# HG changeset patch # User Christopher Rogers # Date 1303141173 0 # Node ID b5dedd192e8aca8521929e7030246eee5a1eda6c # Parent 3946902dd99c6aefdfc55323165102c57f20cfa3 Up: py3k to 3.2. Added CVE-2011-1521 security fix. Also added pyconfig.h to py3k so python3 works. Nothing depends on this package yet so updating it will not cause any problems. diff -r 3946902dd99c -r b5dedd192e8a py3k-dev/receipt --- a/py3k-dev/receipt Sun Apr 17 20:36:34 2011 +0000 +++ b/py3k-dev/receipt Mon Apr 18 15:39:33 2011 +0000 @@ -1,10 +1,11 @@ # SliTaz package receipt. PACKAGE="py3k-dev" -VERSION="3.1.3" +VERSION="3.2" CATEGORY="development" SHORT_DESC="The Python programming language devel files." MAINTAINER="pankso@slitaz.org" +DEPENDS="py3k" WANTED="py3k" SOURCE="Python" WEB_SITE="http://www.python.org/" @@ -16,5 +17,8 @@ cp -a $_pkg/usr/include $fs/usr cp -a $_pkg/usr/bin/*-config $fs/usr/bin chmod 755 $fs/usr/bin/*-config + # in py3k package now + python_version=${VERSION:0:3} + rm $fs/usr/include/python${python_version}m/pyconfig.h } diff -r 3946902dd99c -r b5dedd192e8a py3k/receipt --- a/py3k/receipt Sun Apr 17 20:36:34 2011 +0000 +++ b/py3k/receipt Mon Apr 18 15:39:33 2011 +0000 @@ -1,23 +1,22 @@ # SliTaz package receipt. PACKAGE="py3k" -VERSION="3.1.3" +VERSION="3.2" CATEGORY="development" SHORT_DESC="The Python 3000 programming language." MAINTAINER="pascal.bellard@slitaz.org" SOURCE="Python" -DEPENDS="openssl ncurses bzlib readline sqlite zlib xorg-libXss ncursesw gdbm \ +DEPENDS="openssl bzlib readline sqlite zlib xorg-libXss ncursesw gdbm \ tk xorg-libXext" -BUILD_DEPENDS="readline-dev openssl openssl-dev ncurses ncurses-dev - gdbm-dev" TARBALL="$SOURCE-$VERSION.tar.bz2" -WEB_SITE="http://www.python.org/download/releases/3.0/" +WEB_SITE="http://www.python.org/download/releases/3.2/" WGET_URL="http://www.python.org/ftp/python/$VERSION/$TARBALL" # Rules to configure and make the package. compile_rules() { cd $src + patch -Np1 -i $stuff/CVE-2011-1521.patch ./configure --enable-shared --with-ncurses \ --prefix=/usr --infodir=/usr/share/info \ --mandir=/usr/share/man $CONFIGURE_ARGS && @@ -28,9 +27,13 @@ # Rules to gen a SliTaz package suitable for Tazpkg. genpkg_rules() { - mkdir -p $fs/usr + python_version=${VERSION:0:3} + mkdir -p $fs/usr/include/python${python_version}m cp -a $_pkg/usr/bin $fs/usr cp -a $_pkg/usr/lib $fs/usr + # needed for python3 to work + cp -a $_pkg/usr/include/python${python_version}m/pyconfig.h \ + $fs/usr/include/python${python_version}m rm -f $fs/usr/bin/*-config } diff -r 3946902dd99c -r b5dedd192e8a py3k/stuff/CVE-2011-1521.patch --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/py3k/stuff/CVE-2011-1521.patch Mon Apr 18 15:39:33 2011 +0000 @@ -0,0 +1,134 @@ +diff -Naur Python-3.2.ori/Doc/library/urllib.request.rst Python-3.2/Doc/library/urllib.request.rst +--- Python-3.2.ori/Doc/library/urllib.request.rst 2011-02-11 03:25:47.000000000 -0800 ++++ Python-3.2/Doc/library/urllib.request.rst 2011-04-15 03:49:02.778745379 -0700 +@@ -650,6 +650,10 @@ + is the case, :exc:`HTTPError` is raised. See :rfc:`2616` for details of the + precise meanings of the various redirection codes. + ++ An :class:`HTTPError` exception raised as a security consideration if the ++ HTTPRedirectHandler is presented with a redirected url which is not an HTTP, ++ HTTPS or FTP url. ++ + + .. method:: HTTPRedirectHandler.redirect_request(req, fp, code, msg, hdrs, newurl) + +diff -Naur Python-3.2.ori/Lib/test/test_urllib2.py Python-3.2/Lib/test/test_urllib2.py +--- Python-3.2.ori/Lib/test/test_urllib2.py 2011-02-11 03:25:47.000000000 -0800 ++++ Python-3.2/Lib/test/test_urllib2.py 2011-04-15 03:50:29.705417290 -0700 +@@ -8,6 +8,7 @@ + + import urllib.request + from urllib.request import Request, OpenerDirector ++import urllib.error + + # XXX + # Request +@@ -1029,6 +1030,29 @@ + self.assertEqual(count, + urllib.request.HTTPRedirectHandler.max_redirections) + ++ ++ def test_invalid_redirect(self): ++ from_url = "http://example.com/a.html" ++ valid_schemes = ['http','https','ftp'] ++ invalid_schemes = ['file','imap','ldap'] ++ schemeless_url = "example.com/b.html" ++ h = urllib.request.HTTPRedirectHandler() ++ o = h.parent = MockOpener() ++ req = Request(from_url) ++ req.timeout = socket._GLOBAL_DEFAULT_TIMEOUT ++ ++ for scheme in invalid_schemes: ++ invalid_url = scheme + '://' + schemeless_url ++ self.assertRaises(urllib.error.HTTPError, h.http_error_302, ++ req, MockFile(), 302, "Security Loophole", ++ MockHeaders({"location": invalid_url})) ++ ++ for scheme in valid_schemes: ++ valid_url = scheme + '://' + schemeless_url ++ h.http_error_302(req, MockFile(), 302, "That's fine", ++ MockHeaders({"location": valid_url})) ++ self.assertEqual(o.req.get_full_url(), valid_url) ++ + def test_cookie_redirect(self): + # cookies shouldn't leak into redirected requests + from http.cookiejar import CookieJar +diff -Naur Python-3.2.ori/Lib/test/test_urllib.py Python-3.2/Lib/test/test_urllib.py +--- Python-3.2.ori/Lib/test/test_urllib.py 2010-12-17 09:35:56.000000000 -0800 ++++ Python-3.2/Lib/test/test_urllib.py 2011-04-15 03:49:02.778745379 -0700 +@@ -2,6 +2,7 @@ + + import urllib.parse + import urllib.request ++import urllib.error + import http.client + import email.message + import io +@@ -198,6 +199,21 @@ + finally: + self.unfakehttp() + ++ def test_invalid_redirect(self): ++ # urlopen() should raise IOError for many error codes. ++ self.fakehttp(b'''HTTP/1.1 302 Found ++Date: Wed, 02 Jan 2008 03:03:54 GMT ++Server: Apache/1.3.33 (Debian GNU/Linux) mod_ssl/2.8.22 OpenSSL/0.9.7e ++Location: file://guidocomputer.athome.com:/python/license ++Connection: close ++Content-Type: text/html; charset=iso-8859-1 ++''') ++ try: ++ self.assertRaises(urllib.error.HTTPError, urlopen, ++ "http://python.org/") ++ finally: ++ self.unfakehttp() ++ + def test_empty_socket(self): + # urlopen() raises IOError if the underlying socket does not send any + # data. (#1680230) +diff -Naur Python-3.2.ori/Lib/urllib/request.py Python-3.2/Lib/urllib/request.py +--- Python-3.2.ori/Lib/urllib/request.py 2011-02-11 03:25:47.000000000 -0800 ++++ Python-3.2/Lib/urllib/request.py 2011-04-15 03:49:02.778745379 -0700 +@@ -545,6 +545,17 @@ + + # fix a possible malformed URL + urlparts = urlparse(newurl) ++ ++ # For security reasons we don't allow redirection to anything other ++ # than http, https or ftp. ++ ++ if not urlparts.scheme in ('http', 'https', 'ftp'): ++ raise HTTPError(newurl, code, ++ msg + ++ " - Redirection to url '%s' is not allowed" % ++ newurl, ++ headers, fp) ++ + if not urlparts.path: + urlparts = list(urlparts) + urlparts[2] = "/" +@@ -1897,8 +1908,24 @@ + return + void = fp.read() + fp.close() ++ + # In case the server sent a relative URL, join with original: + newurl = urljoin(self.type + ":" + url, newurl) ++ ++ urlparts = urlparse(newurl) ++ ++ # For security reasons, we don't allow redirection to anything other ++ # than http, https and ftp. ++ ++ # We are using newer HTTPError with older redirect_internal method ++ # This older method will get deprecated in 3.3 ++ ++ if not urlparts.scheme in ('http', 'https', 'ftp'): ++ raise HTTPError(newurl, errcode, ++ errmsg + ++ " Redirection to url '%s' is not allowed." % newurl, ++ headers, fp) ++ + return self.open(newurl) + + def http_error_301(self, url, fp, errcode, errmsg, headers, data=None):