9e12fb0ebe
Fixes the following security issues:
- bpo-37463: ssl.match_hostname() no longer accepts IPv4 addresses with
additional text after the address and only quad-dotted notation without
trailing whitespaces. Some inet_aton() implementations ignore whitespace
and all data after whitespace, e.g. ‘127.0.0.1 whatever’.
- bpo-35907: CVE-2019-9948: Avoid file reading by disallowing local-file://
and local_file:// URL schemes in URLopener().open() and
URLopener().retrieve() of urllib.request.
- bpo-30458: Address CVE-2019-9740 by disallowing URL paths with embedded
whitespace or control characters through into the underlying http client
request. Such potentially malicious header injection URLs now cause an
http.client.InvalidURL exception to be raised.
- bpo-33529: Prevent fold function used in email header encoding from
entering infinite loop when there are too many non-ASCII characters in a
header.
- bpo-35755: shutil.which() now uses os.confstr("CS_PATH") if available and
if the PATH environment variable is not set. Remove also the current
directory from posixpath.defpath. On Unix, shutil.which() and the
subprocess module no longer search the executable in the current directory
if the PATH environment variable is not set.
Also remove the following upstreamed patches:
- 0033-bpo-36742-Fixes-handling-of-pre-normalization-charac.patch
- 0034-bpo-36742-Corrects-fix-to-handle-decomposition-in-us.patch
Signed-off-by: Adam Duskett <Aduskett@gmail.com>
[Peter: mention security fixes]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 906ed044aa)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
100 lines
3.1 KiB
Diff
100 lines
3.1 KiB
Diff
From 18a754e930e03d143d9392e49174cc370b334cdd Mon Sep 17 00:00:00 2001
|
|
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
|
|
Date: Wed, 22 Feb 2017 17:07:56 -0800
|
|
Subject: [PATCH] Add an option to disable pydoc
|
|
|
|
It removes 0.5 MB of data from the target plus the pydoc script
|
|
itself.
|
|
|
|
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
|
|
Signed-off-by: Samuel Martin <s.martin49@gmail.com>
|
|
[ Andrey Smirnov: ported to Python 3.6 ]
|
|
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
|
|
---
|
|
Makefile.pre.in | 8 +++++++-
|
|
configure.ac | 6 ++++++
|
|
setup.py | 9 +++++++--
|
|
3 files changed, 20 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/Makefile.pre.in b/Makefile.pre.in
|
|
index 4110fff4ac..badb2af35d 100644
|
|
--- a/Makefile.pre.in
|
|
+++ b/Makefile.pre.in
|
|
@@ -1231,7 +1231,9 @@ bininstall: altbininstall
|
|
-rm -f $(DESTDIR)$(BINDIR)/idle3
|
|
(cd $(DESTDIR)$(BINDIR); $(LN) -s idle$(VERSION) idle3)
|
|
-rm -f $(DESTDIR)$(BINDIR)/pydoc3
|
|
+ifeq (@PYDOC@,yes)
|
|
(cd $(DESTDIR)$(BINDIR); $(LN) -s pydoc$(VERSION) pydoc3)
|
|
+endif
|
|
-rm -f $(DESTDIR)$(BINDIR)/2to3
|
|
(cd $(DESTDIR)$(BINDIR); $(LN) -s 2to3-$(VERSION) 2to3)
|
|
-rm -f $(DESTDIR)$(BINDIR)/pyvenv
|
|
@@ -1279,7 +1281,7 @@ LIBSUBDIRS= tkinter site-packages \
|
|
multiprocessing multiprocessing/dummy \
|
|
unittest \
|
|
venv venv/scripts venv/scripts/common venv/scripts/posix \
|
|
- curses pydoc_data
|
|
+ curses
|
|
|
|
TESTSUBDIRS= tkinter/test tkinter/test/test_tkinter \
|
|
tkinter/test/test_ttk test \
|
|
@@ -1354,6 +1356,10 @@ ifeq (@TEST_MODULES@,yes)
|
|
LIBSUBDIRS += $(TESTSUBDIRS)
|
|
endif
|
|
|
|
+ifeq (@PYDOC@,yes)
|
|
+LIBSUBDIRS += pydoc_data
|
|
+endif
|
|
+
|
|
libinstall: build_all $(srcdir)/Modules/xxmodule.c
|
|
@for i in $(SCRIPTDIR) $(LIBDEST); \
|
|
do \
|
|
diff --git a/configure.ac b/configure.ac
|
|
index f924937fe1..1621fa1611 100644
|
|
--- a/configure.ac
|
|
+++ b/configure.ac
|
|
@@ -3226,6 +3226,12 @@ if test "$posix_threads" = "yes"; then
|
|
AC_CHECK_FUNCS(pthread_getcpuclockid)
|
|
fi
|
|
|
|
+AC_SUBST(PYDOC)
|
|
+
|
|
+AC_ARG_ENABLE(pydoc,
|
|
+ AS_HELP_STRING([--disable-pydoc], [disable pydoc]),
|
|
+ [ PYDOC="${enableval}" ], [ PYDOC=yes ])
|
|
+
|
|
AC_SUBST(TEST_MODULES)
|
|
|
|
AC_ARG_ENABLE(test-modules,
|
|
diff --git a/setup.py b/setup.py
|
|
index 29bfd174d2..94dd337fef 100644
|
|
--- a/setup.py
|
|
+++ b/setup.py
|
|
@@ -2376,6 +2376,12 @@ def main():
|
|
# turn off warnings when deprecated modules are imported
|
|
import warnings
|
|
warnings.filterwarnings("ignore",category=DeprecationWarning)
|
|
+
|
|
+ scripts = ['Tools/scripts/idle3', 'Tools/scripts/2to3',
|
|
+ 'Lib/smtpd.py']
|
|
+ if not '--disable-pydoc' in sysconfig.get_config_var("CONFIG_ARGS"):
|
|
+ scripts += [ 'Tools/scripts/pydoc3' ]
|
|
+
|
|
setup(# PyPI Metadata (PEP 301)
|
|
name = "Python",
|
|
version = sys.version.split()[0],
|
|
@@ -2400,8 +2406,7 @@ def main():
|
|
# If you change the scripts installed here, you also need to
|
|
# check the PyBuildScripts command above, and change the links
|
|
# created by the bininstall target in Makefile.pre.in
|
|
- scripts = ["Tools/scripts/pydoc3", "Tools/scripts/idle3",
|
|
- "Tools/scripts/2to3", "Tools/scripts/pyvenv"]
|
|
+ scripts = scripts
|
|
)
|
|
|
|
# --install-platlib
|
|
--
|
|
2.13.5
|
|
|