Upgrade package to 3.1.3

backport-CVE-2024-22195.patch

@@ -1,85 +0,0 @@
-From 7dd3680e6eea0d77fde024763657aa4d884ddb23 Mon Sep 17 00:00:00 2001
-From: Calum Hutton <calum.hutton@snyk.io>
-Date: Thu, 26 Oct 2023 12:08:53 +0100
-Subject: [PATCH] xmlattr filter disallows keys with spaces
-
-Reference:https://github.com/pallets/jinja/commit/7dd3680e6eea0d77fde024763657aa4d884ddb23
-Conflict:remove CHANGES.rst
-
----
- Jinja2-3.1.2/src/jinja2/filters.py | 28 +++++++++++++++++++++-------
- Jinja2-3.1.2/tests/test_filters.py |  6 ++++++
- 2 files changed, 27 insertions(+), 7 deletions(-)
-
-diff --git a/Jinja2-3.1.2/src/jinja2/filters.py b/Jinja2-3.1.2/src/jinja2/filters.py
-index ed07c4c..c7ecc9b 100644
---- a/Jinja2-3.1.2/src/jinja2/filters.py
-+++ b/Jinja2-3.1.2/src/jinja2/filters.py
-@@ -248,13 +248,17 @@ def do_items(value: t.Union[t.Mapping[K, V], Undefined]) -> t.Iterator[t.Tuple[K
-     yield from value.items()
- 
- 
-+_space_re = re.compile(r"\s", flags=re.ASCII)
-+
-+
- @pass_eval_context
- def do_xmlattr(
-     eval_ctx: "EvalContext", d: t.Mapping[str, t.Any], autospace: bool = True
- ) -> str:
-     """Create an SGML/XML attribute string based on the items in a dict.
--    All values that are neither `none` nor `undefined` are automatically
--    escaped:
-+
-+    If any key contains a space, this fails with a ``ValueError``. Values that
-+    are neither ``none`` nor ``undefined`` are automatically escaped.
- 
-     .. sourcecode:: html+jinja
- 
-@@ -273,12 +277,22 @@ def do_xmlattr(
- 
-     As you can see it automatically prepends a space in front of the item
-     if the filter returned something unless the second parameter is false.
-+
-+    .. versionchanged:: 3.1.3
-+        Keys with spaces are not allowed.
-     """
--    rv = " ".join(
--        f'{escape(key)}="{escape(value)}"'
--        for key, value in d.items()
--        if value is not None and not isinstance(value, Undefined)
--    )
-+    items = []
-+
-+    for key, value in d.items():
-+        if value is None or isinstance(value, Undefined):
-+            continue
-+
-+        if _space_re.search(key) is not None:
-+            raise ValueError(f"Spaces are not allowed in attributes: '{key}'")
-+
-+        items.append(f'{escape(key)}="{escape(value)}"')
-+
-+    rv = " ".join(items)
- 
-     if autospace and rv:
-         rv = " " + rv
-diff --git a/Jinja2-3.1.2/tests/test_filters.py b/Jinja2-3.1.2/tests/test_filters.py
-index 73f0f0b..a184649 100644
---- a/Jinja2-3.1.2/tests/test_filters.py
-+++ b/Jinja2-3.1.2/tests/test_filters.py
-@@ -474,6 +474,12 @@ class TestFilter:
-         assert 'bar="23"' in out
-         assert 'blub:blub="&lt;?&gt;"' in out
- 
-+    def test_xmlattr_key_with_spaces(self, env):
-+        with pytest.raises(ValueError, match="Spaces are not allowed"):
-+            env.from_string(
-+                "{{ {'src=1 onerror=alert(1)': 'my_class'}|xmlattr }}"
-+            ).render()
-+
-     def test_sort1(self, env):
-         tmpl = env.from_string("{{ [2, 3, 1]|sort }}|{{ [2, 3, 1]|sort(true) }}")
-         assert tmpl.render() == "[1, 2, 3]|[3, 2, 1]"
--- 
-2.33.0
-

backport-update-dependencies.patch

@@ -1,41 +0,0 @@
-From 3fadee01b712580d811bdd2cb06cd8a1b5ee0821 Mon Sep 17 00:00:00 2001
-From: David Lord <davidism@gmail.com>
-Date: Thu, 29 Dec 2022 10:39:00 -0800
-Subject: [PATCH] update dependencies
-
----
- Jinja2-3.1.2/tests/test_loader.py | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/Jinja2-3.1.2/tests/test_loader.py b/Jinja2-3.1.2/tests/test_loader.py
-index 04c921d..77d686e 100644
---- a/Jinja2-3.1.2/tests/test_loader.py
-+++ b/Jinja2-3.1.2/tests/test_loader.py
-@@ -183,6 +183,7 @@ class TestFileSystemLoader:
- 
- class TestModuleLoader:
-     archive = None
-+    mod_env = None
- 
-     def compile_down(self, prefix_loader, zip="deflated"):
-         log = []
-@@ -196,13 +197,14 @@ class TestModuleLoader:
-         self.mod_env = Environment(loader=loaders.ModuleLoader(self.archive))
-         return "".join(log)
- 
--    def teardown(self):
--        if hasattr(self, "mod_env"):
-+    def teardown_method(self):
-+        if self.archive is not None:
-             if os.path.isfile(self.archive):
-                 os.remove(self.archive)
-             else:
-                 shutil.rmtree(self.archive)
-             self.archive = None
-+            self.mod_env = None
- 
-     def test_log(self, prefix_loader):
-         log = self.compile_down(prefix_loader)
--- 
-2.33.0
-

python-jinja2.spec

@@ -1,16 +1,13 @@
 %global _name Jinja2
 
 Name:           python-jinja2
-Version:        3.1.2
+Version:        3.1.3
-Release:        3
+Release:        1
 Summary:        A full-featured template engine for Python
 License:        BSD-3-Clause
 URL:            http://jinja.pocoo.org/
 Source0:        https://files.pythonhosted.org/packages/source/J/Jinja2/Jinja2-%{version}.tar.gz
 
-Patch1:      	backport-update-dependencies.patch
-Patch2:      	backport-CVE-2024-22195.patch
-
 BuildArch:      noarch
 
 %description
@@ -65,6 +62,9 @@ popd
 %doc Jinja2-%{version}/examples
 
 %changelog
+* Thu Jan 25 2024 shixuantong <shixuantong1@huawei.com> - 3.1.3-1
+- Upgrade package to 3.1.3
+
 * Thu Jan 18 2024 weihaohao <weihaohao2@huawei.com> - 3.1.2-3
 - Type:CVE
 - CVE:CVE-2024-22195