|
| 1 | +From 28da95e0be5197aa84708aa0696c70c42be80439 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Mayank Singh <mayansingh@microsoft.com> |
| 3 | +Date: Mon, 26 May 2025 06:42:09 +0000 |
| 4 | +Subject: [PATCH] Patch CVE-2025-47273 |
| 5 | + |
| 6 | +Upstream Patch Reference: https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b |
| 7 | +--- |
| 8 | + setuptools/package_index.py | 33 +++++++++++++++++++++++++++++---- |
| 9 | + 1 file changed, 29 insertions(+), 4 deletions(-) |
| 10 | + |
| 11 | +diff --git a/setuptools/package_index.py b/setuptools/package_index.py |
| 12 | +index cf25f83..d8f350e 100644 |
| 13 | +--- a/setuptools/package_index.py |
| 14 | ++++ b/setuptools/package_index.py |
| 15 | +@@ -813,10 +813,25 @@ class PackageIndex(Environment): |
| 16 | + else: |
| 17 | + raise DistutilsError("Download error for %s: %s" % (url, v)) from v |
| 18 | + |
| 19 | +- def _download_url(self, url, tmpdir): |
| 20 | +- # Determine download filename |
| 21 | +- # |
| 22 | +- name, fragment = egg_info_for_url(url) |
| 23 | ++ @staticmethod |
| 24 | ++ def _resolve_download_filename(url, tmpdir): |
| 25 | ++ """ |
| 26 | ++ >>> import pathlib |
| 27 | ++ >>> du = PackageIndex._resolve_download_filename |
| 28 | ++ >>> root = getfixture('tmp_path') |
| 29 | ++ >>> url = 'https://files.pythonhosted.org/packages/a9/5a/0db.../setuptools-78.1.0.tar.gz' |
| 30 | ++ >>> str(pathlib.Path(du(url, root)).relative_to(root)) |
| 31 | ++ 'setuptools-78.1.0.tar.gz' |
| 32 | ++ |
| 33 | ++ Ensures the target is always in tmpdir. |
| 34 | ++ |
| 35 | ++ >>> url = 'https://anyhost/%2fhome%2fuser%2f.ssh%2fauthorized_keys' |
| 36 | ++ >>> du(url, root) |
| 37 | ++ Traceback (most recent call last): |
| 38 | ++ ... |
| 39 | ++ ValueError: Invalid filename... |
| 40 | ++ """ |
| 41 | ++ name, _fragment = egg_info_for_url(url) |
| 42 | + if name: |
| 43 | + while '..' in name: |
| 44 | + name = name.replace('..', '.').replace('\\', '_') |
| 45 | +@@ -828,6 +843,16 @@ class PackageIndex(Environment): |
| 46 | + |
| 47 | + filename = os.path.join(tmpdir, name) |
| 48 | + |
| 49 | ++ # ensure path resolves within the tmpdir |
| 50 | ++ if not filename.startswith(str(tmpdir)): |
| 51 | ++ raise ValueError(f"Invalid filename {filename}") |
| 52 | ++ |
| 53 | ++ return filename |
| 54 | ++ |
| 55 | ++ def _download_url(self, url, tmpdir): |
| 56 | ++ # Determine download filename |
| 57 | ++ # |
| 58 | ++ filename = self._resolve_download_filename(url, tmpdir) |
| 59 | + return self._download_vcs(url, filename) or self._download_other(url, filename) |
| 60 | + |
| 61 | + @staticmethod |
| 62 | +-- |
| 63 | +2.45.3 |
| 64 | + |
0 commit comments