# HG changeset patch # User Christopher Rogers # Date 1318423644 0 # Node ID 3ab0e975f37e7aede7f2b92a697e31c982de0fb1 # Parent f5b1d838898b91ad176bcae773118d8f667b5084 Up: python to 2.7.2. diff -r f5b1d838898b -r 3ab0e975f37e python-dev/receipt --- a/python-dev/receipt Wed Oct 12 12:42:58 2011 +0000 +++ b/python-dev/receipt Wed Oct 12 12:47:24 2011 +0000 @@ -1,7 +1,7 @@ # SliTaz package receipt. PACKAGE="python-dev" -VERSION="2.7.1" +VERSION="2.7.2" CATEGORY="development" SHORT_DESC="The Python programming language devel files." MAINTAINER="pankso@slitaz.org" diff -r f5b1d838898b -r 3ab0e975f37e python/receipt --- a/python/receipt Wed Oct 12 12:42:58 2011 +0000 +++ b/python/receipt Wed Oct 12 12:47:24 2011 +0000 @@ -1,7 +1,7 @@ # SliTaz package receipt. PACKAGE="python" -VERSION="2.7.1" +VERSION="2.7.2" CATEGORY="development" SHORT_DESC="The Python programming language." MAINTAINER="pankso@slitaz.org" @@ -17,9 +17,11 @@ compile_rules() { cd $src - # Fix urllib Security Vulnerability - # http://blog.python.org/2011/04/urllib-security-vulnerability-fixed.html - patch -Np1 -i $stuff/CVE-2011-1521.patch + # Temporary workaround for FS#22322 + # See http://bugs.python.org/issue10835 for upstream report + sed -i "/progname =/s/python/python${_pybasever}/" Python/pythonrun.c + # Enable built-in SQLite3 module to load extensions (fix FS#22122) + sed -i "/SQLITE_OMIT_LOAD_EXTENSION/d" setup.py ./configure \ --enable-shared \ --build=$HOST_SYSTEM \ diff -r f5b1d838898b -r 3ab0e975f37e python/stuff/CVE-2011-1521.patch --- a/python/stuff/CVE-2011-1521.patch Wed Oct 12 12:42:58 2011 +0000 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,98 +0,0 @@ -diff -Naur Python-2.7.1.ori/Lib/test/test_urllib2.py Python-2.7.1/Lib/test/test_urllib2.py ---- Python-2.7.1.ori/Lib/test/test_urllib2.py 2010-11-21 21:04:33.000000000 -0800 -+++ Python-2.7.1/Lib/test/test_urllib2.py 2011-04-15 05:02:13.278853672 -0700 -@@ -969,6 +969,27 @@ - self.assertEqual(count, - urllib2.HTTPRedirectHandler.max_redirections) - -+ def test_invalid_redirect(self): -+ from_url = "http://example.com/a.html" -+ valid_schemes = ['http', 'https', 'ftp'] -+ invalid_schemes = ['file', 'imap', 'ldap'] -+ schemeless_url = "example.com/b.html" -+ h = urllib2.HTTPRedirectHandler() -+ o = h.parent = MockOpener() -+ req = Request(from_url) -+ -+ for scheme in invalid_schemes: -+ invalid_url = scheme + '://' + schemeless_url -+ self.assertRaises(urllib2.HTTPError, h.http_error_302, -+ req, MockFile(), 302, "Security Loophole", -+ MockHeaders({"location": invalid_url})) -+ -+ for scheme in valid_schemes: -+ valid_url = scheme + '://' + schemeless_url -+ h.http_error_302(req, MockFile(), 302, "That's fine", -+ MockHeaders({"location": valid_url})) -+ self.assertEqual(o.req.get_full_url(), valid_url) -+ - def test_cookie_redirect(self): - # cookies shouldn't leak into redirected requests - from cookielib import CookieJar -diff -Naur Python-2.7.1.ori/Lib/test/test_urllib.py Python-2.7.1/Lib/test/test_urllib.py ---- Python-2.7.1.ori/Lib/test/test_urllib.py 2010-11-21 05:34:58.000000000 -0800 -+++ Python-2.7.1/Lib/test/test_urllib.py 2011-04-15 05:02:13.278853672 -0700 -@@ -161,6 +161,20 @@ - finally: - self.unfakehttp() - -+ def test_invalid_redirect(self): -+ # urlopen() should raise IOError for many error codes. -+ self.fakehttp("""HTTP/1.1 302 Found -+Date: Wed, 02 Jan 2008 03:03:54 GMT -+Server: Apache/1.3.33 (Debian GNU/Linux) mod_ssl/2.8.22 OpenSSL/0.9.7e -+Location: file:README -+Connection: close -+Content-Type: text/html; charset=iso-8859-1 -+""") -+ try: -+ self.assertRaises(IOError, urllib.urlopen, "http://python.org/") -+ finally: -+ self.unfakehttp() -+ - def test_empty_socket(self): - # urlopen() raises IOError if the underlying socket does not send any - # data. (#1680230) -diff -Naur Python-2.7.1.ori/Lib/urllib2.py Python-2.7.1/Lib/urllib2.py ---- Python-2.7.1.ori/Lib/urllib2.py 2010-11-20 03:24:08.000000000 -0800 -+++ Python-2.7.1/Lib/urllib2.py 2011-04-15 05:02:13.278853672 -0700 -@@ -579,6 +579,17 @@ - - newurl = urlparse.urljoin(req.get_full_url(), newurl) - -+ # For security reasons we do not allow redirects to protocols -+ # other than HTTP, HTTPS or FTP. -+ newurl_lower = newurl.lower() -+ if not (newurl_lower.startswith('http://') or -+ newurl_lower.startswith('https://') or -+ newurl_lower.startswith('ftp://')): -+ raise HTTPError(newurl, code, -+ msg + " - Redirection to url '%s' is not allowed" % -+ newurl, -+ headers, fp) -+ - # XXX Probably want to forget about the state of the current - # request, although that might interact poorly with other - # handlers that also use handler-specific request attributes -diff -Naur Python-2.7.1.ori/Lib/urllib.py Python-2.7.1/Lib/urllib.py ---- Python-2.7.1.ori/Lib/urllib.py 2010-11-21 21:04:33.000000000 -0800 -+++ Python-2.7.1/Lib/urllib.py 2011-04-15 05:02:13.278853672 -0700 -@@ -644,6 +644,18 @@ - fp.close() - # In case the server sent a relative URL, join with original: - newurl = basejoin(self.type + ":" + url, newurl) -+ -+ # For security reasons we do not allow redirects to protocols -+ # other than HTTP, HTTPS or FTP. -+ newurl_lower = newurl.lower() -+ if not (newurl_lower.startswith('http://') or -+ newurl_lower.startswith('https://') or -+ newurl_lower.startswith('ftp://')): -+ raise IOError('redirect error', errcode, -+ errmsg + " - Redirection to url '%s' is not allowed" % -+ newurl, -+ headers) -+ - return self.open(newurl) - - def http_error_301(self, url, fp, errcode, errmsg, headers, data=None):