!37 update verision to 66.0.0

From: @zhuofeng6 
Reviewed-by: @gaoruoshu 
Signed-off-by: @gaoruoshu
This commit is contained in:
openeuler-ci-bot 2023-05-05 02:38:48 +00:00 committed by Gitee
commit 76fa1984b9
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
4 changed files with 5 additions and 47 deletions

View File

@ -1,43 +0,0 @@
From 43a9c9bfa6aa626ec2a22540bea28d2ca77964be Mon Sep 17 00:00:00 2001
From: "Jason R. Coombs" <jaraco@jaraco.com>
Date: Fri, 4 Nov 2022 13:47:53 -0400
Subject: [PATCH] Limit the amount of whitespace to search/backtrack.Fixes
#3659.
---
setuptools/package_index.py | 2 +-
setuptools/tests/test_packageindex.py | 8 ++++++++
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/setuptools/package_index.py b/setuptools/package_index.py
index 270e7f3..e93fcc6 100644
--- a/setuptools/package_index.py
+++ b/setuptools/package_index.py
@@ -197,7 +197,7 @@ def unique_values(func):
return wrapper
-REL = re.compile(r"""<([^>]*\srel\s*=\s*['"]?([^'">]+)[^>]*)>""", re.I)
+REL = re.compile(r"""<([^>]*\srel\s{0,10}=\s{0,10}['"]?([^'" >]+)[^>]*)>""", re.I)
# this line is here to fix emacs' cruddy broken syntax highlighting
diff --git a/setuptools/tests/test_packageindex.py b/setuptools/tests/test_packageindex.py
index 8e9435e..fc544c0 100644
--- a/setuptools/tests/test_packageindex.py
+++ b/setuptools/tests/test_packageindex.py
@@ -308,3 +308,11 @@ class TestPyPIConfig:
cred = cfg.creds_by_repository['https://pypi.org']
assert cred.username == 'jaraco'
assert cred.password == 'pity%'
+
+
+@pytest.mark.timeout(1)
+def test_REL_DoS():
+ """
+ REL should not hang on a contrived attack string.
+ """
+ setuptools.package_index.REL.search('< rel=' + ' ' * 2**12)
--
2.27.0

View File

@ -7,16 +7,14 @@
%global python_whlname setuptools-%{version}-py3-none-any.whl %global python_whlname setuptools-%{version}-py3-none-any.whl
Name: python-setuptools Name: python-setuptools
Version: 60.9.3 Version: 66.0.0
Release: 2 Release: 1
Summary: Easily build and distribute Python packages Summary: Easily build and distribute Python packages
License: MIT and (BSD or ASL 2.0) License: MIT and (BSD or ASL 2.0)
URL: https://pypi.python.org/pypi/setuptools URL: https://pypi.python.org/pypi/setuptools
Source0: %{pypi_source setuptools %{version}} Source0: %{pypi_source setuptools %{version}}
Patch6000: backport-CVE-2022-40897.patch
Patch9000: bugfix-eliminate-random-order-in-metadata.patch Patch9000: bugfix-eliminate-random-order-in-metadata.patch
BuildArch: noarch BuildArch: noarch
@ -113,6 +111,9 @@ PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=$(pwd) py.test-%{python3_version} --ignore=
%changelog %changelog
* Sat Jan 28 2023 zhuofeng<zhuofeng2@huawei.com> - 66.0.0-1
- update version to 66.0.0
* Wed Jan 04 2023 zhuofeng <zhuofeng2@huawei.com> - 60.9.3-2 * Wed Jan 04 2023 zhuofeng <zhuofeng2@huawei.com> - 60.9.3-2
- Type:CVE - Type:CVE
- CVE:CVE-2022-40897 - CVE:CVE-2022-40897

Binary file not shown.

BIN
setuptools-66.0.0.tar.gz Normal file

Binary file not shown.