diff --git a/1.26.18.tar.gz b/1.26.18.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..61208b3126ab5c336c508da53aef0b3f3bafe5fb Binary files /dev/null and b/1.26.18.tar.gz differ diff --git a/backport-CVE-2024-37891-Strip-Proxy-Authorization-header-on-redirects.patch b/backport-CVE-2024-37891-Strip-Proxy-Authorization-header-on-redirects.patch new file mode 100644 index 0000000000000000000000000000000000000000..dd9c8f32cc2921503b3fa168b55af638568f2ab6 --- /dev/null +++ b/backport-CVE-2024-37891-Strip-Proxy-Authorization-header-on-redirects.patch @@ -0,0 +1,72 @@ +From accff72ecc2f6cf5a76d9570198a93ac7c90270e Mon Sep 17 00:00:00 2001 +From: Quentin Pradet +Date: Mon, 17 Jun 2024 11:09:06 +0400 +Subject: [PATCH] Merge pull request from GHSA-34jh-p97f-mpxf + +* Strip Proxy-Authorization header on redirects + +* Fix test_retry_default_remove_headers_on_redirect + +* Set release date + +Conflict:test/with_dummyserver/test_poolmanager.py hsa not been modified +because it has been deleted in the pre-phase of the spec file +Reference:https://github.com/urllib3/urllib3/commit/accff72ecc2f6cf5a76d9570198a93ac7c90270e + +--- + CHANGES.rst | 5 +++++ + src/urllib3/util/retry.py | 4 +++- + test/test_retry.py | 6 +++++- + 3 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/CHANGES.rst b/CHANGES.rst +index 3a0a4f0..eba0814 100644 +--- a/CHANGES.rst ++++ b/CHANGES.rst +@@ -1,6 +1,11 @@ + Changes + ======= + ++2.2.2 (2024-06-17) ++================== ++ ++- Added the ``Proxy-Authorization`` header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via ``Retry.remove_headers_on_redirect``. ++ + 1.26.18 (2023-10-17) + -------------------- + +diff --git a/src/urllib3/util/retry.py b/src/urllib3/util/retry.py +index 60ef6c4..9a1e90d 100644 +--- a/src/urllib3/util/retry.py ++++ b/src/urllib3/util/retry.py +@@ -235,7 +235,9 @@ class Retry(object): + RETRY_AFTER_STATUS_CODES = frozenset([413, 429, 503]) + + #: Default headers to be used for ``remove_headers_on_redirect`` +- DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset(["Cookie", "Authorization"]) ++ DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset( ++ ["Cookie", "Authorization", "Proxy-Authorization"] ++ ) + + #: Maximum backoff time. + DEFAULT_BACKOFF_MAX = 120 +diff --git a/test/test_retry.py b/test/test_retry.py +index 6475f2a..a0463e4 100644 +--- a/test/test_retry.py ++++ b/test/test_retry.py +@@ -296,7 +296,11 @@ class TestRetry(object): + def test_retry_default_remove_headers_on_redirect(self): + retry = Retry() + +- assert retry.remove_headers_on_redirect == {"authorization", "cookie"} ++ assert retry.remove_headers_on_redirect == { ++ "authorization", ++ "proxy-authorization", ++ "cookie", ++ } + + def test_retry_set_remove_headers_on_redirect(self): + retry = Retry(remove_headers_on_redirect=["X-API-Secret"]) +-- +2.33.0 + diff --git a/python-urllib3.spec b/python-urllib3.spec index bf9e073df49778d40f241a579cd2cf44211161ac..51d96ce184985cfa85e55c4ff34aa85bb853f2d8 100644 --- a/python-urllib3.spec +++ b/python-urllib3.spec @@ -2,14 +2,18 @@ %bcond_without tests Name: python-%{srcname} -Version: 2.3.0 -Release: 1 +Version: 1.26.18 +Release: 2 Summary: Sanity-friendly HTTP client for Python License: MIT -URL: https://github.com/urllib3/urllib3 -Source0: %{url}/archive/%{version}/%{srcname}-%{version}.tar.gz +URL: https://urllib3.readthedocs.io +Source0: https://github.com/urllib3/urllib3/archive/refs/tags/%{version}.tar.gz Source1: ssl_match_hostname_py3.py +Patch0001: remove_mock.patch + +Patch6000: backport-CVE-2024-37891-Strip-Proxy-Authorization-header-on-redirects.patch + BuildArch: noarch %description @@ -20,28 +24,10 @@ Summary: Python3 HTTP library with thread-safe connection pooling and fil BuildRequires: python3-devel BuildRequires: python3-setuptools -BuildRequires: python3-pip -BuildRequires: python3-wheel -BuildRequires: python3-editables -BuildRequires: python3-hatch-vcs -BuildRequires: python3-hatchling %if %{with tests} -BuildRequires: python3-pytest -BuildRequires: python3-pytest-timeout -BuildRequires: python3-pytest-sugar -BuildRequires: python3-coverage -BuildRequires: python3-h2 -BuildRequires: python3-pysocks -BuildRequires: python3-pyOpenSSL -BuildRequires: python3-idna -BuildRequires: python3-trustme -BuildRequires: python3-cryptography -BuildRequires: python3-trio -BuildRequires: python3-quart -BuildRequires: python3-quart-trio -BuildRequires: python3-hypercorn -BuildRequires: python3-httpx +BuildRequires: python3-cryptography python3-mock python3-six python-idna python-dateutil +BuildRequires: python3-pysocks python3-pytest python3-tornado python-trustme %endif Requires: ca-certificates python3-idna python3-six python3-pysocks @@ -62,18 +48,16 @@ rm -rf test/contrib/ rm -rf test/test_no_ssl.py %build -export SETUPTOOLS_SCM_PRETEND_VERSION='%{version}' -%pyproject_build +%py3_build %install -%pyproject_install +%py3_install rm -rf %{buildroot}%{python3_sitelib}/urllib3/packages/six.py rm -rf %{buildroot}%{python3_sitelib}/urllib3/packages/__pycache__/six.* rm -rf %{buildroot}%{python3_sitelib}/urllib3/packages/ssl_match_hostname/ mkdir -p %{buildroot}/%{python3_sitelib}/urllib3/packages/ -mkdir -p %{buildroot}/%{python3_sitelib}/urllib3/packages/__pycache__/ cp -a %{SOURCE1} %{buildroot}/%{python3_sitelib}/urllib3/packages/ssl_match_hostname.py ln -s %{python3_sitelib}/six.py %{buildroot}/%{python3_sitelib}/urllib3/packages/six.py ln -s %{python3_sitelib}/__pycache__/six.cpython-%{python3_version_nodots}.opt-1.pyc %{buildroot}/%{python3_sitelib}/urllib3/packages/__pycache__/ @@ -89,19 +73,11 @@ PYTHONPATH=%{buildroot}%{python3_sitelib}:%{python3_sitelib} %{__python3} -m pyt %files -n python3-urllib3 %defattr(-,root,root) %license LICENSE.txt -%doc CHANGES.rst README.md +%doc CHANGES.rst README.rst %{python3_sitelib}/urllib3/ -%{python3_sitelib}/urllib3-*.dist-info +%{python3_sitelib}/urllib3-*.egg-info %changelog -* Wed Feb 26 2025 Dongxing Wang - 2.3.0-1 -- Update to 2.3.0 - Added the proxy_is_tunneling property to HTTPConnection and HTTPSConnection - Added pickling support to NewConnectionError and NameResolutionError - Added support for JavaScript Promise Integration on Emscripten - Added HTTPResponse.shutdown() to stop any ongoing or future reads for a specific response - Fixed an issue in debug logs where the HTTP version was rendering as "HTTP/11" instead of "HTTP/1.1" - * Tue Jun 25 2024 chengyechun - 1.26.18-2 - Type:CVE - CVE:CVE-2024-37891 diff --git a/remove_mock.patch b/remove_mock.patch new file mode 100644 index 0000000000000000000000000000000000000000..ab16381db82d2b0d81d35c899d407f5b1febf92c --- /dev/null +++ b/remove_mock.patch @@ -0,0 +1,251 @@ +Index: urllib3-1.26.3/docs/conf.py +=================================================================== +--- urllib3-1.26.3.orig/docs/conf.py ++++ urllib3-1.26.3/docs/conf.py +@@ -14,7 +14,10 @@ sys.path.insert(0, root_path) + # Mock some expensive/platform-specific modules so build will work. + # (https://read-the-docs.readthedocs.io/en/latest/faq.html#\ + # i-get-import-errors-on-libraries-that-depend-on-c-modules) +-import mock ++try: ++ import unittest.mock as mock ++except ImportError: ++ import mock + + + class MockModule(mock.Mock): +Index: urllib3-1.26.3/test/appengine/test_urlfetch.py +=================================================================== +--- urllib3-1.26.3.orig/test/appengine/test_urlfetch.py ++++ urllib3-1.26.3/test/appengine/test_urlfetch.py +@@ -5,7 +5,10 @@ Engine-patched version of httplib to mak + import httplib + import pytest + import StringIO +-from mock import patch ++try: ++ from unittest.mock import patch ++except ImportError: ++ from mock import patch + + from ..test_no_ssl import TestWithoutSSL + +Index: urllib3-1.26.3/test/contrib/test_pyopenssl.py +=================================================================== +--- urllib3-1.26.3.orig/test/contrib/test_pyopenssl.py ++++ urllib3-1.26.3/test/contrib/test_pyopenssl.py +@@ -1,7 +1,10 @@ + # -*- coding: utf-8 -*- + import os + +-import mock ++try: ++ import unittest.mock as mock ++except ImportError: ++ import mock + import pytest + + try: +Index: urllib3-1.26.3/test/contrib/test_pyopenssl_dependencies.py +=================================================================== +--- urllib3-1.26.3.orig/test/contrib/test_pyopenssl_dependencies.py ++++ urllib3-1.26.3/test/contrib/test_pyopenssl_dependencies.py +@@ -1,6 +1,9 @@ + # -*- coding: utf-8 -*- + import pytest +-from mock import Mock, patch ++try: ++ from unittest.mock import Mock, patch ++except ImportError: ++ from mock import Mock, patch + + try: + from urllib3.contrib.pyopenssl import extract_from_urllib3, inject_into_urllib3 +Index: urllib3-1.26.3/test/test_connection.py +=================================================================== +--- urllib3-1.26.3.orig/test/test_connection.py ++++ urllib3-1.26.3/test/test_connection.py +@@ -1,6 +1,9 @@ + import datetime + +-import mock ++try: ++ import unittest.mock as mock ++except ImportError: ++ import mock + import pytest + + from urllib3.connection import RECENT_DATE, CertificateError, _match_hostname +Index: urllib3-1.26.3/test/test_connectionpool.py +=================================================================== +--- urllib3-1.26.3.orig/test/test_connectionpool.py ++++ urllib3-1.26.3/test/test_connectionpool.py +@@ -6,7 +6,10 @@ from ssl import SSLError as BaseSSLError + from test import SHORT_TIMEOUT + + import pytest +-from mock import Mock ++try: ++ from unittest.mock import Mock ++except ImportError: ++ from mock import Mock + + from dummyserver.server import DEFAULT_CA + from urllib3._collections import HTTPHeaderDict +Index: urllib3-1.26.3/test/test_queue_monkeypatch.py +=================================================================== +--- urllib3-1.26.3.orig/test/test_queue_monkeypatch.py ++++ urllib3-1.26.3/test/test_queue_monkeypatch.py +@@ -1,6 +1,9 @@ + from __future__ import absolute_import + +-import mock ++try: ++ import unittest.mock as mock ++except ImportError: ++ import mock + import pytest + + from urllib3 import HTTPConnectionPool +Index: urllib3-1.26.3/test/test_response.py +=================================================================== +--- urllib3-1.26.3.orig/test/test_response.py ++++ urllib3-1.26.3/test/test_response.py +@@ -9,7 +9,10 @@ from base64 import b64decode + from io import BufferedReader, BytesIO, TextIOWrapper + from test import onlyBrotlipy + +-import mock ++try: ++ import unittest.mock as mock ++except ImportError: ++ import mock + import pytest + import six + +Index: urllib3-1.26.3/test/test_retry.py +=================================================================== +--- urllib3-1.26.3.orig/test/test_retry.py ++++ urllib3-1.26.3/test/test_retry.py +@@ -1,6 +1,9 @@ + import warnings + +-import mock ++try: ++ import unittest.mock as mock ++except ImportError: ++ import mock + import pytest + + from urllib3.exceptions import ( +Index: urllib3-1.26.3/test/test_retry_deprecated.py +=================================================================== +--- urllib3-1.26.3.orig/test/test_retry_deprecated.py ++++ urllib3-1.26.3/test/test_retry_deprecated.py +@@ -1,7 +1,10 @@ + # This is a copy-paste of test_retry.py with extra asserts about deprecated options. It will be removed for v2. + import warnings + +-import mock ++try: ++ import unittest.mock as mock ++except ImportError: ++ import mock + import pytest + + from urllib3.exceptions import ( +Index: urllib3-1.26.3/test/test_ssl.py +=================================================================== +--- urllib3-1.26.3.orig/test/test_ssl.py ++++ urllib3-1.26.3/test/test_ssl.py +@@ -1,6 +1,9 @@ + from test import notPyPy2 + +-import mock ++try: ++ import unittest.mock as mock ++except ImportError: ++ import mock + import pytest + + from urllib3.exceptions import SNIMissingWarning +Index: urllib3-1.26.3/test/test_ssltransport.py +=================================================================== +--- urllib3-1.26.3.orig/test/test_ssltransport.py ++++ urllib3-1.26.3/test/test_ssltransport.py +@@ -4,7 +4,10 @@ import socket + import ssl + import sys + +-import mock ++try: ++ import unittest.mock as mock ++except ImportError: ++ import mock + import pytest + + from dummyserver.server import DEFAULT_CA, DEFAULT_CERTS +Index: urllib3-1.26.3/test/test_util.py +=================================================================== +--- urllib3-1.26.3.orig/test/test_util.py ++++ urllib3-1.26.3/test/test_util.py +@@ -9,7 +9,10 @@ from itertools import chain + from test import notBrotlipy, onlyBrotlipy, onlyPy2, onlyPy3 + + import pytest +-from mock import Mock, patch ++try: ++ from unittest.mock import Mock, patch ++except ImportError: ++ from mock import Mock, patch + + from urllib3 import add_stderr_logger, disable_warnings, util + from urllib3.exceptions import ( +Index: urllib3-1.26.3/test/with_dummyserver/test_connectionpool.py +=================================================================== +--- urllib3-1.26.3.orig/test/with_dummyserver/test_connectionpool.py ++++ urllib3-1.26.3/test/with_dummyserver/test_connectionpool.py +@@ -10,7 +10,10 @@ import warnings + from test import LONG_TIMEOUT, SHORT_TIMEOUT, onlyPy2 + from threading import Event + +-import mock ++try: ++ import unittest.mock as mock ++except ImportError: ++ import mock + import pytest + import six + +Index: urllib3-1.26.3/test/with_dummyserver/test_https.py +=================================================================== +--- urllib3-1.26.3.orig/test/with_dummyserver/test_https.py ++++ urllib3-1.26.3/test/with_dummyserver/test_https.py +@@ -19,7 +19,10 @@ from test import ( + resolvesLocalhostFQDN, + ) + +-import mock ++try: ++ import unittest.mock as mock ++except ImportError: ++ import mock + import pytest + import trustme + +Index: urllib3-1.26.3/test/with_dummyserver/test_socketlevel.py +=================================================================== +--- urllib3-1.26.3.orig/test/with_dummyserver/test_socketlevel.py ++++ urllib3-1.26.3/test/with_dummyserver/test_socketlevel.py +@@ -52,7 +52,10 @@ from test import ( + ) + from threading import Event + +-import mock ++try: ++ import unittest.mock as mock ++except ImportError: ++ import mock + import pytest + import trustme +