python-pip/CVE-2023-5752.patch
Charalampos Stratakis a80e443694 Security fix for CVE-2023-5752
Resolves: rhbz#2263291
2024-04-17 03:00:52 +02:00

115 lines
4.1 KiB
Diff

From 018b129371db152450cbf1ac7bff401707de94ef Mon Sep 17 00:00:00 2001
From: Pradyun Gedam <pradyunsg@users.noreply.github.com>
Date: Sun, 1 Oct 2023 14:10:25 +0100
Subject: [PATCH 1/3] Use `-r=...` instead of `-r ...` for hg
This ensures that the resulting revision can not be misinterpreted as an
option.
---
src/pip/_internal/vcs/mercurial.py | 2 +-
tests/unit/test_vcs.py | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/pip/_internal/vcs/mercurial.py b/src/pip/_internal/vcs/mercurial.py
index 4595960..e440c12 100644
--- a/src/pip/_internal/vcs/mercurial.py
+++ b/src/pip/_internal/vcs/mercurial.py
@@ -31,7 +31,7 @@ class Mercurial(VersionControl):
@staticmethod
def get_base_rev_args(rev: str) -> List[str]:
- return ["-r", rev]
+ return [f"-r={rev}"]
def fetch_new(
self, dest: str, url: HiddenText, rev_options: RevOptions, verbosity: int
diff --git a/tests/unit/test_vcs.py b/tests/unit/test_vcs.py
index 38daaa0..9afd022 100644
--- a/tests/unit/test_vcs.py
+++ b/tests/unit/test_vcs.py
@@ -66,7 +66,7 @@ def test_rev_options_repr() -> None:
# First check VCS-specific RevOptions behavior.
(Bazaar, [], ["-r", "123"], {}),
(Git, ["HEAD"], ["123"], {}),
- (Mercurial, [], ["-r", "123"], {}),
+ (Mercurial, [], ["-r=123"], {}),
(Subversion, [], ["-r", "123"], {}),
# Test extra_args. For this, test using a single VersionControl class.
(
--
2.44.0
From d5bbf9df3672bc5c4ed4cfddcbf05e9286324443 Mon Sep 17 00:00:00 2001
From: Pradyun Gedam <pradyunsg@users.noreply.github.com>
Date: Sun, 1 Oct 2023 13:49:06 +0100
Subject: [PATCH 2/3] newspaper:
---
news/12306.bugfix.rst | 1 +
1 file changed, 1 insertion(+)
create mode 100644 news/12306.bugfix.rst
diff --git a/news/12306.bugfix.rst b/news/12306.bugfix.rst
new file mode 100644
index 0000000..eb6eeca
--- /dev/null
+++ b/news/12306.bugfix.rst
@@ -0,0 +1 @@
+Use ``-r=...`` instead of ``-r ...`` to specify references with Mercurial.
--
2.44.0
From 27c8f2a8cdaf4580e2b0f3010ebaf0471ccd5197 Mon Sep 17 00:00:00 2001
From: efflamlemaillet <6533295+efflamlemaillet@users.noreply.github.com>
Date: Fri, 27 Oct 2023 11:08:17 +0200
Subject: [PATCH 3/3] Fix hg: "parse error at 0: not a prefix:" (#12373)
Use two hypen argument `--rev=` instead of `-r=`
Co-authored-by: Efflam Lemaillet <elemaillet@logilab.fr>
Co-authored-by: Pradyun Gedam <pradyunsg@gmail.com>
---
news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst | 1 +
src/pip/_internal/vcs/mercurial.py | 2 +-
tests/unit/test_vcs.py | 2 +-
3 files changed, 3 insertions(+), 2 deletions(-)
create mode 100644 news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst
diff --git a/news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst b/news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst
new file mode 100644
index 0000000..76a8e6b
--- /dev/null
+++ b/news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst
@@ -0,0 +1 @@
+Fix mercurial revision "parse error": use ``--rev={ref}`` instead of ``-r={ref}``
diff --git a/src/pip/_internal/vcs/mercurial.py b/src/pip/_internal/vcs/mercurial.py
index e440c12..c183d41 100644
--- a/src/pip/_internal/vcs/mercurial.py
+++ b/src/pip/_internal/vcs/mercurial.py
@@ -31,7 +31,7 @@ class Mercurial(VersionControl):
@staticmethod
def get_base_rev_args(rev: str) -> List[str]:
- return [f"-r={rev}"]
+ return [f"--rev={rev}"]
def fetch_new(
self, dest: str, url: HiddenText, rev_options: RevOptions, verbosity: int
diff --git a/tests/unit/test_vcs.py b/tests/unit/test_vcs.py
index 9afd022..8512357 100644
--- a/tests/unit/test_vcs.py
+++ b/tests/unit/test_vcs.py
@@ -66,7 +66,7 @@ def test_rev_options_repr() -> None:
# First check VCS-specific RevOptions behavior.
(Bazaar, [], ["-r", "123"], {}),
(Git, ["HEAD"], ["123"], {}),
- (Mercurial, [], ["-r=123"], {}),
+ (Mercurial, [], ["--rev=123"], {}),
(Subversion, [], ["-r", "123"], {}),
# Test extra_args. For this, test using a single VersionControl class.
(
--
2.44.0