diff --git a/Jinja2-3.1.3.tar.gz b/Jinja2-3.1.3.tar.gz deleted file mode 100644 index a0cc07e3ef9fbd14974b6b6c5dfbd6eccae6bde6..0000000000000000000000000000000000000000 Binary files a/Jinja2-3.1.3.tar.gz and /dev/null differ diff --git a/backport-CVE-2024-34064.patch b/backport-CVE-2024-34064.patch deleted file mode 100644 index b1843a0d1ac1613ba5b2835870c9edc716310bc2..0000000000000000000000000000000000000000 --- a/backport-CVE-2024-34064.patch +++ /dev/null @@ -1,109 +0,0 @@ -From 0668239dc6b44ef38e7a6c9f91f312fd4ca581cb Mon Sep 17 00:00:00 2001 -From: David Lord -Date: Thu, 2 May 2024 09:14:00 -0700 -Subject: [PATCH] disallow invalid characters in keys to xmlattr filter - -Reference:https://github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb -Conflict:NA - ---- - Jinja2-3.1.3/CHANGES.rst | 6 ++++++ - Jinja2-3.1.3/src/jinja2/filters.py | 22 +++++++++++++++++----- - Jinja2-3.1.3/tests/test_filters.py | 11 ++++++----- - 3 files changed, 29 insertions(+), 10 deletions(-) - -diff --git a/Jinja2-3.1.3/CHANGES.rst b/Jinja2-3.1.3/CHANGES.rst -index 08a1785..f70cacb 100644 ---- a/Jinja2-3.1.3/CHANGES.rst -+++ b/Jinja2-3.1.3/CHANGES.rst -@@ -1,5 +1,11 @@ - .. currentmodule:: jinja2 - -+- The ``xmlattr`` filter does not allow keys with ``/`` solidus, ``>`` -+ greater-than sign, or ``=`` equals sign, in addition to disallowing spaces. -+ Regardless of any validation done by Jinja, user input should never be used -+ as keys to this filter, or must be separately validated first. -+ GHSA-h75v-3vvj-5mfj -+ - Version 3.1.3 - ------------- - -diff --git a/Jinja2-3.1.3/src/jinja2/filters.py b/Jinja2-3.1.3/src/jinja2/filters.py -index c7ecc9b..bdf6f22 100644 ---- a/Jinja2-3.1.3/src/jinja2/filters.py -+++ b/Jinja2-3.1.3/src/jinja2/filters.py -@@ -248,7 +248,9 @@ def do_items(value: t.Union[t.Mapping[K, V], Undefined]) -> t.Iterator[t.Tuple[K - yield from value.items() - - --_space_re = re.compile(r"\s", flags=re.ASCII) -+# Check for characters that would move the parser state from key to value. -+# https://html.spec.whatwg.org/#attribute-name-state -+_attr_key_re = re.compile(r"[\s/>=]", flags=re.ASCII) - - - @pass_eval_context -@@ -257,8 +259,14 @@ def do_xmlattr( - ) -> str: - """Create an SGML/XML attribute string based on the items in a dict. - -- If any key contains a space, this fails with a ``ValueError``. Values that -- are neither ``none`` nor ``undefined`` are automatically escaped. -+ **Values** that are neither ``none`` nor ``undefined`` are automatically -+ escaped, safely allowing untrusted user input. -+ -+ User input should not be used as **keys** to this filter. If any key -+ contains a space, ``/`` solidus, ``>`` greater-than sign, or ``=`` equals -+ sign, this fails with a ``ValueError``. Regardless of this, user input -+ should never be used as keys to this filter, or must be separately validated -+ first. - - .. sourcecode:: html+jinja - -@@ -278,6 +286,10 @@ def do_xmlattr( - As you can see it automatically prepends a space in front of the item - if the filter returned something unless the second parameter is false. - -+ .. versionchanged:: 3.1.4 -+ Keys with ``/`` solidus, ``>`` greater-than sign, or ``=`` equals sign -+ are not allowed. -+ - .. versionchanged:: 3.1.3 - Keys with spaces are not allowed. - """ -@@ -287,8 +299,8 @@ def do_xmlattr( - if value is None or isinstance(value, Undefined): - continue - -- if _space_re.search(key) is not None: -- raise ValueError(f"Spaces are not allowed in attributes: '{key}'") -+ if _attr_key_re.search(key) is not None: -+ raise ValueError(f"Invalid character in attribute name: {key!r}") - - items.append(f'{escape(key)}="{escape(value)}"') - -diff --git a/Jinja2-3.1.3/tests/test_filters.py b/Jinja2-3.1.3/tests/test_filters.py -index f50ed13..d8e9114 100644 ---- a/Jinja2-3.1.3/tests/test_filters.py -+++ b/Jinja2-3.1.3/tests/test_filters.py -@@ -474,11 +474,12 @@ class TestFilter: - assert 'bar="23"' in out - assert 'blub:blub="<?>"' in out - -- def test_xmlattr_key_with_spaces(self, env): -- with pytest.raises(ValueError, match="Spaces are not allowed"): -- env.from_string( -- "{{ {'src=1 onerror=alert(1)': 'my_class'}|xmlattr }}" -- ).render() -+ @pytest.mark.parametrize("sep", ("\t", "\n", "\f", " ", "/", ">", "=")) -+ def test_xmlattr_key_invalid(self, env: Environment, sep: str) -> None: -+ with pytest.raises(ValueError, match="Invalid character"): -+ env.from_string("{{ {key: 'my_class'}|xmlattr }}").render( -+ key=f"class{sep}onclick=alert(1)" -+ ) - - def test_sort1(self, env): - tmpl = env.from_string("{{ [2, 3, 1]|sort }}|{{ [2, 3, 1]|sort(true) }}") --- -2.33.0 - diff --git a/jinja2-3.1.4.tar.gz b/jinja2-3.1.4.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..01998bbcc27fb459807e84cb05f23de83b749571 Binary files /dev/null and b/jinja2-3.1.4.tar.gz differ diff --git a/python-jinja2.spec b/python-jinja2.spec index 519e1315370809494524cc72e74b12755951a0b5..597bed28396413a9992bd56fbf4f227bd8b94317 100644 --- a/python-jinja2.spec +++ b/python-jinja2.spec @@ -1,14 +1,13 @@ -%global _name Jinja2 +%global _name jinja2 -Name: python-jinja2 -Version: 3.1.3 -Release: 2 +Name: python-%{_name} +Version: 3.1.4 +Release: 1 Summary: A full-featured template engine for Python License: BSD-3-Clause URL: http://jinja.pocoo.org/ -Source0: https://files.pythonhosted.org/packages/source/J/Jinja2/Jinja2-%{version}.tar.gz +Source0: https://files.pythonhosted.org/packages/source/J/Jinja2/%{_name}-%{version}.tar.gz -Patch1: backport-CVE-2024-34064.patch BuildArch: noarch @@ -32,22 +31,28 @@ This package is the python3 version of python-jinja2. %package_help %prep -%autosetup -c -n Jinja2-%{version} -p1 +%autosetup -c -n %{_name}-%{version} -p1 # fix EOL -sed -i 's|\r$||g' Jinja2-%{version}/LICENSE.rst +sed -i 's|\r$||g' %{_name}-%{version}/LICENSE.txt -cp -a Jinja2-%{version} python3 +%generate_buildrequires + +cp -a %{_name}-%{version} python3 %build -pushd python3 -%py3_build -popd +%pyproject_wheel +%if %{with docs} +make -C docs html PYTHONPATH=$(pwd)/src SPHINXBUILD=sphinx-build-3 +# remove hidden file +rm -rvf docs/_build/html/.buildinfo +%endif + %install -pushd python3 -%py3_install -popd +%pyproject_install +%pyproject_save_files jinja2 + %check pushd python3 @@ -64,6 +69,9 @@ popd %doc Jinja2-%{version}/examples %changelog +* Mon Sep 30 2024 zhangxianting - 3.1.4-1 +- Upgrade package to 3.1.4 + * Fri May 10 2024 weihaohao - 3.1.3-2 - Type:CVE - CVE:CVE-2024-34064