From a9868b4795ae3355809dd21f21fb86b15e2d979a Mon Sep 17 00:00:00 2001 From: Maxwell G Date: Tue, 30 May 2023 13:36:42 -0500 Subject: [PATCH 1/2] Support repeated keys in --config-settings --- ...the-same-key-multiple-times-in-confi.patch | 76 +++++++++++++++++++ python-pip.spec | 12 ++- 2 files changed, 87 insertions(+), 1 deletion(-) create mode 100644 Support-passing-the-same-key-multiple-times-in-confi.patch diff --git a/Support-passing-the-same-key-multiple-times-in-confi.patch b/Support-passing-the-same-key-multiple-times-in-confi.patch new file mode 100644 index 0000000..0496d4e --- /dev/null +++ b/Support-passing-the-same-key-multiple-times-in-confi.patch @@ -0,0 +1,76 @@ +From d498b3997167865a42f4c663eac518cae3a0daeb Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Filipe=20La=C3=ADns?= +Date: Fri, 17 Mar 2023 21:23:19 +0000 +Subject: [PATCH] Support passing the same key multiple times in + --config-settings (#11853) + +(cherry picked from commit 1268487cbab1b2ffab881b5961c0476e655b6c88) +--- + news/11681.feature.rst | 4 ++++ + src/pip/_internal/cli/cmdoptions.py | 8 +++++++- + tests/unit/test_pyproject_config.py | 15 ++++++++++++--- + 3 files changed, 23 insertions(+), 4 deletions(-) + create mode 100644 news/11681.feature.rst + +diff --git a/news/11681.feature.rst b/news/11681.feature.rst +new file mode 100644 +index 000000000..a0d918b19 +--- /dev/null ++++ b/news/11681.feature.rst +@@ -0,0 +1,4 @@ ++The ``--config-settings``/``-C`` option now supports using the same key multiple ++times. When the same key is specified multiple times, all values are passed to ++the build backend as a list, as opposed to the previous behavior where pip would ++only pass the last value is the same key was used multiple times. +diff --git a/src/pip/_internal/cli/cmdoptions.py b/src/pip/_internal/cli/cmdoptions.py +index b4e2560de..4179f98a5 100644 +--- a/src/pip/_internal/cli/cmdoptions.py ++++ b/src/pip/_internal/cli/cmdoptions.py +@@ -803,7 +803,13 @@ def _handle_config_settings( + if dest is None: + dest = {} + setattr(parser.values, option.dest, dest) +- dest[key] = val ++ if key in dest: ++ if isinstance(dest[key], list): ++ dest[key].append(val) ++ else: ++ dest[key] = [dest[key], val] ++ else: ++ dest[key] = val + + + config_settings: Callable[..., Option] = partial( +diff --git a/tests/unit/test_pyproject_config.py b/tests/unit/test_pyproject_config.py +index 9937f3880..c7e469560 100644 +--- a/tests/unit/test_pyproject_config.py ++++ b/tests/unit/test_pyproject_config.py +@@ -1,3 +1,5 @@ ++from typing import Dict, List ++ + import pytest + + from pip._internal.commands import create_command +@@ -36,9 +38,16 @@ def test_set_config_empty_value() -> None: + assert options.config_settings == {"x": ""} + + +-def test_replace_config_value() -> None: ++@pytest.mark.parametrize( ++ ("passed", "expected"), ++ [ ++ (["x=hello", "x=world"], {"x": ["hello", "world"]}), ++ (["x=hello", "x=world", "x=other"], {"x": ["hello", "world", "other"]}), ++ ], ++) ++def test_multiple_config_values(passed: List[str], expected: Dict[str, str]) -> None: + i = create_command("install") + options, _ = i.parse_args( +- ["xxx", "--config-settings", "x=hello", "--config-settings", "x=world"] ++ ["xxx", *(f"--config-settings={option}" for option in passed)] + ) +- assert options.config_settings == {"x": "world"} ++ assert options.config_settings == expected +-- +2.40.1 + diff --git a/python-pip.spec b/python-pip.spec index 08aedb1..8a0640f 100644 --- a/python-pip.spec +++ b/python-pip.spec @@ -21,7 +21,7 @@ Name: python-%{srcname} Version: %{base_version}%{?prerel:~%{prerel}} -Release: 2%{?dist} +Release: 3%{?dist} Summary: A tool for installing and managing Python packages # We bundle a lot of libraries with pip, which itself is under MIT license. @@ -90,6 +90,13 @@ Patch: nowarn-pip._internal.main.patch # Upstream issue: https://github.com/pypa/packaging/issues/368 Patch: no-version-warning.patch +# Support passing the same key multiple times in --config-settings +# This is needed for pyproject-rpm-macros to have consistent behavior across +# Fedora releases. +# Based on: +# https://github.com/pypa/pip/commit/1268487cbab1b2ffab881b5961c0476e655b6c88 +Patch: Support-passing-the-same-key-multiple-times-in-confi.patch + # Downstream only patch # Users might have local installations of pip from using # `pip install --user --upgrade pip` on older/newer versions. @@ -390,6 +397,9 @@ pytest_k='not completion' %{python_wheel_dir}/%{python_wheel_name} %changelog +* Tue May 30 2023 Maxwell G - 22.3.1-3 +- Backport patch to support passing the same key multiple times in --config-settings + * Fri Jan 20 2023 Fedora Release Engineering - 22.3.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From 0e5fd6d75c7f16879275d8d160e9942a726d62a9 Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Wed, 17 Apr 2024 03:00:52 +0200 Subject: [PATCH 2/2] Security fix for CVE-2023-5752 Resolves: rhbz#2263291 --- CVE-2023-5752.patch | 166 ++++++++++++++++++++++++++++++++++++++++++++ python-pip.spec | 14 +++- 2 files changed, 179 insertions(+), 1 deletion(-) create mode 100644 CVE-2023-5752.patch diff --git a/CVE-2023-5752.patch b/CVE-2023-5752.patch new file mode 100644 index 0000000..446a270 --- /dev/null +++ b/CVE-2023-5752.patch @@ -0,0 +1,166 @@ +From e368a2ee9db863112dcd5054a8db439ea07c8ae9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?St=C3=A9phane=20Bidoul?= +Date: Mon, 29 May 2023 13:57:52 +0200 +Subject: [PATCH 1/4] Pass revisions options explicitly to mercurial commands + +--- + news/12119.bugfix.rst | 3 +++ + src/pip/_internal/vcs/mercurial.py | 2 +- + tests/unit/test_vcs.py | 2 +- + 3 files changed, 5 insertions(+), 2 deletions(-) + create mode 100644 news/12119.bugfix.rst + +diff --git a/news/12119.bugfix.rst b/news/12119.bugfix.rst +new file mode 100644 +index 0000000..da8d8b0 +--- /dev/null ++++ b/news/12119.bugfix.rst +@@ -0,0 +1,3 @@ ++Pass the ``-r`` flag to mercurial to be explicit that a revision is passed and protect ++against ``hg`` options injection as part of VCS URLs. Users that do not have control on ++VCS URLs passed to pip are advised to upgrade. +diff --git a/src/pip/_internal/vcs/mercurial.py b/src/pip/_internal/vcs/mercurial.py +index 2a005e0..4595960 100644 +--- a/src/pip/_internal/vcs/mercurial.py ++++ b/src/pip/_internal/vcs/mercurial.py +@@ -31,7 +31,7 @@ class Mercurial(VersionControl): + + @staticmethod + def get_base_rev_args(rev: str) -> List[str]: +- return [rev] ++ return ["-r", rev] + + def fetch_new( + self, dest: str, url: HiddenText, rev_options: RevOptions, verbosity: int +diff --git a/tests/unit/test_vcs.py b/tests/unit/test_vcs.py +index 566c88c..38daaa0 100644 +--- a/tests/unit/test_vcs.py ++++ b/tests/unit/test_vcs.py +@@ -66,7 +66,7 @@ def test_rev_options_repr() -> None: + # First check VCS-specific RevOptions behavior. + (Bazaar, [], ["-r", "123"], {}), + (Git, ["HEAD"], ["123"], {}), +- (Mercurial, [], ["123"], {}), ++ (Mercurial, [], ["-r", "123"], {}), + (Subversion, [], ["-r", "123"], {}), + # Test extra_args. For this, test using a single VersionControl class. + ( +-- +2.44.0 + + +From 29f1379a6ebcf48dae94d4446c568edac6a86372 Mon Sep 17 00:00:00 2001 +From: Pradyun Gedam +Date: Sun, 1 Oct 2023 14:10:25 +0100 +Subject: [PATCH 2/4] Use `-r=...` instead of `-r ...` for hg + +This ensures that the resulting revision can not be misinterpreted as an +option. +--- + src/pip/_internal/vcs/mercurial.py | 2 +- + tests/unit/test_vcs.py | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/pip/_internal/vcs/mercurial.py b/src/pip/_internal/vcs/mercurial.py +index 4595960..e440c12 100644 +--- a/src/pip/_internal/vcs/mercurial.py ++++ b/src/pip/_internal/vcs/mercurial.py +@@ -31,7 +31,7 @@ class Mercurial(VersionControl): + + @staticmethod + def get_base_rev_args(rev: str) -> List[str]: +- return ["-r", rev] ++ return [f"-r={rev}"] + + def fetch_new( + self, dest: str, url: HiddenText, rev_options: RevOptions, verbosity: int +diff --git a/tests/unit/test_vcs.py b/tests/unit/test_vcs.py +index 38daaa0..9afd022 100644 +--- a/tests/unit/test_vcs.py ++++ b/tests/unit/test_vcs.py +@@ -66,7 +66,7 @@ def test_rev_options_repr() -> None: + # First check VCS-specific RevOptions behavior. + (Bazaar, [], ["-r", "123"], {}), + (Git, ["HEAD"], ["123"], {}), +- (Mercurial, [], ["-r", "123"], {}), ++ (Mercurial, [], ["-r=123"], {}), + (Subversion, [], ["-r", "123"], {}), + # Test extra_args. For this, test using a single VersionControl class. + ( +-- +2.44.0 + + +From 19db9b777831cb3da519bc84304501b7b9702159 Mon Sep 17 00:00:00 2001 +From: Pradyun Gedam +Date: Sun, 1 Oct 2023 13:49:06 +0100 +Subject: [PATCH 3/4] newspaper: + +--- + news/12306.bugfix.rst | 1 + + 1 file changed, 1 insertion(+) + create mode 100644 news/12306.bugfix.rst + +diff --git a/news/12306.bugfix.rst b/news/12306.bugfix.rst +new file mode 100644 +index 0000000..eb6eeca +--- /dev/null ++++ b/news/12306.bugfix.rst +@@ -0,0 +1 @@ ++Use ``-r=...`` instead of ``-r ...`` to specify references with Mercurial. +-- +2.44.0 + + +From 259d59335885077c1e1adbed02986734e2823f27 Mon Sep 17 00:00:00 2001 +From: efflamlemaillet <6533295+efflamlemaillet@users.noreply.github.com> +Date: Fri, 27 Oct 2023 11:08:17 +0200 +Subject: [PATCH 4/4] Fix hg: "parse error at 0: not a prefix:" (#12373) + +Use two hypen argument `--rev=` instead of `-r=` + +Co-authored-by: Efflam Lemaillet +Co-authored-by: Pradyun Gedam +--- + news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst | 1 + + src/pip/_internal/vcs/mercurial.py | 2 +- + tests/unit/test_vcs.py | 2 +- + 3 files changed, 3 insertions(+), 2 deletions(-) + create mode 100644 news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst + +diff --git a/news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst b/news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst +new file mode 100644 +index 0000000..76a8e6b +--- /dev/null ++++ b/news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst +@@ -0,0 +1 @@ ++Fix mercurial revision "parse error": use ``--rev={ref}`` instead of ``-r={ref}`` +diff --git a/src/pip/_internal/vcs/mercurial.py b/src/pip/_internal/vcs/mercurial.py +index e440c12..c183d41 100644 +--- a/src/pip/_internal/vcs/mercurial.py ++++ b/src/pip/_internal/vcs/mercurial.py +@@ -31,7 +31,7 @@ class Mercurial(VersionControl): + + @staticmethod + def get_base_rev_args(rev: str) -> List[str]: +- return [f"-r={rev}"] ++ return [f"--rev={rev}"] + + def fetch_new( + self, dest: str, url: HiddenText, rev_options: RevOptions, verbosity: int +diff --git a/tests/unit/test_vcs.py b/tests/unit/test_vcs.py +index 9afd022..8512357 100644 +--- a/tests/unit/test_vcs.py ++++ b/tests/unit/test_vcs.py +@@ -66,7 +66,7 @@ def test_rev_options_repr() -> None: + # First check VCS-specific RevOptions behavior. + (Bazaar, [], ["-r", "123"], {}), + (Git, ["HEAD"], ["123"], {}), +- (Mercurial, [], ["-r=123"], {}), ++ (Mercurial, [], ["--rev=123"], {}), + (Subversion, [], ["-r", "123"], {}), + # Test extra_args. For this, test using a single VersionControl class. + ( +-- +2.44.0 + diff --git a/python-pip.spec b/python-pip.spec index 8a0640f..66e1b23 100644 --- a/python-pip.spec +++ b/python-pip.spec @@ -21,7 +21,7 @@ Name: python-%{srcname} Version: %{base_version}%{?prerel:~%{prerel}} -Release: 3%{?dist} +Release: 4%{?dist} Summary: A tool for installing and managing Python packages # We bundle a lot of libraries with pip, which itself is under MIT license. @@ -97,6 +97,14 @@ Patch: no-version-warning.patch # https://github.com/pypa/pip/commit/1268487cbab1b2ffab881b5961c0476e655b6c88 Patch: Support-passing-the-same-key-multiple-times-in-confi.patch +# Security fix for CVE-2023-5752: +# Mercurial configuration injectable in repo revision when installing via pip +# Resolved upstream: +# https://github.com/pypa/pip/commit/4145168d68884a6ec10948dd28b1a6f54f17e63b +# https://github.com/pypa/pip/commit/1082eb12622b20d101d2864111dd9a591dd6c2f5 +# https://github.com/pypa/pip/commit/6dbd9c68f085c5bf304247bf7c7933842092efb2 +Patch: CVE-2023-5752.patch + # Downstream only patch # Users might have local installations of pip from using # `pip install --user --upgrade pip` on older/newer versions. @@ -397,6 +405,10 @@ pytest_k='not completion' %{python_wheel_dir}/%{python_wheel_name} %changelog +* Wed Apr 17 2024 Charalampos Stratakis - 22.3.1-4 +- Security fix for CVE-2023-5752 +Resolves: rhbz#2263291 + * Tue May 30 2023 Maxwell G - 22.3.1-3 - Backport patch to support passing the same key multiple times in --config-settings