From 3d0209a32532ee03beadceab03ec84f2d4138c40 Mon Sep 17 00:00:00 2001
From: markeryang <yanglongkang@h-partners.com>
Date: Wed, 13 Dec 2023 10:53:41 +0800
Subject: [PATCH] Fix vulnerable regex

---
 backport-fix-vulnerable-regex.patch | 25 +++++++++++++++++++++++++
 python-pip.spec                     |  6 +++++-
 2 files changed, 30 insertions(+), 1 deletion(-)
 create mode 100644 backport-fix-vulnerable-regex.patch

diff --git a/backport-fix-vulnerable-regex.patch b/backport-fix-vulnerable-regex.patch
new file mode 100644
index 0000000..c9ec582
--- /dev/null
+++ b/backport-fix-vulnerable-regex.patch
@@ -0,0 +1,25 @@
+From 254e668eef34ca21005634a2bdba9d9a74deaa26 Mon Sep 17 00:00:00 2001
+From: M00nL1ght <69127692+SCH227@users.noreply.github.com>
+Date: Tue, 30 Aug 2022 05:51:29 +0300
+Subject: [PATCH] Fix vulnerable regex
+
+Implement exclusive RE searches to avoid backtracking
+---
+ src/pip/_internal/models/wheel.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/pip/_internal/models/wheel.py b/src/pip/_internal/models/wheel.py
+index 35c70375539..a5dc12bdd63 100644
+--- a/src/pip/_internal/models/wheel.py
++++ b/src/pip/_internal/models/wheel.py
+@@ -13,8 +13,8 @@ class Wheel:
+     """A wheel file"""
+ 
+     wheel_file_re = re.compile(
+-        r"""^(?P<namever>(?P<name>.+?)-(?P<ver>.*?))
+-        ((-(?P<build>\d[^-]*?))?-(?P<pyver>.+?)-(?P<abi>.+?)-(?P<plat>.+?)
++        r"""^(?P<namever>(?P<name>[^\s-]+?)-(?P<ver>[^\s-]*?))
++        ((-(?P<build>\d[^-]*?))?-(?P<pyver>[^\s-]+?)-(?P<abi>[^\s-]+?)-(?P<plat>[^\s-]+?)
+         \.whl|\.dist-info)$""",
+         re.VERBOSE,
+     )
diff --git a/python-pip.spec b/python-pip.spec
index c57bc81..8b08e0b 100644
--- a/python-pip.spec
+++ b/python-pip.spec
@@ -6,7 +6,7 @@ pip is the package installer for Python. You can use pip to install packages fro
 %global bashcompdir %(b=$(pkg-config --variable=completionsdir bash-completion 2>/dev/null); echo ${b:-%{_sysconfdir}/bash_completion.d})
 Name:           python-%{srcname}
 Version:        21.3.1
-Release:        2
+Release:        3
 Summary:        A tool for installing and managing Python packages
 License:        MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD)
 URL:            http://www.pip-installer.org
@@ -16,6 +16,7 @@ Patch1:         allow-stripping-given-prefix-from-wheel-RECORD-files.patch
 Patch2:         emit-a-warning-when-running-with-root-privileges.patch
 Patch3:         remove-existing-dist-only-if-path-conflicts.patch
 Patch6000:      dummy-certifi.patch
+Patch6001:      backport-fix-vulnerable-regex.patch
 
 Source10: 	pip-allow-older-versions.patch
 
@@ -118,6 +119,9 @@ install -p dist/%{python_wheelname} -t %{buildroot}%{python_wheeldir}
 %{python_wheeldir}/%{python_wheelname}
 
 %changelog
+* Wed Dec 13 2023 yanglongkang <yanglongkang@h-partners.com> - 21.3.1-3
+- Fix vulnerable regex
+
 * Fri Jul 01 2022 dongyuzhen <dongyuzhen@h-partners.com> - 21.3.1-2
 - Add patches that are deleted during the upgrade
 
-- 
Gitee