.gitignore

@@ -64,12 +64,3 @@ lxml-2.2.7.tar.gz.asc
 /lxml-4.9.3-no-isoschematron-rng.tar.gz
 /lxml-4.9.4-no-isoschematron-rng.tar.gz
 /lxml-5.1.0-no-isoschematron-rng.tar.gz
-/lxml-5.2.0-no-isoschematron-rng.tar.gz
-/lxml-5.2.1-no-isoschematron-rng.tar.gz
-/lxml-5.3.0-no-isoschematron-rng.tar.gz
-/lxml-5.3.1-no-isoschematron-rng.tar.gz
-/lxml-5.3.2-no-isoschematron-rng.tar.gz
-/lxml-5.4.0-no-isoschematron-rng.tar.gz
-/lxml-6.0.0-no-isoschematron-rng.tar.gz
-/lxml-6.0.1-no-isoschematron-rng.tar.gz
-/lxml-6.0.2-no-isoschematron-rng.tar.gz

407.patch

@@ -0,0 +1,98 @@
+From e3012a702dea2b03830fe00a5e8f7a429bbc3f42 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
+Date: Tue, 27 Feb 2024 18:43:45 +0100
+Subject: [PATCH] Fix test_elementtree with Expat 2.6.0
+
+Feeding the parser by too small chunks defers parsing to prevent
+CVE-2023-52425. Future versions of Expat may be more reactive.
+
+Heavily inspired by https://github.com/python/cpython/commit/4a08e7b3431cd32a0daf22a33421cd3035343dc4
+
+We cannot use a @fails_with_expat_2_6_0 decorator
+because the test passes in ETreePullTestCase.
+
+Co-Authored-By: Serhiy Storchaka <storchaka@gmail.com>
+---
+ src/lxml/tests/test_elementtree.py | 62 +++++++++++++++++++-----------
+ 1 file changed, 39 insertions(+), 23 deletions(-)
+
+diff --git a/src/lxml/tests/test_elementtree.py b/src/lxml/tests/test_elementtree.py
+index 8ccf4442a..ef923c5ce 100644
+--- a/src/lxml/tests/test_elementtree.py
++++ b/src/lxml/tests/test_elementtree.py
+@@ -10,6 +10,7 @@
+ import io
+ import operator
+ import os
++import pyexpat
+ import re
+ import sys
+ import textwrap
+@@ -4383,29 +4384,44 @@ def assert_event_tags(self, parser, expected, max_events=None):
+         self.assertEqual([(action, elem.tag) for action, elem in events],
+                          expected)
+ 
+-    def test_simple_xml(self):
+-        for chunk_size in (None, 1, 5):
+-            #with self.subTest(chunk_size=chunk_size):
+-                parser = self.etree.XMLPullParser()
+-                self.assert_event_tags(parser, [])
+-                self._feed(parser, "<!-- comment -->\n", chunk_size)
+-                self.assert_event_tags(parser, [])
+-                self._feed(parser,
+-                           "<root>\n  <element key='value'>text</element",
+-                           chunk_size)
+-                self.assert_event_tags(parser, [])
+-                self._feed(parser, ">\n", chunk_size)
+-                self.assert_event_tags(parser, [('end', 'element')])
+-                self._feed(parser, "<element>text</element>tail\n", chunk_size)
+-                self._feed(parser, "<empty-element/>\n", chunk_size)
+-                self.assert_event_tags(parser, [
+-                    ('end', 'element'),
+-                    ('end', 'empty-element'),
+-                    ])
+-                self._feed(parser, "</root>\n", chunk_size)
+-                self.assert_event_tags(parser, [('end', 'root')])
+-                root = self._close_and_return_root(parser)
+-                self.assertEqual(root.tag, 'root')
++    def test_simple_xml(self, chunk_size=None):
++        parser = self.etree.XMLPullParser()
++        self.assert_event_tags(parser, [])
++        self._feed(parser, "<!-- comment -->\n", chunk_size)
++        self.assert_event_tags(parser, [])
++        self._feed(parser,
++                   "<root>\n  <element key='value'>text</element",
++                   chunk_size)
++        self.assert_event_tags(parser, [])
++        self._feed(parser, ">\n", chunk_size)
++        self.assert_event_tags(parser, [('end', 'element')])
++        self._feed(parser, "<element>text</element>tail\n", chunk_size)
++        self._feed(parser, "<empty-element/>\n", chunk_size)
++        self.assert_event_tags(parser, [
++            ('end', 'element'),
++            ('end', 'empty-element'),
++            ])
++        self._feed(parser, "</root>\n", chunk_size)
++        self.assert_event_tags(parser, [('end', 'root')])
++        root = self._close_and_return_root(parser)
++        self.assertEqual(root.tag, 'root')
++
++    def test_simple_xml_chunk_1(self):
++        if self.etree is not etree and pyexpat.version_info >= (2, 6, 0):
++            raise unittest.SkipTest(
++                "Feeding the parser by too small chunks defers parsing"
++            )
++        self.test_simple_xml(chunk_size=1)
++
++    def test_simple_xml_chunk_5(self):
++        if self.etree is not etree and pyexpat.version_info >= (2, 6, 0):
++            raise unittest.SkipTest(
++                "Feeding the parser by too small chunks defers parsing"
++            )
++        self.test_simple_xml(chunk_size=5)
++
++    def test_simple_xml_chunk_22(self):
++        self.test_simple_xml(chunk_size=22)
+ 
+     def test_feed_while_iterating(self):
+         parser = self.etree.XMLPullParser()

python-lxml.spec

@@ -1,5 +1,5 @@
 Name:           python-lxml
-Version:        6.0.2
+Version:        5.1.0
 Release:        %autorelease
 Summary:        XML processing library combining libxml2/libxslt with the ElementTree API
 
@@ -16,6 +16,10 @@ URL:            https://github.com/lxml/lxml
 Source0:        lxml-%{version}-no-isoschematron-rng.tar.gz
 Source1:        get-lxml-source.sh
 
+# Fix test_elementtree with Expat 2.6.0
+# Merged upstream
+Patch:          https://github.com/lxml/lxml/pull/407.patch
+
 BuildRequires:  gcc
 BuildRequires:  libxml2-devel
 BuildRequires:  libxslt-devel
@@ -25,7 +29,6 @@ BuildRequires:  python3-devel
 # - [cssselect] Requires cssselect BuildRequires lxml
 # - [html5] Requires html5lib BuildRequires lxml
 # - [htmlsoup] Requires beautifulsoup4 Requires lxml
-# - [html_clean] Requires lxml-html-clean Requires lxml
 # Hence we provide a bcond to disable the extras altogether.
 # By default, the extras are disabled in RHEL, to avoid dependencies.
 %bcond extras %{undefined rhel}
@@ -44,7 +47,6 @@ Summary:        %{summary}
 Suggests:       python3-lxml+cssselect
 Suggests:       python3-lxml+html5
 Suggests:       python3-lxml+htmlsoup
-Suggests:       python3-lxml+html_clean
 %endif
 
 %description -n python3-lxml %{_description}
@@ -52,7 +54,7 @@ Suggests:       python3-lxml+html_clean
 Python 3 version.
 
 %if %{with extras}
-%pyproject_extras_subpkg -n python3-lxml cssselect html5 htmlsoup html_clean
+%pyproject_extras_subpkg -n python3-lxml cssselect html5 htmlsoup
 %endif
 
 %prep
@@ -65,7 +67,7 @@ sed -i "s/Cython.*/Cython/" requirements.txt
 sed -i 's/"Cython.*",/"Cython",/' pyproject.toml
 
 %generate_buildrequires
-%pyproject_buildrequires -x source%{?with_extras:,cssselect,html5,htmlsoup,html_clean}
+%pyproject_buildrequires -x source%{?with_extras:,cssselect,html5,htmlsoup}
 
 %build
 # Remove pregenerated Cython C sources

sources

@@ -1 +1 @@
-SHA512 (lxml-6.0.2-no-isoschematron-rng.tar.gz) = dc89f75c3a3c828a46bcb2eefbebe8f98ce8072b9fb66f8ef81edbf2babed74e4c54e26392603319d60ab3bfab6a4795eedc85b28efba815797d43d53aae4060
+SHA512 (lxml-5.1.0-no-isoschematron-rng.tar.gz) = f4b65c0189c89742fb4be6a3e73b08e7e7338272b71482e64be75dc8d53cebc769c0520a86a46579328fa0ec4377bb2bd860338550b1098d26c8f509fcedc664