,6 +30,10 @@
rm -r Modules/zlib
rm -r Modules/_ctypes/{darwin,libffi}*
+ # urllib Security Vulnerability
+ # http://blog.python.org/2011/04/urllib-security-vulnerability-fixed.html
+ patch -Np1 -i ../CVE-2011-1521.patch
+
./configure --prefix=/usr \
--enable-shared \
--with-threads \
@@ -40,10 +45,12 @@
--with-system-ffi
make
+}
- # Run the upstream test suite
-# LD_LIBRARY_PATH="${srcdir}/Python-${pkgver}":${LD_LIBRARY_PATH} \
-# "${srcdir}/Python-${pkgver}/python" -m test.regrtest -x test_distutils
+check() {
+ cd "${srcdir}/Python-${pkgver}"
+ LD_LIBRARY_PATH="${srcdir}/Python-${pkgver}":${LD_LIBRARY_PATH} \
+ "${srcdir}/Python-${pkgver}/python" -m test.regrtest -x test_distutils test_site
}
package() {
More information about the arch-commits
mailing list