diff --git a/.gitignore b/.gitignore index e31c637..dfc2d49 100644 --- a/.gitignore +++ b/.gitignore @@ -64,12 +64,3 @@ lxml-2.2.7.tar.gz.asc /lxml-4.9.3-no-isoschematron-rng.tar.gz /lxml-4.9.4-no-isoschematron-rng.tar.gz /lxml-5.1.0-no-isoschematron-rng.tar.gz -/lxml-5.2.0-no-isoschematron-rng.tar.gz -/lxml-5.2.1-no-isoschematron-rng.tar.gz -/lxml-5.3.0-no-isoschematron-rng.tar.gz -/lxml-5.3.1-no-isoschematron-rng.tar.gz -/lxml-5.3.2-no-isoschematron-rng.tar.gz -/lxml-5.4.0-no-isoschematron-rng.tar.gz -/lxml-6.0.0-no-isoschematron-rng.tar.gz -/lxml-6.0.1-no-isoschematron-rng.tar.gz -/lxml-6.0.2-no-isoschematron-rng.tar.gz diff --git a/407.patch b/407.patch new file mode 100644 index 0000000..81e3203 --- /dev/null +++ b/407.patch @@ -0,0 +1,98 @@ +From e3012a702dea2b03830fe00a5e8f7a429bbc3f42 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= +Date: Tue, 27 Feb 2024 18:43:45 +0100 +Subject: [PATCH] Fix test_elementtree with Expat 2.6.0 + +Feeding the parser by too small chunks defers parsing to prevent +CVE-2023-52425. Future versions of Expat may be more reactive. + +Heavily inspired by https://github.com/python/cpython/commit/4a08e7b3431cd32a0daf22a33421cd3035343dc4 + +We cannot use a @fails_with_expat_2_6_0 decorator +because the test passes in ETreePullTestCase. + +Co-Authored-By: Serhiy Storchaka +--- + src/lxml/tests/test_elementtree.py | 62 +++++++++++++++++++----------- + 1 file changed, 39 insertions(+), 23 deletions(-) + +diff --git a/src/lxml/tests/test_elementtree.py b/src/lxml/tests/test_elementtree.py +index 8ccf4442a..ef923c5ce 100644 +--- a/src/lxml/tests/test_elementtree.py ++++ b/src/lxml/tests/test_elementtree.py +@@ -10,6 +10,7 @@ + import io + import operator + import os ++import pyexpat + import re + import sys + import textwrap +@@ -4383,29 +4384,44 @@ def assert_event_tags(self, parser, expected, max_events=None): + self.assertEqual([(action, elem.tag) for action, elem in events], + expected) + +- def test_simple_xml(self): +- for chunk_size in (None, 1, 5): +- #with self.subTest(chunk_size=chunk_size): +- parser = self.etree.XMLPullParser() +- self.assert_event_tags(parser, []) +- self._feed(parser, "\n", chunk_size) +- self.assert_event_tags(parser, []) +- self._feed(parser, +- "\n text\n", chunk_size) +- self.assert_event_tags(parser, [('end', 'element')]) +- self._feed(parser, "texttail\n", chunk_size) +- self._feed(parser, "\n", chunk_size) +- self.assert_event_tags(parser, [ +- ('end', 'element'), +- ('end', 'empty-element'), +- ]) +- self._feed(parser, "\n", chunk_size) +- self.assert_event_tags(parser, [('end', 'root')]) +- root = self._close_and_return_root(parser) +- self.assertEqual(root.tag, 'root') ++ def test_simple_xml(self, chunk_size=None): ++ parser = self.etree.XMLPullParser() ++ self.assert_event_tags(parser, []) ++ self._feed(parser, "\n", chunk_size) ++ self.assert_event_tags(parser, []) ++ self._feed(parser, ++ "\n text\n", chunk_size) ++ self.assert_event_tags(parser, [('end', 'element')]) ++ self._feed(parser, "texttail\n", chunk_size) ++ self._feed(parser, "\n", chunk_size) ++ self.assert_event_tags(parser, [ ++ ('end', 'element'), ++ ('end', 'empty-element'), ++ ]) ++ self._feed(parser, "\n", chunk_size) ++ self.assert_event_tags(parser, [('end', 'root')]) ++ root = self._close_and_return_root(parser) ++ self.assertEqual(root.tag, 'root') ++ ++ def test_simple_xml_chunk_1(self): ++ if self.etree is not etree and pyexpat.version_info >= (2, 6, 0): ++ raise unittest.SkipTest( ++ "Feeding the parser by too small chunks defers parsing" ++ ) ++ self.test_simple_xml(chunk_size=1) ++ ++ def test_simple_xml_chunk_5(self): ++ if self.etree is not etree and pyexpat.version_info >= (2, 6, 0): ++ raise unittest.SkipTest( ++ "Feeding the parser by too small chunks defers parsing" ++ ) ++ self.test_simple_xml(chunk_size=5) ++ ++ def test_simple_xml_chunk_22(self): ++ self.test_simple_xml(chunk_size=22) + + def test_feed_while_iterating(self): + parser = self.etree.XMLPullParser() diff --git a/python-lxml.spec b/python-lxml.spec index 3151ed0..8237b01 100644 --- a/python-lxml.spec +++ b/python-lxml.spec @@ -1,5 +1,5 @@ Name: python-lxml -Version: 6.0.2 +Version: 5.1.0 Release: %autorelease Summary: XML processing library combining libxml2/libxslt with the ElementTree API @@ -16,6 +16,10 @@ URL: https://github.com/lxml/lxml Source0: lxml-%{version}-no-isoschematron-rng.tar.gz Source1: get-lxml-source.sh +# Fix test_elementtree with Expat 2.6.0 +# Merged upstream +Patch: https://github.com/lxml/lxml/pull/407.patch + BuildRequires: gcc BuildRequires: libxml2-devel BuildRequires: libxslt-devel @@ -25,7 +29,6 @@ BuildRequires: python3-devel # - [cssselect] Requires cssselect BuildRequires lxml # - [html5] Requires html5lib BuildRequires lxml # - [htmlsoup] Requires beautifulsoup4 Requires lxml -# - [html_clean] Requires lxml-html-clean Requires lxml # Hence we provide a bcond to disable the extras altogether. # By default, the extras are disabled in RHEL, to avoid dependencies. %bcond extras %{undefined rhel} @@ -44,7 +47,6 @@ Summary: %{summary} Suggests: python3-lxml+cssselect Suggests: python3-lxml+html5 Suggests: python3-lxml+htmlsoup -Suggests: python3-lxml+html_clean %endif %description -n python3-lxml %{_description} @@ -52,7 +54,7 @@ Suggests: python3-lxml+html_clean Python 3 version. %if %{with extras} -%pyproject_extras_subpkg -n python3-lxml cssselect html5 htmlsoup html_clean +%pyproject_extras_subpkg -n python3-lxml cssselect html5 htmlsoup %endif %prep @@ -65,7 +67,7 @@ sed -i "s/Cython.*/Cython/" requirements.txt sed -i 's/"Cython.*",/"Cython",/' pyproject.toml %generate_buildrequires -%pyproject_buildrequires -x source%{?with_extras:,cssselect,html5,htmlsoup,html_clean} +%pyproject_buildrequires -x source%{?with_extras:,cssselect,html5,htmlsoup} %build # Remove pregenerated Cython C sources diff --git a/sources b/sources index 943c07f..c2b3845 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (lxml-6.0.2-no-isoschematron-rng.tar.gz) = dc89f75c3a3c828a46bcb2eefbebe8f98ce8072b9fb66f8ef81edbf2babed74e4c54e26392603319d60ab3bfab6a4795eedc85b28efba815797d43d53aae4060 +SHA512 (lxml-5.1.0-no-isoschematron-rng.tar.gz) = f4b65c0189c89742fb4be6a3e73b08e7e7338272b71482e64be75dc8d53cebc769c0520a86a46579328fa0ec4377bb2bd860338550b1098d26c8f509fcedc664