summaryrefslogtreecommitdiffstats
path: root/meta-python/recipes-devtools/python
diff options
context:
space:
mode:
Diffstat (limited to 'meta-python/recipes-devtools/python')
-rw-r--r--meta-python/recipes-devtools/python/python-lxml/python-lxml-3.2.5-fix-CVE-2014-3146.patch91
-rw-r--r--meta-python/recipes-devtools/python/python-lxml_3.4.4.bb (renamed from meta-python/recipes-devtools/python/python-lxml_3.2.5.bb)9
2 files changed, 4 insertions, 96 deletions
diff --git a/meta-python/recipes-devtools/python/python-lxml/python-lxml-3.2.5-fix-CVE-2014-3146.patch b/meta-python/recipes-devtools/python/python-lxml/python-lxml-3.2.5-fix-CVE-2014-3146.patch
deleted file mode 100644
index 0a8e211bd3..0000000000
--- a/meta-python/recipes-devtools/python/python-lxml/python-lxml-3.2.5-fix-CVE-2014-3146.patch
+++ /dev/null
@@ -1,91 +0,0 @@
1Upstream-status:Backport
2
3--- a/src/lxml/html/clean.py
4+++ b/src/lxml/html/clean.py
5@@ -70,9 +70,10 @@ _css_import_re = re.compile(
6
7 # All kinds of schemes besides just javascript: that can cause
8 # execution:
9-_javascript_scheme_re = re.compile(
10- r'\s*(?:javascript|jscript|livescript|vbscript|data|about|mocha):', re.I)
11-_substitute_whitespace = re.compile(r'\s+').sub
12+_is_javascript_scheme = re.compile(
13+ r'(?:javascript|jscript|livescript|vbscript|data|about|mocha):',
14+ re.I).search
15+_substitute_whitespace = re.compile(r'[\s\x00-\x08\x0B\x0C\x0E-\x19]+').sub
16 # FIXME: should data: be blocked?
17
18 # FIXME: check against: http://msdn2.microsoft.com/en-us/library/ms537512.aspx
19@@ -467,7 +468,7 @@ class Cleaner(object):
20 def _remove_javascript_link(self, link):
21 # links like "j a v a s c r i p t:" might be interpreted in IE
22 new = _substitute_whitespace('', link)
23- if _javascript_scheme_re.search(new):
24+ if _is_javascript_scheme(new):
25 # FIXME: should this be None to delete?
26 return ''
27 return link
28--- a/src/lxml/html/tests/test_clean.txt
29+++ b/src/lxml/html/tests/test_clean.txt
30@@ -1,3 +1,4 @@
31+>>> import re
32 >>> from lxml.html import fromstring, tostring
33 >>> from lxml.html.clean import clean, clean_html, Cleaner
34 >>> from lxml.html import usedoctest
35@@ -17,6 +18,7 @@
36 ... <body onload="evil_function()">
37 ... <!-- I am interpreted for EVIL! -->
38 ... <a href="javascript:evil_function()">a link</a>
39+... <a href="j\x01a\x02v\x03a\x04s\x05c\x06r\x07i\x0Ep t:evil_function()">a control char link</a>
40 ... <a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgidGVzdCIpOzwvc2NyaXB0Pg==">data</a>
41 ... <a href="#" onclick="evil_function()">another link</a>
42 ... <p onclick="evil_function()">a paragraph</p>
43@@ -33,7 +35,7 @@
44 ... </body>
45 ... </html>'''
46
47->>> print(doc)
48+>>> print(re.sub('[\x00-\x07\x0E]', '', doc))
49 <html>
50 <head>
51 <script type="text/javascript" src="evil-site"></script>
52@@ -49,6 +51,7 @@
53 <body onload="evil_function()">
54 <!-- I am interpreted for EVIL! -->
55 <a href="javascript:evil_function()">a link</a>
56+ <a href="javascrip t:evil_function()">a control char link</a>
57 <a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgidGVzdCIpOzwvc2NyaXB0Pg==">data</a>
58 <a href="#" onclick="evil_function()">another link</a>
59 <p onclick="evil_function()">a paragraph</p>
60@@ -81,6 +84,7 @@
61 <body onload="evil_function()">
62 <!-- I am interpreted for EVIL! -->
63 <a href="javascript:evil_function()">a link</a>
64+ <a href="javascrip%20t:evil_function()">a control char link</a>
65 <a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgidGVzdCIpOzwvc2NyaXB0Pg==">data</a>
66 <a href="#" onclick="evil_function()">another link</a>
67 <p onclick="evil_function()">a paragraph</p>
68@@ -104,6 +108,7 @@
69 </head>
70 <body>
71 <a href="">a link</a>
72+ <a href="">a control char link</a>
73 <a href="">data</a>
74 <a href="#">another link</a>
75 <p>a paragraph</p>
76@@ -123,6 +128,7 @@
77 </head>
78 <body>
79 <a href="">a link</a>
80+ <a href="">a control char link</a>
81 <a href="">data</a>
82 <a href="#">another link</a>
83 <p>a paragraph</p>
84@@ -146,6 +152,7 @@
85 </head>
86 <body>
87 <a href="">a link</a>
88+ <a href="">a control char link</a>
89 <a href="">data</a>
90 <a href="#">another link</a>
91 <p>a paragraph</p>
diff --git a/meta-python/recipes-devtools/python/python-lxml_3.2.5.bb b/meta-python/recipes-devtools/python/python-lxml_3.4.4.bb
index 68e36771fe..2480e4df90 100644
--- a/meta-python/recipes-devtools/python/python-lxml_3.2.5.bb
+++ b/meta-python/recipes-devtools/python/python-lxml_3.4.4.bb
@@ -8,11 +8,10 @@ SRCNAME = "lxml"
8 8
9DEPENDS = "libxml2 libxslt" 9DEPENDS = "libxml2 libxslt"
10 10
11SRC_URI = "http://pypi.python.org/packages/source/l/${SRCNAME}/${SRCNAME}-${PV}.tar.gz \ 11SRC_URI = "http://pypi.python.org/packages/source/l/${SRCNAME}/${SRCNAME}-${PV}.tar.gz"
12 file://python-lxml-3.2.5-fix-CVE-2014-3146.patch "
13 12
14SRC_URI[md5sum] = "6c4fb9b1840631cff09b8229a12a9ef7" 13SRC_URI[md5sum] = "a9a65972afc173ec7a39c585f4eea69c"
15SRC_URI[sha256sum] = "2bf072808a6546d0e56bf1ad3b98a43cca828724360d7419fad135141bd31f7e" 14SRC_URI[sha256sum] = "b3d362bac471172747cda3513238f115cbd6c5f8b8e6319bf6a97a7892724099"
16 15
17S = "${WORKDIR}/${SRCNAME}-${PV}" 16S = "${WORKDIR}/${SRCNAME}-${PV}"
18 17
@@ -25,7 +24,7 @@ DISTUTILS_BUILD_ARGS += " \
25 24
26DISTUTILS_INSTALL_ARGS += " \ 25DISTUTILS_INSTALL_ARGS += " \
27 --with-xslt-config='${STAGING_BINDIR_NATIVE}/pkg-config libxslt' \ 26 --with-xslt-config='${STAGING_BINDIR_NATIVE}/pkg-config libxslt' \
28 --with-xml2-config='${STAGING_BINDIR_CROSS}/xml2-config' \ 27 --with-xml2-config='${STAGING_BINDIR_CROSS}/pkg-config libxml2' \
29" 28"
30 29
31BBCLASSEXTEND = "native nativesdk" 30BBCLASSEXTEND = "native nativesdk"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-05-22 09:40:00 +0000