|
| 1 | +From a537ec061cdfb9f39ef721111bf6927627fe91ec Mon Sep 17 00:00:00 2001 |
| 2 | +From: Sindhu Karri <lakarri@microsoft.com> |
| 3 | +Date: Mon, 22 Jul 2024 12:23:41 +0000 |
| 4 | +Subject: [PATCH] Fix CVE-2024-6345 in package_index.py |
| 5 | + |
| 6 | +--- |
| 7 | + setuptools/package_index.py | 175 +++++++++++++++++------------------- |
| 8 | + 1 file changed, 83 insertions(+), 92 deletions(-) |
| 9 | + |
| 10 | +diff --git a/setuptools/package_index.py b/setuptools/package_index.py |
| 11 | +index c998160..85d7cfe 100644 |
| 12 | +--- a/setuptools/package_index.py |
| 13 | ++++ b/setuptools/package_index.py |
| 14 | +@@ -812,96 +812,45 @@ class PackageIndex(Environment): |
| 15 | + def _attempt_download(self, url, filename): |
| 16 | + headers = self._download_to(url, filename) |
| 17 | + if 'html' in headers.get('content-type', '').lower(): |
| 18 | +- return self._download_html(url, headers, filename) |
| 19 | ++ return self._invalid_download_html(url, headers, filename) |
| 20 | + else: |
| 21 | + return filename |
| 22 | + |
| 23 | +- def _download_html(self, url, headers, filename): |
| 24 | +- file = open(filename) |
| 25 | +- for line in file: |
| 26 | +- if line.strip(): |
| 27 | +- # Check for a subversion index page |
| 28 | +- if re.search(r'<title>([^- ]+ - )?Revision \d+:', line): |
| 29 | +- # it's a subversion index page: |
| 30 | +- file.close() |
| 31 | +- os.unlink(filename) |
| 32 | +- return self._download_svn(url, filename) |
| 33 | +- break # not an index page |
| 34 | +- file.close() |
| 35 | ++ def _invalid_download_html(self, url, headers, filename): |
| 36 | + os.unlink(filename) |
| 37 | +- raise DistutilsError("Unexpected HTML page found at " + url) |
| 38 | +- |
| 39 | +- def _download_svn(self, url, filename): |
| 40 | +- warnings.warn("SVN download support is deprecated", UserWarning) |
| 41 | +- url = url.split('#', 1)[0] # remove any fragment for svn's sake |
| 42 | +- creds = '' |
| 43 | +- if url.lower().startswith('svn:') and '@' in url: |
| 44 | +- scheme, netloc, path, p, q, f = urllib.parse.urlparse(url) |
| 45 | +- if not netloc and path.startswith('//') and '/' in path[2:]: |
| 46 | +- netloc, path = path[2:].split('/', 1) |
| 47 | +- auth, host = _splituser(netloc) |
| 48 | +- if auth: |
| 49 | +- if ':' in auth: |
| 50 | +- user, pw = auth.split(':', 1) |
| 51 | +- creds = " --username=%s --password=%s" % (user, pw) |
| 52 | +- else: |
| 53 | +- creds = " --username=" + auth |
| 54 | +- netloc = host |
| 55 | +- parts = scheme, netloc, url, p, q, f |
| 56 | +- url = urllib.parse.urlunparse(parts) |
| 57 | +- self.info("Doing subversion checkout from %s to %s", url, filename) |
| 58 | +- os.system("svn checkout%s -q %s %s" % (creds, url, filename)) |
| 59 | +- return filename |
| 60 | ++ raise DistutilsError(f"Unexpected HTML page found at {url}") |
| 61 | + |
| 62 | + @staticmethod |
| 63 | +- def _vcs_split_rev_from_url(url, pop_prefix=False): |
| 64 | +- scheme, netloc, path, query, frag = urllib.parse.urlsplit(url) |
| 65 | ++ def _vcs_split_rev_from_url(url): |
| 66 | ++ """ |
| 67 | ++ Given a possible VCS URL, return a clean URL and resolved revision if any. |
| 68 | ++ |
| 69 | ++ >>> vsrfu = PackageIndex._vcs_split_rev_from_url |
| 70 | ++ >>> vsrfu('git+https://github.com/pypa/setuptools@v69.0.0#egg-info=setuptools') |
| 71 | ++ ('https://github.com/pypa/setuptools', 'v69.0.0') |
| 72 | ++ >>> vsrfu('git+https://github.com/pypa/setuptools#egg-info=setuptools') |
| 73 | ++ ('https://github.com/pypa/setuptools', None) |
| 74 | ++ >>> vsrfu('http://foo/bar') |
| 75 | ++ ('http://foo/bar', None) |
| 76 | ++ """ |
| 77 | ++ parts = urllib.parse.urlsplit(url) |
| 78 | + |
| 79 | +- scheme = scheme.split('+', 1)[-1] |
| 80 | ++ clean_scheme = parts.scheme.split('+', 1)[-1] |
| 81 | + |
| 82 | + # Some fragment identification fails |
| 83 | +- path = path.split('#', 1)[0] |
| 84 | +- |
| 85 | +- rev = None |
| 86 | +- if '@' in path: |
| 87 | +- path, rev = path.rsplit('@', 1) |
| 88 | +- |
| 89 | +- # Also, discard fragment |
| 90 | +- url = urllib.parse.urlunsplit((scheme, netloc, path, query, '')) |
| 91 | +- |
| 92 | +- return url, rev |
| 93 | +- |
| 94 | +- def _download_git(self, url, filename): |
| 95 | +- filename = filename.split('#', 1)[0] |
| 96 | +- url, rev = self._vcs_split_rev_from_url(url, pop_prefix=True) |
| 97 | +- |
| 98 | +- self.info("Doing git clone from %s to %s", url, filename) |
| 99 | +- os.system("git clone --quiet %s %s" % (url, filename)) |
| 100 | +- |
| 101 | +- if rev is not None: |
| 102 | +- self.info("Checking out %s", rev) |
| 103 | +- os.system("git -C %s checkout --quiet %s" % ( |
| 104 | +- filename, |
| 105 | +- rev, |
| 106 | +- )) |
| 107 | +- |
| 108 | +- return filename |
| 109 | +- |
| 110 | +- def _download_hg(self, url, filename): |
| 111 | +- filename = filename.split('#', 1)[0] |
| 112 | +- url, rev = self._vcs_split_rev_from_url(url, pop_prefix=True) |
| 113 | ++ no_fragment_path, _, _ = parts.path.partition('#') |
| 114 | + |
| 115 | +- self.info("Doing hg clone from %s to %s", url, filename) |
| 116 | +- os.system("hg clone --quiet %s %s" % (url, filename)) |
| 117 | ++ pre, sep, post = no_fragment_path.rpartition('@') |
| 118 | ++ clean_path, rev = (pre, post) if sep else (post, None) |
| 119 | + |
| 120 | +- if rev is not None: |
| 121 | +- self.info("Updating to %s", rev) |
| 122 | +- os.system("hg --cwd %s up -C -r %s -q" % ( |
| 123 | +- filename, |
| 124 | +- rev, |
| 125 | +- )) |
| 126 | ++ resolved = parts._replace( |
| 127 | ++ scheme=clean_scheme, |
| 128 | ++ path=clean_path, |
| 129 | ++ # discard the fragment |
| 130 | ++ fragment='', |
| 131 | ++ ).geturl() |
| 132 | + |
| 133 | +- return filename |
| 134 | ++ return resolved, rev |
| 135 | + |
| 136 | + def debug(self, msg, *args): |
| 137 | + log.debug(msg, *args) |
0 commit comments