From 10d7b0462e8a1792aa879d8bab321af70b3e8ad5 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Sep 27 2022 11:41:28 +0000 Subject: import python-lxml-4.6.5-3.el9 --- diff --git a/SOURCES/CVE-2022-2309.patch b/SOURCES/CVE-2022-2309.patch new file mode 100644 index 0000000..588d9ba --- /dev/null +++ b/SOURCES/CVE-2022-2309.patch @@ -0,0 +1,104 @@ +diff --git a/src/lxml/apihelpers.pxi b/src/lxml/apihelpers.pxi +index 5eb3416..88a031d 100644 +--- a/src/lxml/apihelpers.pxi ++++ b/src/lxml/apihelpers.pxi +@@ -246,9 +246,10 @@ cdef dict _build_nsmap(xmlNode* c_node): + while c_node is not NULL and c_node.type == tree.XML_ELEMENT_NODE: + c_ns = c_node.nsDef + while c_ns is not NULL: +- prefix = funicodeOrNone(c_ns.prefix) +- if prefix not in nsmap: +- nsmap[prefix] = funicodeOrNone(c_ns.href) ++ if c_ns.prefix or c_ns.href: ++ prefix = funicodeOrNone(c_ns.prefix) ++ if prefix not in nsmap: ++ nsmap[prefix] = funicodeOrNone(c_ns.href) + c_ns = c_ns.next + c_node = c_node.parent + return nsmap +diff --git a/src/lxml/includes/xmlparser.pxd b/src/lxml/includes/xmlparser.pxd +index a196e34..45acfc8 100644 +--- a/src/lxml/includes/xmlparser.pxd ++++ b/src/lxml/includes/xmlparser.pxd +@@ -144,6 +144,7 @@ cdef extern from "libxml/parser.h": + void* userData + int* spaceTab + int spaceMax ++ int nsNr + bint html + bint progressive + int inSubset +diff --git a/src/lxml/iterparse.pxi b/src/lxml/iterparse.pxi +index 4c20506..3da7485 100644 +--- a/src/lxml/iterparse.pxi ++++ b/src/lxml/iterparse.pxi +@@ -419,7 +419,7 @@ cdef int _countNsDefs(xmlNode* c_node): + count = 0 + c_ns = c_node.nsDef + while c_ns is not NULL: +- count += 1 ++ count += (c_ns.href is not NULL) + c_ns = c_ns.next + return count + +@@ -430,9 +430,10 @@ cdef int _appendStartNsEvents(xmlNode* c_node, list event_list) except -1: + count = 0 + c_ns = c_node.nsDef + while c_ns is not NULL: +- ns_tuple = (funicode(c_ns.prefix) if c_ns.prefix is not NULL else '', +- funicode(c_ns.href)) +- event_list.append( (u"start-ns", ns_tuple) ) +- count += 1 ++ if c_ns.href: ++ ns_tuple = (funicodeOrEmpty(c_ns.prefix), ++ funicode(c_ns.href)) ++ event_list.append( (u"start-ns", ns_tuple) ) ++ count += 1 + c_ns = c_ns.next + return count +diff --git a/src/lxml/parser.pxi b/src/lxml/parser.pxi +index 3ed223b..f5ff6b2 100644 +--- a/src/lxml/parser.pxi ++++ b/src/lxml/parser.pxi +@@ -569,6 +569,9 @@ cdef class _ParserContext(_ResolverContext): + self._c_ctxt.disableSAX = 0 # work around bug in libxml2 + else: + xmlparser.xmlClearParserCtxt(self._c_ctxt) ++ # work around bug in libxml2 [2.9.10 .. 2.9.14]: ++ # https://gitlab.gnome.org/GNOME/libxml2/-/issues/378 ++ self._c_ctxt.nsNr = 0 + + cdef int prepare(self, bint set_document_loader=True) except -1: + cdef int result +diff --git a/src/lxml/tests/test_etree.py b/src/lxml/tests/test_etree.py +index 42613dc..db1f560 100644 +--- a/src/lxml/tests/test_etree.py ++++ b/src/lxml/tests/test_etree.py +@@ -1459,6 +1459,27 @@ class ETreeOnlyTestCase(HelperTestCase): + [1,2,1,4], + counts) + ++ def test_walk_after_parse_failure(self): ++ # This used to be an issue because libxml2 can leak empty namespaces ++ # between failed parser runs. iterwalk() failed to handle such a tree. ++ parser = etree.XMLParser() ++ ++ try: ++ etree.XML('''''', parser=parser) ++ except etree.XMLSyntaxError: ++ pass ++ else: ++ assert False, "invalid input did not fail to parse" ++ ++ et = etree.XML(''' ''', parser=parser) ++ try: ++ ns = next(etree.iterwalk(et, events=('start-ns',))) ++ except StopIteration: ++ # This would be the expected result, because there was no namespace ++ pass ++ else: ++ assert False, "Found unexpected namespace '%s'" % ns ++ + def test_itertext_comment_pi(self): + # https://bugs.launchpad.net/lxml/+bug/1844674 + XML = self.etree.XML diff --git a/SPECS/python-lxml.spec b/SPECS/python-lxml.spec index 3e7ec6d..ca1403c 100644 --- a/SPECS/python-lxml.spec +++ b/SPECS/python-lxml.spec @@ -2,7 +2,7 @@ Name: python-%{modname} Version: 4.6.5 -Release: 2%{?dist} +Release: 3%{?dist} Summary: XML processing library combining libxml2/libxslt with the ElementTree API # The lxml project is licensed under BSD @@ -13,6 +13,14 @@ License: BSD and MIT and zlib URL: https://github.com/lxml/lxml Source0: %{pypi_source %{modname}} +# Fix for CVE-2022-2309 +# Resolved upstream: +# https://github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847149af0c6f +# https://github.com/lxml/lxml/commit/d01872ccdf7e1e5e825b6c6292b43e7d27ae5fc4 +# https://github.com/lxml/lxml/commit/c742576c105f40fc8b754fcae56fee4aa35840a3 +# Tracking bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2107571 +Patch0: CVE-2022-2309.patch + BuildRequires: gcc BuildRequires: libxml2-devel BuildRequires: libxslt-devel @@ -65,6 +73,10 @@ cp -a build/lib.%{python3_platform}-%{python3_version}/* src/ %{python3_sitearch}/%{modname}-*.egg-info/ %changelog +* Wed Jul 27 2022 Charalampos Stratakis - 4.6.5-3 +- Security fix for CVE-2022-2309 +- Resolves: rhbz#2107571 + * Tue Feb 08 2022 Tomas Orsava - 4.6.5-2 - Add automatically generated Obsoletes tag with the python39- prefix for smoother upgrade from RHEL8