From e9ebd28d1181007ff7f490ef595f47ba584cab3f Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Oct 19 2020 09:13:24 +0000
Subject: import python27-python-virtualenv-13.1.0-4.el7


---

diff --git a/SOURCES/CVE-2019-20916.patch b/SOURCES/CVE-2019-20916.patch
new file mode 100644
index 0000000..8f77430
--- /dev/null
+++ b/SOURCES/CVE-2019-20916.patch
@@ -0,0 +1,55 @@
+diff --git a/pip/download.py b/pip/download.py
+index a083316..cad4da6 100644
+--- a/pip/download.py
++++ b/pip/download.py
+@@ -51,7 +51,8 @@ __all__ = ['get_file_content',
+            'is_url', 'url_to_path', 'path_to_url',
+            'is_archive_file', 'unpack_vcs_link',
+            'unpack_file_url', 'is_vcs_url', 'is_file_url',
+-           'unpack_http_url', 'unpack_url']
++           'unpack_http_url', 'unpack_url',
++           'parse_content_disposition', 'sanitize_content_filename']
+ 
+ 
+ logger = logging.getLogger(__name__)
+@@ -827,6 +828,28 @@ def unpack_url(link, location, download_dir=None,
+     if only_download:
+         write_delete_marker_file(location)
+ 
++def sanitize_content_filename(filename):
++    # type: (str) -> str
++    """
++    Sanitize the "filename" value from a Content-Disposition header.
++    """
++    return os.path.basename(filename)
++
++
++def parse_content_disposition(content_disposition, default_filename):
++    # type: (str, str) -> str
++    """
++    Parse the "filename" value from a Content-Disposition header, and
++    return the default filename if the result is empty.
++    """
++    _type, params = cgi.parse_header(content_disposition)
++    filename = params.get('filename')
++    if filename:
++        # We need to sanitize the filename to prevent directory traversal
++        # in case the filename contains ".." path parts.
++        filename = sanitize_content_filename(filename)
++    return filename or default_filename
++
+ 
+ def _download_http_url(link, session, temp_dir):
+     """Download link url into temp_dir using provided session"""
+@@ -868,10 +891,7 @@ def _download_http_url(link, session, temp_dir):
+     # Have a look at the Content-Disposition header for a better guess
+     content_disposition = resp.headers.get('content-disposition')
+     if content_disposition:
+-        type, params = cgi.parse_header(content_disposition)
+-        # We use ``or`` here because we don't want to use an "empty" value
+-        # from the filename param.
+-        filename = params.get('filename') or filename
++        filename = parse_content_disposition(content_disposition, filename)
+     ext = splitext(filename)[1]
+     if not ext:
+         ext = mimetypes.guess_extension(content_type)
diff --git a/SPECS/python-virtualenv.spec b/SPECS/python-virtualenv.spec
index 8ed115c..4f1e462 100644
--- a/SPECS/python-virtualenv.spec
+++ b/SPECS/python-virtualenv.spec
@@ -3,7 +3,7 @@
 
 Name:           %{?scl_prefix}python-virtualenv
 Version:        13.1.0
-Release:        3%{?dist}
+Release:        4%{?dist}
 Summary:        Tool to create isolated Python environments
 
 Group:          Development/Languages
@@ -18,9 +18,14 @@ Patch0:         polish-error-msg-when-file-is-passed.patch
 
 BuildRoot:      %{_tmppath}/%{pkg_name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
+# Fix CVE-2019-20916: directory traversal in _download_http_url() function within the bundled pip wheel
+# Backported from upstream: https://github.com/pypa/pip/pull/6418
+Patch5:         CVE-2019-20916.patch
+
 BuildArch:      noarch
 BuildRequires:  %{?scl_prefix}python-devel
 BuildRequires:  %{?scl_prefix}python-sphinx
+BuildRequires:  zip
 Requires:       %{?scl_prefix}python-setuptools
 Requires:       %{?scl_prefix}python-devel
 
@@ -36,6 +41,17 @@ licensed under an MIT-style permissive license.
 %{__sed} -i -e "1s|#!/usr/bin/env python||" virtualenv.py 
 
 
+# Patching of bundled libraries
+pushd virtualenv_support/
+# Extract wheel content
+unzip pip-7.1.*-any.whl
+%patch5 -p1
+# Replace the pip folder in the zip archive (.whl)
+zip -r pip-7.1.*-any.whl pip
+# Remove unzipped folders
+rm -rf pip/ pip-7.1.*.dist-info/
+popd  # out of virtualenv_support
+
 %build
 # Build code
 %{?scl:scl enable %{scl} "}
@@ -65,6 +81,10 @@ rm -rf $RPM_BUILD_ROOT
 %attr(755,root,root) %{_bindir}/virtualenv*
 
 %changelog
+* Mon Sep 21 2020 Charalampos Stratakis <cstratak@redhat.com> - 13.1.0-4
+- Security fix for CVE-2019-20916 for the bundled pip wheel
+Resolves: rhbz#1882659
+
 * Fri May 25 2018 Charalampos Stratakis <cstratak@redhat.com> - 13.1.0-3
 - Rebuild for multi-arch bootstrap