update version to 66.0.0
This commit is contained in:
parent
ec9b9b6697
commit
cd3328cec3
@ -1,43 +0,0 @@
|
||||
From 43a9c9bfa6aa626ec2a22540bea28d2ca77964be Mon Sep 17 00:00:00 2001
|
||||
From: "Jason R. Coombs" <jaraco@jaraco.com>
|
||||
Date: Fri, 4 Nov 2022 13:47:53 -0400
|
||||
Subject: [PATCH] Limit the amount of whitespace to search/backtrack.Fixes
|
||||
#3659.
|
||||
|
||||
---
|
||||
setuptools/package_index.py | 2 +-
|
||||
setuptools/tests/test_packageindex.py | 8 ++++++++
|
||||
2 files changed, 9 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/setuptools/package_index.py b/setuptools/package_index.py
|
||||
index 270e7f3..e93fcc6 100644
|
||||
--- a/setuptools/package_index.py
|
||||
+++ b/setuptools/package_index.py
|
||||
@@ -197,7 +197,7 @@ def unique_values(func):
|
||||
return wrapper
|
||||
|
||||
|
||||
-REL = re.compile(r"""<([^>]*\srel\s*=\s*['"]?([^'">]+)[^>]*)>""", re.I)
|
||||
+REL = re.compile(r"""<([^>]*\srel\s{0,10}=\s{0,10}['"]?([^'" >]+)[^>]*)>""", re.I)
|
||||
# this line is here to fix emacs' cruddy broken syntax highlighting
|
||||
|
||||
|
||||
diff --git a/setuptools/tests/test_packageindex.py b/setuptools/tests/test_packageindex.py
|
||||
index 8e9435e..fc544c0 100644
|
||||
--- a/setuptools/tests/test_packageindex.py
|
||||
+++ b/setuptools/tests/test_packageindex.py
|
||||
@@ -308,3 +308,11 @@ class TestPyPIConfig:
|
||||
cred = cfg.creds_by_repository['https://pypi.org']
|
||||
assert cred.username == 'jaraco'
|
||||
assert cred.password == 'pity%'
|
||||
+
|
||||
+
|
||||
+@pytest.mark.timeout(1)
|
||||
+def test_REL_DoS():
|
||||
+ """
|
||||
+ REL should not hang on a contrived attack string.
|
||||
+ """
|
||||
+ setuptools.package_index.REL.search('< rel=' + ' ' * 2**12)
|
||||
--
|
||||
2.27.0
|
||||
|
||||
@ -7,16 +7,14 @@
|
||||
%global python_whlname setuptools-%{version}-py3-none-any.whl
|
||||
|
||||
Name: python-setuptools
|
||||
Version: 60.9.3
|
||||
Release: 2
|
||||
Version: 66.0.0
|
||||
Release: 1
|
||||
Summary: Easily build and distribute Python packages
|
||||
|
||||
License: MIT and (BSD or ASL 2.0)
|
||||
URL: https://pypi.python.org/pypi/setuptools
|
||||
Source0: %{pypi_source setuptools %{version}}
|
||||
|
||||
Patch6000: backport-CVE-2022-40897.patch
|
||||
|
||||
Patch9000: bugfix-eliminate-random-order-in-metadata.patch
|
||||
|
||||
BuildArch: noarch
|
||||
@ -113,6 +111,9 @@ PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=$(pwd) py.test-%{python3_version} --ignore=
|
||||
|
||||
|
||||
%changelog
|
||||
* Sat Jan 28 2023 zhuofeng<zhuofeng2@huawei.com> - 66.0.0-1
|
||||
- update version to 66.0.0
|
||||
|
||||
* Wed Jan 04 2023 zhuofeng <zhuofeng2@huawei.com> - 60.9.3-2
|
||||
- Type:CVE
|
||||
- CVE:CVE-2022-40897
|
||||
|
||||
Binary file not shown.
BIN
setuptools-66.0.0.tar.gz
Normal file
BIN
setuptools-66.0.0.tar.gz
Normal file
Binary file not shown.
Loading…
x
Reference in New Issue
Block a user