Blame SOURCES/CVE-2021-3572.patch

4cae43
Backport of https://github.com/pypa/pip/pull/9827 with parts of
4cae43
https://github.com/pypa/pip/pull/4690 to make it work with pip v9.0.1
4cae43
diff --git a/pip/vcs/git.py b/pip/vcs/git.py
4cae43
index 2187dd8..d1502f8 100644
4cae43
--- a/pip/vcs/git.py
4cae43
+++ b/pip/vcs/git.py
4cae43
@@ -81,7 +81,7 @@ class Git(VersionControl):
4cae43
         and branches may need origin/ as a prefix.
4cae43
         Returns the SHA1 of the branch or tag if found.
4cae43
         """
4cae43
-        revisions = self.get_short_refs(dest)
4cae43
+        revisions = self.get_short_refs(dest, rev)
4cae43
 
4cae43
         origin_rev = 'origin/%s' % rev
4cae43
         if origin_rev in revisions:
4cae43
@@ -171,12 +171,20 @@ class Git(VersionControl):
4cae43
             ['rev-parse', 'HEAD'], show_stdout=False, cwd=location)
4cae43
         return current_rev.strip()
4cae43
 
4cae43
-    def get_full_refs(self, location):
4cae43
+    def get_full_refs(self, location, pattern=''):
4cae43
         """Yields tuples of (commit, ref) for branches and tags"""
4cae43
-        output = self.run_command(['show-ref'],
4cae43
+        output = self.run_command(['show-ref', pattern],
4cae43
                                   show_stdout=False, cwd=location)
4cae43
-        for line in output.strip().splitlines():
4cae43
-            commit, ref = line.split(' ', 1)
4cae43
+        for line in output.split("\n"):
4cae43
+            line = line.rstrip("\r")
4cae43
+            if not line:
4cae43
+                continue
4cae43
+            try:
4cae43
+                commit, ref = line.split(' ', 1)
4cae43
+            except ValueError:
4cae43
+                # Include the offending line to simplify troubleshooting if
4cae43
+                # this error ever occurs.
4cae43
+                raise ValueError(f'unexpected show-ref line: {line!r}')
4cae43
             yield commit.strip(), ref.strip()
4cae43
 
4cae43
     def is_ref_remote(self, ref):
4cae43
@@ -200,10 +208,10 @@ class Git(VersionControl):
4cae43
     def get_refs(self, location):
4cae43
         return self.get_short_refs(location)
4cae43
 
4cae43
-    def get_short_refs(self, location):
4cae43
+    def get_short_refs(self, location, pattern=''):
4cae43
         """Return map of named refs (branches or tags) to commit hashes."""
4cae43
         rv = {}
4cae43
-        for commit, ref in self.get_full_refs(location):
4cae43
+        for commit, ref in self.get_full_refs(location, pattern):
4cae43
             ref_name = None
4cae43
             if self.is_ref_remote(ref):
4cae43
                 ref_name = ref[len('refs/remotes/'):]