Security fix for CVE-2023-5752

Resolves: rhbz#2263291

CVE-2023-5752.patch

@@ -0,0 +1,166 @@
+From e368a2ee9db863112dcd5054a8db439ea07c8ae9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?St=C3=A9phane=20Bidoul?= <stephane.bidoul@gmail.com>
+Date: Mon, 29 May 2023 13:57:52 +0200
+Subject: [PATCH 1/4] Pass revisions options explicitly to mercurial commands
+
+---
+ news/12119.bugfix.rst              | 3 +++
+ src/pip/_internal/vcs/mercurial.py | 2 +-
+ tests/unit/test_vcs.py             | 2 +-
+ 3 files changed, 5 insertions(+), 2 deletions(-)
+ create mode 100644 news/12119.bugfix.rst
+
+diff --git a/news/12119.bugfix.rst b/news/12119.bugfix.rst
+new file mode 100644
+index 0000000..da8d8b0
+--- /dev/null
++++ b/news/12119.bugfix.rst
+@@ -0,0 +1,3 @@
++Pass the ``-r`` flag to mercurial to be explicit that a revision is passed and protect
++against ``hg`` options injection as part of VCS URLs. Users that do not have control on
++VCS URLs passed to pip are advised to upgrade.
+diff --git a/src/pip/_internal/vcs/mercurial.py b/src/pip/_internal/vcs/mercurial.py
+index 2a005e0..4595960 100644
+--- a/src/pip/_internal/vcs/mercurial.py
++++ b/src/pip/_internal/vcs/mercurial.py
+@@ -31,7 +31,7 @@ class Mercurial(VersionControl):
+ 
+     @staticmethod
+     def get_base_rev_args(rev: str) -> List[str]:
+-        return [rev]
++        return ["-r", rev]
+ 
+     def fetch_new(
+         self, dest: str, url: HiddenText, rev_options: RevOptions, verbosity: int
+diff --git a/tests/unit/test_vcs.py b/tests/unit/test_vcs.py
+index 566c88c..38daaa0 100644
+--- a/tests/unit/test_vcs.py
++++ b/tests/unit/test_vcs.py
+@@ -66,7 +66,7 @@ def test_rev_options_repr() -> None:
+         # First check VCS-specific RevOptions behavior.
+         (Bazaar, [], ["-r", "123"], {}),
+         (Git, ["HEAD"], ["123"], {}),
+-        (Mercurial, [], ["123"], {}),
++        (Mercurial, [], ["-r", "123"], {}),
+         (Subversion, [], ["-r", "123"], {}),
+         # Test extra_args.  For this, test using a single VersionControl class.
+         (
+-- 
+2.44.0
+
+
+From 29f1379a6ebcf48dae94d4446c568edac6a86372 Mon Sep 17 00:00:00 2001
+From: Pradyun Gedam <pradyunsg@users.noreply.github.com>
+Date: Sun, 1 Oct 2023 14:10:25 +0100
+Subject: [PATCH 2/4] Use `-r=...` instead of `-r ...` for hg
+
+This ensures that the resulting revision can not be misinterpreted as an
+option.
+---
+ src/pip/_internal/vcs/mercurial.py | 2 +-
+ tests/unit/test_vcs.py             | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/pip/_internal/vcs/mercurial.py b/src/pip/_internal/vcs/mercurial.py
+index 4595960..e440c12 100644
+--- a/src/pip/_internal/vcs/mercurial.py
++++ b/src/pip/_internal/vcs/mercurial.py
+@@ -31,7 +31,7 @@ class Mercurial(VersionControl):
+ 
+     @staticmethod
+     def get_base_rev_args(rev: str) -> List[str]:
+-        return ["-r", rev]
++        return [f"-r={rev}"]
+ 
+     def fetch_new(
+         self, dest: str, url: HiddenText, rev_options: RevOptions, verbosity: int
+diff --git a/tests/unit/test_vcs.py b/tests/unit/test_vcs.py
+index 38daaa0..9afd022 100644
+--- a/tests/unit/test_vcs.py
++++ b/tests/unit/test_vcs.py
+@@ -66,7 +66,7 @@ def test_rev_options_repr() -> None:
+         # First check VCS-specific RevOptions behavior.
+         (Bazaar, [], ["-r", "123"], {}),
+         (Git, ["HEAD"], ["123"], {}),
+-        (Mercurial, [], ["-r", "123"], {}),
++        (Mercurial, [], ["-r=123"], {}),
+         (Subversion, [], ["-r", "123"], {}),
+         # Test extra_args.  For this, test using a single VersionControl class.
+         (
+-- 
+2.44.0
+
+
+From 19db9b777831cb3da519bc84304501b7b9702159 Mon Sep 17 00:00:00 2001
+From: Pradyun Gedam <pradyunsg@users.noreply.github.com>
+Date: Sun, 1 Oct 2023 13:49:06 +0100
+Subject: [PATCH 3/4] newspaper:
+
+---
+ news/12306.bugfix.rst | 1 +
+ 1 file changed, 1 insertion(+)
+ create mode 100644 news/12306.bugfix.rst
+
+diff --git a/news/12306.bugfix.rst b/news/12306.bugfix.rst
+new file mode 100644
+index 0000000..eb6eeca
+--- /dev/null
++++ b/news/12306.bugfix.rst
+@@ -0,0 +1 @@
++Use ``-r=...`` instead of ``-r ...`` to specify references with Mercurial.
+-- 
+2.44.0
+
+
+From 259d59335885077c1e1adbed02986734e2823f27 Mon Sep 17 00:00:00 2001
+From: efflamlemaillet <6533295+efflamlemaillet@users.noreply.github.com>
+Date: Fri, 27 Oct 2023 11:08:17 +0200
+Subject: [PATCH 4/4] Fix hg: "parse error at 0: not a prefix:" (#12373)
+
+Use two hypen argument `--rev=` instead of `-r=`
+
+Co-authored-by: Efflam Lemaillet <elemaillet@logilab.fr>
+Co-authored-by: Pradyun Gedam <pradyunsg@gmail.com>
+---
+ news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst | 1 +
+ src/pip/_internal/vcs/mercurial.py                   | 2 +-
+ tests/unit/test_vcs.py                               | 2 +-
+ 3 files changed, 3 insertions(+), 2 deletions(-)
+ create mode 100644 news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst
+
+diff --git a/news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst b/news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst
+new file mode 100644
+index 0000000..76a8e6b
+--- /dev/null
++++ b/news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst
+@@ -0,0 +1 @@
++Fix mercurial revision "parse error": use ``--rev={ref}`` instead of ``-r={ref}``
+diff --git a/src/pip/_internal/vcs/mercurial.py b/src/pip/_internal/vcs/mercurial.py
+index e440c12..c183d41 100644
+--- a/src/pip/_internal/vcs/mercurial.py
++++ b/src/pip/_internal/vcs/mercurial.py
+@@ -31,7 +31,7 @@ class Mercurial(VersionControl):
+ 
+     @staticmethod
+     def get_base_rev_args(rev: str) -> List[str]:
+-        return [f"-r={rev}"]
++        return [f"--rev={rev}"]
+ 
+     def fetch_new(
+         self, dest: str, url: HiddenText, rev_options: RevOptions, verbosity: int
+diff --git a/tests/unit/test_vcs.py b/tests/unit/test_vcs.py
+index 9afd022..8512357 100644
+--- a/tests/unit/test_vcs.py
++++ b/tests/unit/test_vcs.py
+@@ -66,7 +66,7 @@ def test_rev_options_repr() -> None:
+         # First check VCS-specific RevOptions behavior.
+         (Bazaar, [], ["-r", "123"], {}),
+         (Git, ["HEAD"], ["123"], {}),
+-        (Mercurial, [], ["-r=123"], {}),
++        (Mercurial, [], ["--rev=123"], {}),
+         (Subversion, [], ["-r", "123"], {}),
+         # Test extra_args.  For this, test using a single VersionControl class.
+         (
+-- 
+2.44.0
+

Support-passing-the-same-key-multiple-times-in-confi.patch

@@ -0,0 +1,76 @@
+From d498b3997167865a42f4c663eac518cae3a0daeb Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Filipe=20La=C3=ADns?= <lains@riseup.net>
+Date: Fri, 17 Mar 2023 21:23:19 +0000
+Subject: [PATCH] Support passing the same key multiple times in
+ --config-settings (#11853)
+
+(cherry picked from commit 1268487cbab1b2ffab881b5961c0476e655b6c88)
+---
+ news/11681.feature.rst              |  4 ++++
+ src/pip/_internal/cli/cmdoptions.py |  8 +++++++-
+ tests/unit/test_pyproject_config.py | 15 ++++++++++++---
+ 3 files changed, 23 insertions(+), 4 deletions(-)
+ create mode 100644 news/11681.feature.rst
+
+diff --git a/news/11681.feature.rst b/news/11681.feature.rst
+new file mode 100644
+index 000000000..a0d918b19
+--- /dev/null
++++ b/news/11681.feature.rst
+@@ -0,0 +1,4 @@
++The ``--config-settings``/``-C`` option now supports using the same key multiple
++times. When the same key is specified multiple times, all values are passed to
++the build backend as a list, as opposed to the previous behavior where pip would
++only pass the last value is the same key was used multiple times.
+diff --git a/src/pip/_internal/cli/cmdoptions.py b/src/pip/_internal/cli/cmdoptions.py
+index b4e2560de..4179f98a5 100644
+--- a/src/pip/_internal/cli/cmdoptions.py
++++ b/src/pip/_internal/cli/cmdoptions.py
+@@ -803,7 +803,13 @@ def _handle_config_settings(
+     if dest is None:
+         dest = {}
+         setattr(parser.values, option.dest, dest)
+-    dest[key] = val
++    if key in dest:
++        if isinstance(dest[key], list):
++            dest[key].append(val)
++        else:
++            dest[key] = [dest[key], val]
++    else:
++        dest[key] = val
+ 
+ 
+ config_settings: Callable[..., Option] = partial(
+diff --git a/tests/unit/test_pyproject_config.py b/tests/unit/test_pyproject_config.py
+index 9937f3880..c7e469560 100644
+--- a/tests/unit/test_pyproject_config.py
++++ b/tests/unit/test_pyproject_config.py
+@@ -1,3 +1,5 @@
++from typing import Dict, List
++
+ import pytest
+ 
+ from pip._internal.commands import create_command
+@@ -36,9 +38,16 @@ def test_set_config_empty_value() -> None:
+     assert options.config_settings == {"x": ""}
+ 
+ 
+-def test_replace_config_value() -> None:
++@pytest.mark.parametrize(
++    ("passed", "expected"),
++    [
++        (["x=hello", "x=world"], {"x": ["hello", "world"]}),
++        (["x=hello", "x=world", "x=other"], {"x": ["hello", "world", "other"]}),
++    ],
++)
++def test_multiple_config_values(passed: List[str], expected: Dict[str, str]) -> None:
+     i = create_command("install")
+     options, _ = i.parse_args(
+-        ["xxx", "--config-settings", "x=hello", "--config-settings", "x=world"]
++        ["xxx", *(f"--config-settings={option}" for option in passed)]
+     )
+-    assert options.config_settings == {"x": "world"}
++    assert options.config_settings == expected
+-- 
+2.40.1
+

python-pip.spec

@@ -21,7 +21,7 @@
 
 Name:           python-%{srcname}
 Version:        %{base_version}%{?prerel:~%{prerel}}
-Release:        2%{?dist}
+Release:        4%{?dist}
 Summary:        A tool for installing and managing Python packages
 
 # We bundle a lot of libraries with pip, which itself is under MIT license.
@@ -90,6 +90,21 @@ Patch:          nowarn-pip._internal.main.patch
 # Upstream issue: https://github.com/pypa/packaging/issues/368
 Patch:          no-version-warning.patch
 
+# Support passing the same key multiple times in --config-settings
+# This is needed for pyproject-rpm-macros to have consistent behavior across
+# Fedora releases.
+# Based on:
+#   https://github.com/pypa/pip/commit/1268487cbab1b2ffab881b5961c0476e655b6c88
+Patch:          Support-passing-the-same-key-multiple-times-in-confi.patch
+
+# Security fix for CVE-2023-5752:
+# Mercurial configuration injectable in repo revision when installing via pip
+# Resolved upstream:
+# https://github.com/pypa/pip/commit/4145168d68884a6ec10948dd28b1a6f54f17e63b
+# https://github.com/pypa/pip/commit/1082eb12622b20d101d2864111dd9a591dd6c2f5
+# https://github.com/pypa/pip/commit/6dbd9c68f085c5bf304247bf7c7933842092efb2
+Patch:          CVE-2023-5752.patch
+
 # Downstream only patch
 # Users might have local installations of pip from using
 # `pip install --user --upgrade pip` on older/newer versions.
@@ -390,6 +405,13 @@ pytest_k='not completion'
 %{python_wheel_dir}/%{python_wheel_name}
 
 %changelog
+* Wed Apr 17 2024 Charalampos Stratakis <cstratak@redhat.com> - 22.3.1-4
+- Security fix for CVE-2023-5752
+Resolves: rhbz#2263291
+
+* Tue May 30 2023 Maxwell G <maxwell@gtmx.me> - 22.3.1-3
+- Backport patch to support passing the same key multiple times in --config-settings
+
 * Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 22.3.1-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild