fix some CVE and BEP problem

CVE-2019-16056.patch

@@ -0,0 +1,133 @@
+From e170d5de8a7e8561388d38007195b5edf5f1fc82 Mon Sep 17 00:00:00 2001
+From: "Miss Islington (bot)"
+ <31488909+miss-islington@users.noreply.github.com>
+Date: Fri, 9 Aug 2019 01:30:33 -0700
+Subject: [PATCH] bpo-34155: Dont parse domains containing @ (GH-13079)
+
+Before:
+
+        >>> email.message_from_string('From: a@malicious.org@important.com', policy=email.policy.default)['from'].addresses
+        (Address(display_name='', username='a', domain='malicious.org'),)
+
+        >>> parseaddr('a@malicious.org@important.com')
+        ('', 'a@malicious.org')
+
+    After:
+
+        >>> email.message_from_string('From: a@malicious.org@important.com', policy=email.policy.default)['from'].addresses
+        (Address(display_name='', username='', domain=''),)
+
+        >>> parseaddr('a@malicious.org@important.com')
+        ('', 'a@')
+
+https://bugs.python.org/issue34155
+(cherry picked from commit 8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9)
+
+Co-authored-by: jpic <jpic@users.noreply.github.com>
+Signed-off-by: hehuazhen <hehuazhen@huawei.com>
+---
+ Lib/email/_header_value_parser.py                          |  2 ++
+ Lib/email/_parseaddr.py                                    | 11 ++++++++++-
+ Lib/test/test_email/test__header_value_parser.py           | 10 ++++++++++
+ Lib/test/test_email/test_email.py                          | 14 ++++++++++++++
+ .../next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst |  1 +
+ 5 files changed, 37 insertions(+), 1 deletion(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst
+
+diff --git a/Lib/email/_header_value_parser.py b/Lib/email/_header_value_parser.py
+index fc00b4a..bbc026e 100644
+--- a/Lib/email/_header_value_parser.py
++++ b/Lib/email/_header_value_parser.py
+@@ -1582,6 +1582,8 @@ def get_domain(value):
+         token, value = get_dot_atom(value)
+     except errors.HeaderParseError:
+         token, value = get_atom(value)
++    if value and value[0] == '@':
++        raise errors.HeaderParseError('Invalid Domain')
+     if leader is not None:
+         token[:0] = [leader]
+     domain.append(token)
+diff --git a/Lib/email/_parseaddr.py b/Lib/email/_parseaddr.py
+index cdfa372..41ff6f8 100644
+--- a/Lib/email/_parseaddr.py
++++ b/Lib/email/_parseaddr.py
+@@ -379,7 +379,12 @@ class AddrlistClass:
+         aslist.append('@')
+         self.pos += 1
+         self.gotonext()
+-        return EMPTYSTRING.join(aslist) + self.getdomain()
++        domain = self.getdomain()
++        if not domain:
++            # Invalid domain, return an empty address instead of returning a
++            # local part to denote failed parsing.
++            return EMPTYSTRING
++        return EMPTYSTRING.join(aslist) + domain
+ 
+     def getdomain(self):
+         """Get the complete domain name from an address."""
+@@ -394,6 +399,10 @@ class AddrlistClass:
+             elif self.field[self.pos] == '.':
+                 self.pos += 1
+                 sdlist.append('.')
++            elif self.field[self.pos] == '@':
++                # bpo-34155: Don't parse domains with two `@` like
++                # `a@malicious.org@important.com`.
++                return EMPTYSTRING
+             elif self.field[self.pos] in self.atomends:
+                 break
+             else:
+diff --git a/Lib/test/test_email/test__header_value_parser.py b/Lib/test/test_email/test__header_value_parser.py
+index 693487b..7dc4de1 100644
+--- a/Lib/test/test_email/test__header_value_parser.py
++++ b/Lib/test/test_email/test__header_value_parser.py
+@@ -1438,6 +1438,16 @@ class TestParser(TestParserMixin, TestEmailBase):
+         self.assertEqual(addr_spec.domain, 'example.com')
+         self.assertEqual(addr_spec.addr_spec, 'star.a.star@example.com')
+ 
++    def test_get_addr_spec_multiple_domains(self):
++        with self.assertRaises(errors.HeaderParseError):
++            parser.get_addr_spec('star@a.star@example.com')
++
++        with self.assertRaises(errors.HeaderParseError):
++            parser.get_addr_spec('star@a@example.com')
++
++        with self.assertRaises(errors.HeaderParseError):
++            parser.get_addr_spec('star@172.17.0.1@example.com')
++
+     # get_obs_route
+ 
+     def test_get_obs_route_simple(self):
+diff --git a/Lib/test/test_email/test_email.py b/Lib/test/test_email/test_email.py
+index c29cc56..aa77588 100644
+--- a/Lib/test/test_email/test_email.py
++++ b/Lib/test/test_email/test_email.py
+@@ -3041,6 +3041,20 @@ class TestMiscellaneous(TestEmailBase):
+         self.assertEqual(utils.parseaddr('<>'), ('', ''))
+         self.assertEqual(utils.formataddr(utils.parseaddr('<>')), '')
+ 
++    def test_parseaddr_multiple_domains(self):
++        self.assertEqual(
++            utils.parseaddr('a@b@c'),
++            ('', '')
++        )
++        self.assertEqual(
++            utils.parseaddr('a@b.c@c'),
++            ('', '')
++        )
++        self.assertEqual(
++            utils.parseaddr('a@172.17.0.1@c'),
++            ('', '')
++        )
++
+     def test_noquote_dump(self):
+         self.assertEqual(
+             utils.formataddr(('A Silly Person', 'person@dom.ain')),
+diff --git a/Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst b/Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst
+new file mode 100644
+index 0000000..50292e2
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst
+@@ -0,0 +1 @@
++Fix parsing of invalid email addresses with more than one ``@`` (e.g. a@b@c.com.) to not return the part before 2nd ``@`` as valid email address. Patch by maxking & jpic.
+-- 
+1.8.3.1

CVE-2019-16935.patch

@@ -0,0 +1,79 @@
+From 0fe421c4875a031a83b4f0d804464af3a613985c Mon Sep 17 00:00:00 2001
+From: Dong-hee Na <donghee.na92@gmail.com>
+Date: Sat, 28 Sep 2019 04:59:37 +0900
+Subject: [PATCH] bpo-38243, xmlrpc.server: Escape the server_title (GH-16373)
+
+Escape the server title of xmlrpc.server.DocXMLRPCServer
+when rendering the document page as HTML.
+---
+ Lib/test/test_docxmlrpc.py                               | 16 ++++++++++++++++
+ Lib/xmlrpc/server.py                                     |  3 ++-
+ .../Security/2019-09-25-13-21-09.bpo-38243.1pfz24.rst    |  3 +++
+ 3 files changed, 21 insertions(+), 1 deletion(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2019-09-25-13-21-09.bpo-38243.1pfz24.rst
+
+diff --git a/Lib/test/test_docxmlrpc.py b/Lib/test/test_docxmlrpc.py
+index f077f05..3821565 100644
+--- a/Lib/test/test_docxmlrpc.py
++++ b/Lib/test/test_docxmlrpc.py
+@@ -1,5 +1,6 @@
+ from xmlrpc.server import DocXMLRPCServer
+ import http.client
++import re
+ import sys
+ import threading
+ from test import support
+@@ -193,6 +194,21 @@ class DocXMLRPCHTTPGETServer(unittest.TestCase):
+              b'method_annotation</strong></a>(x: bytes)</dt></dl>'),
+             response.read())
+ 
++    def test_server_title_escape(self):
++        # bpo-38243: Ensure that the server title and documentation
++        # are escaped for HTML.
++        self.serv.set_server_title('test_title<script>')
++        self.serv.set_server_documentation('test_documentation<script>')
++        self.assertEqual('test_title<script>', self.serv.server_title)
++        self.assertEqual('test_documentation<script>',
++                self.serv.server_documentation)
++
++        generated = self.serv.generate_html_documentation()
++        title = re.search(r'<title>(.+?)</title>', generated).group()
++        documentation = re.search(r'<p><tt>(.+?)</tt></p>', generated).group()
++        self.assertEqual('<title>Python: test_title&lt;script&gt;</title>', title)
++        self.assertEqual('<p><tt>test_documentation&lt;script&gt;</tt></p>', documentation)
++
+ 
+ if __name__ == '__main__':
+     unittest.main()
+diff --git a/Lib/xmlrpc/server.py b/Lib/xmlrpc/server.py
+index f1c467e..32aba4d 100644
+--- a/Lib/xmlrpc/server.py
++++ b/Lib/xmlrpc/server.py
+@@ -108,6 +108,7 @@ from xmlrpc.client import Fault, dumps, loads, gzip_encode, gzip_decode
+ from http.server import BaseHTTPRequestHandler
+ from functools import partial
+ from inspect import signature
++import html
+ import http.server
+ import socketserver
+ import sys
+@@ -894,7 +895,7 @@ class XMLRPCDocGenerator:
+                                 methods
+                             )
+ 
+-        return documenter.page(self.server_title, documentation)
++        return documenter.page(html.escape(self.server_title), documentation)
+ 
+ class DocXMLRPCRequestHandler(SimpleXMLRPCRequestHandler):
+     """XML-RPC and documentation request handler class.
+diff --git a/Misc/NEWS.d/next/Security/2019-09-25-13-21-09.bpo-38243.1pfz24.rst b/Misc/NEWS.d/next/Security/2019-09-25-13-21-09.bpo-38243.1pfz24.rst
+new file mode 100644
+index 0000000..98d7be1
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2019-09-25-13-21-09.bpo-38243.1pfz24.rst
+@@ -0,0 +1,3 @@
++Escape the server title of :class:`xmlrpc.server.DocXMLRPCServer`
++when rendering the document page as HTML.
++(Contributed by Dong-hee Na in :issue:`38243`.)
+-- 
+1.8.3.1

CVE-2019-17514.patch

@@ -0,0 +1,27 @@
+From c7dac45bbe3ea5fe11df60b07f03c822de350284 Mon Sep 17 00:00:00 2001
+From: Elena Oat <oat.elena@gmail.com>
+Date: Sun, 4 Nov 2018 06:50:55 -0800
+Subject: [PATCH] Explain that the orderness of the result of glob is
+ system-dependant (GH-6587)
+
+Thanks!
+---
+ Doc/library/glob.rst | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/Doc/library/glob.rst b/Doc/library/glob.rst
+index 0db10b5..2a5f0dd 100644
+--- a/Doc/library/glob.rst
++++ b/Doc/library/glob.rst
+@@ -42,7 +42,8 @@ For example, ``'[?]'`` matches the character ``'?'``.
+    a string containing a path specification. *pathname* can be either absolute
+    (like :file:`/usr/src/Python-1.5/Makefile`) or relative (like
+    :file:`../../Tools/\*/\*.gif`), and can contain shell-style wildcards. Broken
+-   symlinks are included in the results (as in the shell).
++   symlinks are included in the results (as in the shell). Whether or not the
++   results are sorted depends on the file system.
+ 
+    .. index::
+       single: **; in glob-style wildcards
+-- 
+1.8.3.1

python3.spec

@@ -3,7 +3,7 @@ Summary: Interpreter of the Python3 programming language
 URL: https://www.python.org/
 
 Version: 3.7.4
-Release: 3
+Release: 4
 License: Python
 
 %global branchversion 3.7
@@ -102,6 +102,10 @@ Patch251: 00251-change-user-install-location.patch
 Patch274: 00274-fix-arch-names.patch
 Patch316: 00316-mark-bdist_wininst-unsupported.patch
 
+Patch6000:	CVE-2019-16056.patch
+Patch6001:	CVE-2019-16935.patch
+Patch6002:	CVE-2019-17514.patch
+
 Provides: python%{branchversion} = %{version}-%{release}
 Provides: python(abi) = %{branchversion}
 
@@ -231,7 +235,6 @@ pushd ${DebugBuildDir}
   --with-system-ffi \
   --enable-loadable-sqlite-extensions \
   --with-dtrace \
-  --with-lto \
   --with-ssl-default-suites=openssl \
   --with-valgrind \
   --without-ensurepip \
@@ -256,7 +259,6 @@ pushd ${OptimizedBuildDir}
   --with-system-ffi \
   --enable-loadable-sqlite-extensions \
   --with-dtrace \
-  --with-lto \
   --with-ssl-default-suites=openssl \
   --with-valgrind \
   --without-ensurepip \
@@ -374,6 +376,11 @@ mv %{buildroot}%{_bindir}/2to3-%{branchversion} %{buildroot}%{_bindir}/2to3
 %check
 topdir=$(pwd)
 
+BEP_WHITELIST_TMP="$BEP_WHITELIST"
+BEP_GTDLIST_TMP="$BEP_GTDLIST"
+export BEP_WHITELIST="python python-debug "$BEP_WHITELIST""
+export BEP_GTDLIST=`echo $BEP_GTDLIST | sed 's/ python / /g'`
+
 export OPENSSL_CONF=/non-existing-file
 
 LD_LIBRARY_PATH=$(pwd)/build/debug $(pwd)/build/debug/python -m test.pythoninfo
@@ -400,6 +407,9 @@ LD_LIBRARY_PATH=$(pwd)/build/optimized $(pwd)/build/optimized/python -m test.reg
     -x test_socket \
     -x test_asyncio
 
+export BEP_WHITELIST="$BEP_WHITELIST_TMP"
+export BEP_GTDLIST="$BEP_GTDLIST_TMP"
+
 %files
 %license LICENSE
 %doc README.rst
@@ -659,6 +669,19 @@ LD_LIBRARY_PATH=$(pwd)/build/optimized $(pwd)/build/optimized/python -m test.reg
 %{pylibdir}/distutils/tests
 %{pylibdir}/sqlite3/test
 %{pylibdir}/test
+%exclude %{pylibdir}/test/allsans.pem
+%exclude %{pylibdir}/test/badcert.pem
+%exclude %{pylibdir}/test/badkey.pem
+%exclude %{pylibdir}/test/idnsans.pem
+%exclude %{pylibdir}/test/keycert2.pem
+%exclude %{pylibdir}/test/keycert3.pem
+%exclude %{pylibdir}/test/keycert4.pem
+%exclude %{pylibdir}/test/keycertecc.pem
+%exclude %{pylibdir}/test/keycert.pem
+%exclude %{pylibdir}/test/pycakey.pem
+%exclude %{pylibdir}/test/ssl_key.pem
+%exclude %{pylibdir}/test/keycert3.pem
+%exclude %{pylibdir}/test/ssl_key.pem
 %{dynload_dir}/_ctypes_test.%{SOABI_optimized}.so
 %{dynload_dir}/_testbuffer.%{SOABI_optimized}.so
 %{dynload_dir}/_testcapi.%{SOABI_optimized}.so
@@ -769,6 +792,10 @@ LD_LIBRARY_PATH=$(pwd)/build/optimized $(pwd)/build/optimized/python -m test.reg
 %{_mandir}/*/*
 
 %changelog
+* Thu Dec 24 2019 openEuler Buildteam <buildteam@openeuler.org> - 3.7.4-4
+- fix CVE-2019-16056 CVE-2019-16935 CVE-2019-17514
+- Delete the test keys, fix BEP problem
+
 * Thu Dec 12 2019 lvying <lvying6@huawei.com> - 3.7.4-3
 - provides python3-enum34