rpms
/
babel
20
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Compare commits

merge into: rpms:c9
Branches Tags
rpms:i10cs
rpms:cs10
rpms:i8c-stream-3.8_bootstrap
rpms:c8-stream-3.8_bootstrap
rpms:i8c-beta-stream-2.7
rpms:c8-beta-stream-2.7
rpms:i8c-stream-3.8
rpms:c8-stream-3.8
rpms:i8c-stream-2.7
rpms:c8-stream-2.7
rpms:i8c
rpms:c8
rpms:i9c
rpms:c9
...
pull from: rpms:c8
Branches Tags
rpms:i10cs
rpms:cs10
rpms:i8c-stream-3.8_bootstrap
rpms:c8-stream-3.8_bootstrap
rpms:i8c-beta-stream-2.7
rpms:c8-beta-stream-2.7
rpms:i8c-stream-3.8
rpms:c8-stream-3.8
rpms:i8c-stream-2.7
rpms:c8-stream-2.7
rpms:i8c
rpms:c8
rpms:i9c
rpms:c9

No commits in common. 'c9' and 'c8' have entirely different histories.
c9 ... c8

5 changed files with 249 additions and 119 deletions
Show Stats

2
.babel.metadata
Unescape View File

@ -1 +1 @@
1ce15f82eba5184cabe6ac1491cb58262e27adfd SOURCES/Babel-2.9.1.tar.gz
9adbd49864392713c6a3080aeb0a9e6432577277 SOURCES/Babel-2.5.1.tar.gz

2
.gitignore vendored
Unescape View File

@ -1 +1 @@
SOURCES/Babel-2.9.1.tar.gz
SOURCES/Babel-2.5.1.tar.gz

128
SOURCES/CVE-2021-20095.patch
Unescape View File

@ -0,0 +1,128 @@
diff --git a/babel/localedata.py b/babel/localedata.py
index 4b6d3b6..080b723 100644
--- a/babel/localedata.py
+++ b/babel/localedata.py
@@ -13,6 +13,8 @@
"""
import os
+import re
+import sys
import threading
from collections import MutableMapping
from itertools import chain
@@ -33,6 +35,7 @@ def get_base_dir():
_cache = {}
_cache_lock = threading.RLock()
_dirname = os.path.join(get_base_dir(), 'locale-data')
+_windows_reserved_name_re = re.compile("^(con|prn|aux|nul|com[0-9]|lpt[0-9])$", re.I)
def normalize_locale(name):
@@ -49,6 +52,22 @@ def normalize_locale(name):
return locale_id
+def resolve_locale_filename(name):
+ """
+ Resolve a locale identifier to a `.dat` path on disk.
+ """
+
+ # Clean up any possible relative paths.
+ name = os.path.basename(name)
+
+ # Ensure we're not left with one of the Windows reserved names.
+ if sys.platform == "win32" and _windows_reserved_name_re.match(os.path.splitext(name)[0]):
+ raise ValueError("Name %s is invalid on Windows" % name)
+
+ # Build the path.
+ return os.path.join(_dirname, '%s.dat' % name)
+
+
def exists(name):
"""Check whether locale data is available for the given locale.
@@ -60,7 +79,7 @@ def exists(name):
return False
if name in _cache:
return True
- file_found = os.path.exists(os.path.join(_dirname, '%s.dat' % name))
+ file_found = os.path.exists(resolve_locale_filename(name))
return True if file_found else bool(normalize_locale(name))
@@ -102,6 +121,7 @@ def load(name, merge_inherited=True):
:raise `IOError`: if no locale data file is found for the given locale
identifer, or one of the locales it inherits from
"""
+ name = os.path.basename(name)
_cache_lock.acquire()
try:
data = _cache.get(name)
@@ -119,7 +139,7 @@ def load(name, merge_inherited=True):
else:
parent = '_'.join(parts[:-1])
data = load(parent).copy()
- filename = os.path.join(_dirname, '%s.dat' % name)
+ filename = resolve_locale_filename(name)
with open(filename, 'rb') as fileobj:
if name != 'root' and merge_inherited:
merge(data, pickle.load(fileobj))
diff --git a/tests/test_localedata.py b/tests/test_localedata.py
index 3599b21..173e7a3 100644
--- a/tests/test_localedata.py
+++ b/tests/test_localedata.py
@@ -11,12 +11,18 @@
# individuals. For the exact contribution history, see the revision
# history and logs, available at http://babel.edgewall.org/log/.
+import os
+import pickle
+import sys
+import tempfile
import unittest
import random
from operator import methodcaller
import sys
-from babel import localedata, numbers
+import pytest
+
+from babel import localedata, Locale, UnknownLocaleError, numbers
class MergeResolveTestCase(unittest.TestCase):
@@ -117,3 +123,33 @@ def test_locale_argument_acceptance():
assert normalized_locale == None
locale_exist = localedata.exists(['en_us', None])
assert locale_exist == False
+
+def test_locale_name_cleanup():
+ """
+ Test that locale identifiers are cleaned up to avoid directory traversal.
+ """
+ no_exist_name = os.path.join(tempfile.gettempdir(), "babel%d.dat" % random.randint(1, 99999))
+ with open(no_exist_name, "wb") as f:
+ pickle.dump({}, f)
+
+ try:
+ name = os.path.splitext(os.path.relpath(no_exist_name, localedata._dirname))[0]
+ except ValueError:
+ if sys.platform == "win32":
+ pytest.skip("unable to form relpath")
+ raise
+
+ assert not localedata.exists(name)
+ with pytest.raises(IOError):
+ localedata.load(name)
+ with pytest.raises(UnknownLocaleError):
+ Locale(name)
+
+
+@pytest.mark.skipif(sys.platform != "win32", reason="windows-only test")
+def test_reserved_locale_names():
+ for name in ("con", "aux", "nul", "prn", "com8", "lpt5"):
+ with pytest.raises(ValueError):
+ localedata.load(name)
+ with pytest.raises(ValueError):
+ Locale(name)

15
SOURCES/babel-2.3.4-remove-pytz-version.patch
Unescape View File

@ -0,0 +1,15 @@
diff -up Babel-2.3.4/setup.py.orig Babel-2.3.4/setup.py
--- Babel-2.3.4/setup.py.orig 2016-04-11 11:58:25.000000000 +0200
+++ Babel-2.3.4/setup.py 2016-04-25 13:35:54.458765892 +0200
@@ -59,7 +59,10 @@ setup(
# This version identifier is currently necessary as
# pytz otherwise does not install on pip 1.4 or
# higher.
- 'pytz>=0a',
+ ### But the version confuses setuptools 8 and higher so remove it in the
+ ### system package
+ #'pytz>=0a',
+ 'pytz',
],
cmdclass={'import_cldr': import_cldr},

221
SPECS/babel.spec
Unescape View File

@ -1,25 +1,47 @@
%global srcname Babel
%global sum Library for internationalizing Python applications
# On fedora 24 and beyond we want to use the python3 version by default
# (Only reason earlier versions aren't switched is that we didn't push it out
# before the release)
%if 0%{?fedora} >= 24 || 0%{?rhel} > 7
%global default_python 3
%else
%global default_python 2
%endif
# There is some bootstrapping involved when upgrading Python 3
# First of all we need babel (this package) to use sphinx
# And pytest is at this point not yet ready
%bcond_with bootstrap
%global bootstrap 0
Name: babel
Version: 2.9.1
Release: 2%{?dist}
Version: 2.5.1
Release: 7%{?dist}
Summary: Tools for internationalizing Python applications
License: BSD
URL: https://babel.pocoo.org/
Source0: %{pypi_source}
URL: http://babel.pocoo.org/
Source0: https://files.pythonhosted.org/packages/source/B/%{srcname}/%{srcname}-%{version}.tar.gz
Patch0: babel-2.3.4-remove-pytz-version.patch
# Fix CVE-2021-20095: relative path traversal allows an attacker to load
# arbitrary locale files on disk and execute arbitrary code
# Resolved upstream: https://github.com/python-babel/babel/pull/782/
# CVE bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1955615
Patch1: CVE-2021-20095.patch
BuildArch: noarch
%if 0%{?rhel} && 0%{?rhel} <= 7
BuildRequires: python2-devel
BuildRequires: python2-setuptools
BuildRequires: python2-pytz
BuildRequires: python2-pytest
%endif
BuildRequires: python3-devel
BuildRequires: python3-setuptools
%if !%{with bootstrap}
BuildRequires: platform-python-setuptools
%if !%{bootstrap}
BuildRequires: python3-pytz
BuildRequires: python3-pytest
%endif
@ -27,11 +49,19 @@ BuildRequires: python3-pytest
# build the documentation
BuildRequires: make
%if !%{with bootstrap}
%if %{default_python} >= 3
%if %{bootstrap}
BuildRequires: python2-sphinx
%else
BuildRequires: python3-sphinx
%endif
Requires: python3-babel
Requires: python3-setuptools
Requires: platform-python-setuptools
%else
BuildRequires: python2-sphinx
Requires: python2-babel
Requires: python2-setuptools
%endif
%description
@ -43,11 +73,27 @@ Babel is composed of two major parts:
providing access to various locale display names, localized number
and date formatting, etc.
%package -n python2-babel
Summary: %sum
Requires: python2-setuptools
Requires: pytz
%{?python_provide:%python_provide python2-babel}
%description -n python2-babel
Babel is composed of two major parts:
* tools to build and work with gettext message catalogs
* a Python interface to the CLDR (Common Locale Data Repository),
providing access to various locale display names, localized number
and date formatting, etc.
%package -n python3-babel
Summary: %sum
Requires: python3-setuptools
Requires: platform-python-setuptools
Requires: python3-pytz
%{?python_provide:%python_provide python3-babel}
@ -61,157 +107,98 @@ Babel is composed of two major parts:
providing access to various locale display names, localized number
and date formatting, etc.
%if !%{with bootstrap}
%package doc
Summary: Documentation for Babel
Provides: python-babel-doc = %{version}-%{release}
Provides: python2-babel-doc = %{version}-%{release}
Provides: python3-babel-doc = %{version}-%{release}
%description doc
Documentation for Babel
%endif
%prep
%autosetup -p1 -n %{srcname}-%{version}
%autosetup -n %{srcname}-%{version} -p1
%build
%if 0%{?rhel} && 0%{?rhel} <= 7
%py2_build
%endif
%py3_build
BUILDDIR="$PWD/built-docs"
rm -rf "$BUILDDIR"
%if !%{with bootstrap}
pushd docs
make \
%if %{default_python} >= 3 && !%{bootstrap}
SPHINXBUILD=sphinx-build-3 \
%else
SPHINXBUILD=sphinx-build \
%endif
BUILDDIR="$BUILDDIR" \
html
popd
rm -f "$BUILDDIR/html/.buildinfo"
%endif
%install
%if %{default_python} >= 3
%if 0%{?rhel} && 0%{?rhel} <= 7
%py2_install
%endif
%py3_install
%else
%py3_install
%py2_install
%endif
%check
export TZ=UTC
%if !%{with bootstrap}
# tests/messages/test_frontend.py and tests/test_dates require freezegun
%{__python3} -m pytest --ignore tests/messages/test_frontend.py --ignore tests/test_dates.py
# test_frontend needs python-freezegun
rm tests/messages/test_frontend.py
export TZ=America/New_York
%if 0%{?rhel} && 0%{?rhel} <= 7
%{__python2} -m pytest
%endif
%if !%{bootstrap}
%{__python3} -m pytest
%endif
%files
%doc CHANGES AUTHORS
%license LICENSE
%{_bindir}/pybabel
%if 0%{?rhel} && 0%{?rhel} <= 7
%files -n python2-babel
%{python2_sitelib}/Babel-%{version}-py*.egg-info
%{python2_sitelib}/babel
%endif
%files -n python3-babel
%{python3_sitelib}/Babel-%{version}-py*.egg-info/
%{python3_sitelib}/babel/
%{_bindir}/pybabel
%{python3_sitelib}/Babel-%{version}-py*.egg-info
%{python3_sitelib}/babel
%if !%{with bootstrap}
%files doc
%doc built-docs/html/*
%endif
%changelog
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 2.9.1-2
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688
* Thu Jul 15 2021 Tomas Orsava <torsava@redhat.com> - 2.5.1-7
- Include the /usr/bin/pybabel binary that runs on Python 3.6 in the
python3-babel package
Resolves: rhbz#1967173
* Fri May 21 2021 Charalampos Stratakis <cstratak@redhat.com> - 2.9.1-1
- Update to 2.9.1.
- Fixes CVE-2021-20095
* Fri May 07 2021 Charalampos Stratakis <cstratak@redhat.com> - 2.5.1-6
- Fix CVE-2021-20095
Resolves: rhbz#1955615
* Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 2.9.0-6
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
* Tue Apr 13 2021 Miro Hrončok <mhroncok@redhat.com> - 2.9.0-5
- Drop build dependency on python-freezegun
- Resolves: rhbz#1947517
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.0-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Mon Dec 21 2020 Miro Hrončok <mhroncok@redhat.com> - 2.9.0-3
- Disable Python 2 build entirely
* Tue Nov 24 2020 Miro Hrončok <mhroncok@redhat.com>
- Disable Python 2 build on RHEL 9+
* Mon Nov 16 22:22:25 CET 2020 Felix Schwarz <fschwarz@fedoraproject.org> - 2.9.0-1
- update to 2.9.0
* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.0-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Sat May 23 2020 Miro Hrončok <mhroncok@redhat.com> - 2.8.0-6
- Rebuilt for Python 3.9
* Fri May 22 2020 Miro Hrončok <mhroncok@redhat.com> - 2.8.0-5
- Bootstrap for Python 3.9
* Fri May 08 2020 Felix Schwarz <fschwarz@fedoraproject.org> - 2.8.0-4
- reenable Python 2 subpackage for Fedora 33+ (rhbz #1737930)
* Tue May 05 2020 Felix Schwarz <fschwarz@fedoraproject.org> - 2.8.0-3
- add patch for compatibility with Python 3.9a6
* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Thu Jan 02 2020 Felix Schwarz <fschwarz@fedoraproject.org> - 2.8.0-1
- update to upstream version 2.8.0
* Thu Oct 31 2019 Nils Philippsen <nils@tiptoe.de> - 2.7.0-7
- drop python2-babel only from F33 on as it is needed for trac (for the time
being, #1737930)
* Thu Oct 31 2019 Nils Philippsen <nils@tiptoe.de> - 2.7.0-6
- drop python2-babel from F32 on
* Fri Sep 13 2019 Miro Hrončok <mhroncok@redhat.com> - 2.7.0-5
- Reduce Python 2 build dependencies on Fedora 32
* Fri Aug 16 2019 Miro Hrončok <mhroncok@redhat.com> - 2.7.0-4
- Rebuilt for Python 3.8
* Thu Aug 15 2019 Miro Hrončok <mhroncok@redhat.com> - 2.7.0-3
- Bootstrap for Python 3.8
* Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Mon May 27 2019 Felix Schwarz <fschwarz@fedoraproject.org> - 2.7.0-1
- update to upstream version 2.7.0
* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.0-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.0-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Mon Jul 02 2018 Miro Hrončok <mhroncok@redhat.com> - 2.6.0-4
- Rebuilt for Python 3.7
* Mon Jul 02 2018 Miro Hrončok <mhroncok@redhat.com> - 2.6.0-3
- Rebuilt for Python 3.7
* Fri Jun 29 2018 Felix Schwarz <fschwarz@fedoraproject.org> - 2.6.0-2
- add setting to build without Python 2 support
* Fri Jun 29 2018 Felix Schwarz <fschwarz@fedoraproject.org> - 2.6.0-1
- update to upstream version 2.6.0
* Mon Jun 18 2018 Tomas Orsava <torsava@redhat.com> - 2.5.1-5
- Run tests in pytest (as declared in BuildRequires)
* Thu Mar 28 2019 Nils Philippsen <nils@redhat.com> - 2.5.1-5
- make spec file work without %%rhel being defined
* Sat Jun 16 2018 Miro Hrončok <mhroncok@redhat.com> - 2.5.1-4
- Rebuilt for Python 3.7
* Tue Mar 26 2019 Nils Philippsen <nils@redhat.com> - 2.5.1-4
- depend on platform-python-setuptools rather than python3-setuptools (#1650487)
* Thu Jun 14 2018 Miro Hrončok <mhroncok@redhat.com> - 2.5.1-3
- Bootstrap for Python 3.7
* Mon Jun 18 2018 Petr Viktorin <pviktori@redhat.com> - 2.5.1-3
- Remove the freezegun dependency
* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.5.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

Write Preview
Loading…
Cancel
Save