diff --git a/CVE-2024-41810.patch b/CVE-2024-41810.patch deleted file mode 100644 index 9fc130ddd38dc32cf92fae7b7ef54df87d71e3ee..0000000000000000000000000000000000000000 --- a/CVE-2024-41810.patch +++ /dev/null @@ -1,102 +0,0 @@ -From a22866244736345239909eaca7be2eb8da791997 Mon Sep 17 00:00:00 2001 -From: Viktor Chuchurski -Date: Thu, 25 Jul 2024 19:34:35 +0200 -Subject: [PATCH 1/6] - added output encoding in redirect HTML - ---- - src/twisted/web/_template_util.py | 2 +- - src/twisted/web/newsfragments/12263.bugfix | 1 + - src/twisted/web/newsfragments/9839.bugfix | 1 + - src/twisted/web/test/test_util.py | 39 +++++++++++++++++++++- - 4 files changed, 41 insertions(+), 2 deletions(-) - create mode 100644 src/twisted/web/newsfragments/12263.bugfix - create mode 100644 src/twisted/web/newsfragments/9839.bugfix - -diff --git a/src/twisted/web/_template_util.py b/src/twisted/web/_template_util.py -index 38ebbed..c6f7e9d 100644 ---- a/src/twisted/web/_template_util.py -+++ b/src/twisted/web/_template_util.py -@@ -92,7 +92,7 @@ def redirectTo(URL: bytes, request: IRequest) -> bytes: - - - """ % { -- b"url": URL -+ b"url": escape(URL.decode("utf-8")).encode("utf-8") - } - return content - -diff --git a/src/twisted/web/newsfragments/12263.bugfix b/src/twisted/web/newsfragments/12263.bugfix -new file mode 100644 -index 0000000..b3982ca ---- /dev/null -+++ b/src/twisted/web/newsfragments/12263.bugfix -@@ -0,0 +1 @@ -+twisted.web.util.redirectTo now HTML-escapes the provided URL in the fallback response body it returns (GHSA-cf56-g6w6-pqq2). The issue is being tracked with CVE-2024-41810. -\ No newline at end of file -diff --git a/src/twisted/web/newsfragments/9839.bugfix b/src/twisted/web/newsfragments/9839.bugfix -new file mode 100644 -index 0000000..1e2e7f7 ---- /dev/null -+++ b/src/twisted/web/newsfragments/9839.bugfix -@@ -0,0 +1 @@ -+twisted.web.util.redirectTo now HTML-escapes the provided URL in the fallback response body it returns (GHSA-cf56-g6w6-pqq2, CVE-2024-41810). -diff --git a/src/twisted/web/test/test_util.py b/src/twisted/web/test/test_util.py -index 996b0d0..87282ce 100644 ---- a/src/twisted/web/test/test_util.py -+++ b/src/twisted/web/test/test_util.py -@@ -5,7 +5,6 @@ - Tests for L{twisted.web.util}. - """ - -- - import gc - - from twisted.internet import defer -@@ -64,6 +63,44 @@ class RedirectToTests(TestCase): - targetURL = "http://target.example.com/4321" - self.assertRaises(TypeError, redirectTo, targetURL, request) - -+ def test_legitimateRedirect(self): -+ """ -+ Legitimate URLs are fully interpolated in the `redirectTo` response body without transformation -+ """ -+ request = DummyRequest([b""]) -+ html = redirectTo(b"https://twisted.org/", request) -+ expected = b""" -+ -+ -+ -+ -+ -+ click here -+ -+ -+""" -+ self.assertEqual(html, expected) -+ -+ def test_maliciousRedirect(self): -+ """ -+ Malicious URLs are HTML-escaped before interpolating them in the `redirectTo` response body -+ """ -+ request = DummyRequest([b""]) -+ html = redirectTo( -+ b'https://twisted.org/">', request -+ ) -+ expected = b""" -+ -+ -+ -+ -+ -+ click here -+ -+ -+""" -+ self.assertEqual(html, expected) -+ - - class ParentRedirectTests(SynchronousTestCase): - """ --- -2.41.0 - diff --git a/python-twisted.spec b/python-twisted.spec index 6e44225c64e72a7dac9d6bcbf6421e957bbc4555..f9d362ee07e09aeb6ea6d8d3ee818deea4bb650d 100644 --- a/python-twisted.spec +++ b/python-twisted.spec @@ -1,14 +1,12 @@ %define debug_package %{nil} Name: python-twisted -Version: 24.3.0 +Version: 25.5.0 Release: 1 Summary: An event-driven networking engine written in Python License: MIT URL: http://twistedmatrix.com/ Source0: https://github.com/twisted/twisted/archive/twisted-%{version}/twisted-%{version}.tar.gz -Patch0: CVE-2024-41810.patch - BuildRequires: python3-pip python3-hatchling python3-hatch-vcs python3-wheel BuildRequires: python3-hatch-fancy-pypi-readme python3-incremental @@ -113,6 +111,15 @@ PATH=%{buildroot}%{_bindir}:$PATH PYTHONPATH=%{buildroot}%{python3_sitelib} %{bu %{_mandir}/man1/{cftp.1*,ckeygen.1*,conch.1*,mailmail.1*,pyhtmlizer.1*,tkconch.1*,trial.1*,twistd.1*} %changelog +* Wed Aug 06 2025 zhang_wenyu - 25.5.0-1 +- Upgrade version to 25.5.0 + - twisted.trial.unittest.TestCase.deferRunCleanups were removed and + converted to private methods. + - twisted.internet.defer.Deferred.callbacks attribute has been deprecated + - twisted.internet.runner.procmon.ProcessMonitor: startProcess() catches + exceptions raised by reactor.spawnProcess() and attempts to restart + the failed process + * Thu Sep 19 2024 xu_ping <707078654@qq.com> - 24.3.0-1 - Upgrade version to 24.7.0 diff --git a/twisted-24.3.0.tar.gz b/twisted-25.5.0.tar.gz similarity index 33% rename from twisted-24.3.0.tar.gz rename to twisted-25.5.0.tar.gz index 55078ee6afa4f9c3abf7f38553bccafb1b58e7bb..14a7a4194326046ba1b29692da0a02bd5a365460 100644 Binary files a/twisted-24.3.0.tar.gz and b/twisted-25.5.0.tar.gz differ