parent
b518f3e543
commit
43f1f9f9fe
GPG Key ID:
1EC08A25C9DB2503
@ -1 +1 @@
|
|||||||
SOURCES/build-1.2.1.tar.gz
|
SOURCES/build-0.10.0.tar.gz
|
||||||
|
|||||||
@ -1 +1 @@
|
|||||||
decd14db86648aa4a4a37e751fdc403fc7b68447 SOURCES/build-1.2.1.tar.gz
|
09ab6a243772343cb846a833bdc18532b596061f SOURCES/build-0.10.0.tar.gz
|
||||||
|
|||||||
@ -0,0 +1,36 @@
|
|||||||
|
From 4f5362fccc908820574fdbac2f6b6871c0f371c5 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Henry Schreiner <henryschreineriii@gmail.com>
|
||||||
|
Date: Wed, 15 Mar 2023 09:33:53 -0400
|
||||||
|
Subject: [PATCH] tests: strip formatting from stderr (pip 23)
|
||||||
|
|
||||||
|
Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>
|
||||||
|
---
|
||||||
|
tests/test_main.py | 8 ++++++--
|
||||||
|
1 file changed, 6 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/tests/test_main.py b/tests/test_main.py
|
||||||
|
index e924d8bd..456ff749 100644
|
||||||
|
--- a/tests/test_main.py
|
||||||
|
+++ b/tests/test_main.py
|
||||||
|
@@ -20,6 +20,8 @@
|
||||||
|
cwd = os.getcwd()
|
||||||
|
out = os.path.join(cwd, 'dist')
|
||||||
|
|
||||||
|
+ANSI_STRIP = re.compile(r'\x1B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])')
|
||||||
|
+
|
||||||
|
|
||||||
|
@pytest.mark.parametrize(
|
||||||
|
('cli_args', 'build_args', 'hook'),
|
||||||
|
@@ -368,8 +370,10 @@ def test_output_env_subprocess_error(
|
||||||
|
assert stdout[:4] == stdout_body
|
||||||
|
assert stdout[-1].startswith(stdout_error)
|
||||||
|
|
||||||
|
- assert len(stderr) == 1
|
||||||
|
- assert stderr[0].startswith('ERROR: Invalid requirement: ')
|
||||||
|
+ # Newer versions of pip also color stderr - strip them if present
|
||||||
|
+ cleaned_stderr = ANSI_STRIP.sub('', '\n'.join(stderr)).strip()
|
||||||
|
+ assert len(cleaned_stderr.splitlines()) == 1
|
||||||
|
+ assert cleaned_stderr.startswith('ERROR: Invalid requirement: ')
|
||||||
|
|
||||||
|
|
||||||
|
@pytest.mark.parametrize(
|
||||||
@ -0,0 +1,78 @@
|
|||||||
|
From e62a9fbd9ae519d35341dd2e972b43fb1f00b7c7 Mon Sep 17 00:00:00 2001
|
||||||
|
From: layday <layday@protonmail.com>
|
||||||
|
Date: Tue, 13 Jun 2023 12:46:09 +0200
|
||||||
|
Subject: [PATCH] filter out malicious files when extracting tar archives
|
||||||
|
|
||||||
|
---
|
||||||
|
src/build/__main__.py | 5 +++--
|
||||||
|
src/build/util.py | 16 ++++++++++++++++
|
||||||
|
2 files changed, 19 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/src/build/__main__.py b/src/build/__main__.py
|
||||||
|
index 2d65720..914e0d6 100644
|
||||||
|
--- a/src/build/__main__.py
|
||||||
|
+++ b/src/build/__main__.py
|
||||||
|
@@ -9,7 +9,6 @@ import platform
|
||||||
|
import shutil
|
||||||
|
import subprocess
|
||||||
|
import sys
|
||||||
|
-import tarfile
|
||||||
|
import tempfile
|
||||||
|
import textwrap
|
||||||
|
import traceback
|
||||||
|
@@ -228,6 +227,8 @@ def build_package_via_sdist(
|
||||||
|
:param isolation: Isolate the build in a separate environment
|
||||||
|
:param skip_dependency_check: Do not perform the dependency check
|
||||||
|
"""
|
||||||
|
+ from .util import TarFile
|
||||||
|
+
|
||||||
|
if 'sdist' in distributions:
|
||||||
|
raise ValueError('Only binary distributions are allowed but sdist was specified')
|
||||||
|
|
||||||
|
@@ -238,7 +239,7 @@ def build_package_via_sdist(
|
||||||
|
sdist_out = tempfile.mkdtemp(prefix='build-via-sdist-')
|
||||||
|
built: list[str] = []
|
||||||
|
# extract sdist
|
||||||
|
- with tarfile.open(sdist) as t:
|
||||||
|
+ with TarFile.open(sdist) as t:
|
||||||
|
t.extractall(sdist_out)
|
||||||
|
try:
|
||||||
|
builder = _ProjectBuilder(os.path.join(sdist_out, sdist_name[: -len('.tar.gz')]))
|
||||||
|
diff --git a/src/build/util.py b/src/build/util.py
|
||||||
|
index 90c0028..7597667 100644
|
||||||
|
--- a/src/build/util.py
|
||||||
|
+++ b/src/build/util.py
|
||||||
|
@@ -5,7 +5,9 @@ from __future__ import annotations
|
||||||
|
import os
|
||||||
|
import pathlib
|
||||||
|
import sys
|
||||||
|
+import tarfile
|
||||||
|
import tempfile
|
||||||
|
+import typing
|
||||||
|
|
||||||
|
import pyproject_hooks
|
||||||
|
|
||||||
|
@@ -56,6 +58,20 @@ def project_wheel_metadata(
|
||||||
|
return _project_wheel_metadata(builder)
|
||||||
|
|
||||||
|
|
||||||
|
+if typing.TYPE_CHECKING:
|
||||||
|
+ TarFile = tarfile.TarFile
|
||||||
|
+
|
||||||
|
+else:
|
||||||
|
+ # Per https://peps.python.org/pep-0706/, the "data" filter will become
|
||||||
|
+ # the default in Python 3.14.
|
||||||
|
+ if sys.version_info < (3, 14) and hasattr(tarfile, 'data_filter'):
|
||||||
|
+
|
||||||
|
+ class TarFile(tarfile.TarFile):
|
||||||
|
+ extraction_filter = staticmethod(tarfile.data_filter)
|
||||||
|
+
|
||||||
|
+ else:
|
||||||
|
+ TarFile = tarfile.TarFile
|
||||||
|
+
|
||||||
|
__all__ = [
|
||||||
|
'project_wheel_metadata',
|
||||||
|
]
|
||||||
|
--
|
||||||
|
2.40.1
|
||||||
|
|
||||||
Loading…
Reference in new issue