From 3149b6ff316e2c015acc708fc06bdc4ddc02af8e Mon Sep 17 00:00:00 2001 From: Jonas Heinrich Date: Thu, 1 Sep 2022 14:38:28 +0200 Subject: [PATCH 1/3] python310Packages.sanic: 22.3.2 -> 22.6.2 --- .../sanic/22.3.2-CVE-2022-35920.patch | 141 ------------------ .../python-modules/sanic/default.nix | 23 +-- 2 files changed, 7 insertions(+), 157 deletions(-) delete mode 100644 pkgs/development/python-modules/sanic/22.3.2-CVE-2022-35920.patch diff --git a/pkgs/development/python-modules/sanic/22.3.2-CVE-2022-35920.patch b/pkgs/development/python-modules/sanic/22.3.2-CVE-2022-35920.patch deleted file mode 100644 index 694c69602c12..000000000000 --- a/pkgs/development/python-modules/sanic/22.3.2-CVE-2022-35920.patch +++ /dev/null @@ -1,141 +0,0 @@ -Based on upstream 9d415e4ec63d31b3749fd540e2c2ac7c98dedcdd and -2fa28f1711a8e59c6f4d3468e9c2f8b6991188a2, adjusted to apply to -v22.3.2, raise the same exception as before and not remove any -imports. - -diff --git a/sanic/mixins/routes.py b/sanic/mixins/routes.py -index 9e2cf96..e0cf86b 100644 ---- a/sanic/mixins/routes.py -+++ b/sanic/mixins/routes.py -@@ -3,7 +3,7 @@ from contextlib import suppress - from functools import partial, wraps - from inspect import getsource, signature - from mimetypes import guess_type --from os import path -+from os import path, sep - from pathlib import PurePath - from re import sub - from textwrap import dedent -@@ -775,23 +775,23 @@ class RouteMixin(metaclass=SanicMeta): - content_type=None, - __file_uri__=None, - ): -- # Using this to determine if the URL is trying to break out of the path -- # served. os.path.realpath seems to be very slow -- if __file_uri__ and "../" in __file_uri__: -- raise InvalidUsage("Invalid URL") - # Merge served directory and requested file if provided -- # Strip all / that in the beginning of the URL to help prevent python -- # from herping a derp and treating the uri as an absolute path -- root_path = file_path = file_or_directory -+ root_path = file_path = path.abspath(unquote(file_or_directory)) -+ - if __file_uri__: -- file_path = path.join( -- file_or_directory, sub("^[/]*", "", __file_uri__) -- ) -+ # Strip all / that in the beginning of the URL to help prevent -+ # python from herping a derp and treating the uri as an -+ # absolute path -+ unquoted_file_uri = unquote(__file_uri__).lstrip("/") -+ -+ segments = unquoted_file_uri.split("/") -+ if ".." in segments or any(sep in segment for segment in segments): -+ raise InvalidUsage("Invalid URL") -+ -+ file_path = path.join(file_or_directory, unquoted_file_uri) -+ file_path = path.abspath(file_path) - -- # URL decode the path sent by the browser otherwise we won't be able to -- # match filenames which got encoded (filenames with spaces etc) -- file_path = path.abspath(unquote(file_path)) -- if not file_path.startswith(path.abspath(unquote(root_path))): -+ if not file_path.startswith(root_path): - error_logger.exception( - f"File not found: path={file_or_directory}, " - f"relative_url={__file_uri__}" -diff --git a/tests/test_static.py b/tests/test_static.py -index 36a98e1..aeb625b 100644 ---- a/tests/test_static.py -+++ b/tests/test_static.py -@@ -1,6 +1,7 @@ - import inspect - import logging - import os -+import sys - - from collections import Counter - from pathlib import Path -@@ -8,7 +9,7 @@ from time import gmtime, strftime - - import pytest - --from sanic import text -+from sanic import Sanic, text - from sanic.exceptions import FileNotFound - - -@@ -21,6 +22,22 @@ def static_file_directory(): - return static_directory - - -+@pytest.fixture(scope="module") -+def double_dotted_directory_file(static_file_directory: str): -+ """Generate double dotted directory and its files""" -+ if sys.platform == "win32": -+ raise Exception("Windows doesn't support double dotted directories") -+ -+ file_path = Path(static_file_directory) / "dotted.." / "dot.txt" -+ double_dotted_dir = file_path.parent -+ Path.mkdir(double_dotted_dir, exist_ok=True) -+ with open(file_path, "w") as f: -+ f.write("DOT\n") -+ yield file_path -+ Path.unlink(file_path) -+ Path.rmdir(double_dotted_dir) -+ -+ - def get_file_path(static_file_directory, file_name): - return os.path.join(static_file_directory, file_name) - -@@ -578,3 +595,40 @@ def test_resource_type_dir(app, static_file_directory): - def test_resource_type_unknown(app, static_file_directory, caplog): - with pytest.raises(ValueError): - app.static("/static", static_file_directory, resource_type="unknown") -+ -+ -+@pytest.mark.skipif( -+ sys.platform == "win32", -+ reason="Windows does not support double dotted directories", -+) -+def test_dotted_dir_ok( -+ app: Sanic, static_file_directory: str, double_dotted_directory_file: Path -+): -+ app.static("/foo", static_file_directory) -+ dot_relative_path = str( -+ double_dotted_directory_file.relative_to(static_file_directory) -+ ) -+ _, response = app.test_client.get("/foo/" + dot_relative_path) -+ assert response.status == 200 -+ assert response.body == b"DOT\n" -+ -+ -+def test_breakout(app: Sanic, static_file_directory: str): -+ app.static("/foo", static_file_directory) -+ -+ _, response = app.test_client.get("/foo/..%2Fstatic/test.file") -+ assert response.status == 400 -+ -+ -+@pytest.mark.skipif( -+ sys.platform != "win32", reason="Block backslash on Windows only" -+) -+def test_double_backslash_prohibited_on_win32( -+ app: Sanic, static_file_directory: str -+): -+ app.static("/foo", static_file_directory) -+ -+ _, response = app.test_client.get("/foo/static/..\\static/test.file") -+ assert response.status == 400 -+ _, response = app.test_client.get("/foo/static\\../static/test.file") -+ assert response.status == 400 diff --git a/pkgs/development/python-modules/sanic/default.nix b/pkgs/development/python-modules/sanic/default.nix index 3959c3b7bd7b..e1559e1ec432 100644 --- a/pkgs/development/python-modules/sanic/default.nix +++ b/pkgs/development/python-modules/sanic/default.nix @@ -20,11 +20,12 @@ , uvicorn , uvloop , websockets +, aioquic }: buildPythonPackage rec { pname = "sanic"; - version = "22.3.2"; + version = "22.6.2"; format = "setuptools"; disabled = pythonOlder "3.7"; @@ -33,22 +34,12 @@ buildPythonPackage rec { owner = "sanic-org"; repo = pname; rev = "v${version}"; - hash = "sha256-4zdPp3X22dfZ5YlW3G5/OqeUxrt+NiFO9dk2XjEKXEg="; + hash = "sha256-krEQd0ak9Uua+r+pYmLStlizgE4HmZBO8Q0I2/gWAwU="; }; - patches = [ - ./22.3.2-CVE-2022-35920.patch - ]; - - postPatch = '' - # Loosen dependency requirements. - substituteInPlace setup.py \ - --replace "pytest==6.2.5" "pytest" \ - --replace "gunicorn==20.0.4" "gunicorn" - ''; - propagatedBuildInputs = [ aiofiles + aioquic httptools multidict sanic-routing @@ -88,6 +79,8 @@ buildPythonPackage rec { ]; disabledTests = [ + # Require networking + "test_full_message" # Fails to parse cmdline arguments "test_dev" "test_auto_reload" @@ -130,9 +123,7 @@ buildPythonPackage rec { # for the same local port __darwinAllowLocalNetworking = true; - pythonImportsCheck = [ - "sanic" - ]; + pythonImportsCheck = [ "sanic" ]; meta = with lib; { broken = stdenv.isDarwin; From e8995b4f1657beebfc1d06e53d57efafb7277d94 Mon Sep 17 00:00:00 2001 From: Jonas Heinrich Date: Thu, 1 Sep 2022 14:41:52 +0200 Subject: [PATCH 2/3] python310Packages.aioquic: init at 0.9.20 --- .../python-modules/aioquic/default.nix | 38 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 40 insertions(+) create mode 100644 pkgs/development/python-modules/aioquic/default.nix diff --git a/pkgs/development/python-modules/aioquic/default.nix b/pkgs/development/python-modules/aioquic/default.nix new file mode 100644 index 000000000000..9ea35ea2d668 --- /dev/null +++ b/pkgs/development/python-modules/aioquic/default.nix @@ -0,0 +1,38 @@ +{ lib +, fetchPypi +, buildPythonPackage +, openssl +, pylsqpack +, certifi +, pytestCheckHook +, pyopenssl +}: + +buildPythonPackage rec { + pname = "aioquic"; + version = "0.9.20"; + + src = fetchPypi { + inherit pname version; + sha256 = "sha256-7ENqqs6Ze4RrAeUgDtv34+VrkYJqFE77l0j9jd0zK74="; + }; + + propagatedBuildInputs = [ + certifi + pylsqpack + pyopenssl + ]; + + buildInputs = [ openssl ]; + + checkInputs = [ pytestCheckHook ]; + + pythonImportsCheck = [ "aioquic" ]; + + meta = with lib; { + description = "Implementation of QUIC and HTTP/3"; + homepage = "https://github.com/aiortc/aioquic"; + license = licenses.bsd3; + maintainers = with maintainers; [ onny ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 8e01b0f15281..e0b322c2c638 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -410,6 +410,8 @@ in { aioqsw = callPackage ../development/python-modules/aioqsw { }; + aioquic = callPackage ../development/python-modules/aioquic { }; + aiorecollect = callPackage ../development/python-modules/aiorecollect { }; aioredis = callPackage ../development/python-modules/aioredis { }; From 8c000f265156a3c056626c3fe388914aa06ac4be Mon Sep 17 00:00:00 2001 From: Jonas Heinrich Date: Thu, 1 Sep 2022 14:45:35 +0200 Subject: [PATCH 3/3] python310Packages.pysqpack: init at 0.3.16 --- .../python-modules/pylsqpack/default.nix | 26 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 ++ 2 files changed, 28 insertions(+) create mode 100644 pkgs/development/python-modules/pylsqpack/default.nix diff --git a/pkgs/development/python-modules/pylsqpack/default.nix b/pkgs/development/python-modules/pylsqpack/default.nix new file mode 100644 index 000000000000..0fbd7a757c00 --- /dev/null +++ b/pkgs/development/python-modules/pylsqpack/default.nix @@ -0,0 +1,26 @@ +{ lib +, fetchPypi +, buildPythonPackage +, pytestCheckHook +}: + +buildPythonPackage rec { + pname = "pylsqpack"; + version = "0.3.16"; + + src = fetchPypi { + inherit pname version; + sha256 = "sha256-tnps4/aTfYUGgYJ3FL5zCqNhwEnjd1Lj7Z3xHn8jL/s="; + }; + + checkInputs = [ pytestCheckHook ]; + + pythonImportsCheck = [ "pylsqpack" ]; + + meta = with lib; { + description = "Python wrapper for the ls-qpack QPACK library"; + homepage = "https://github.com/aiortc/pylsqpack"; + license = licenses.bsd3; + maintainers = with maintainers; [ onny ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index e0b322c2c638..69cab10e85ea 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -7888,6 +7888,8 @@ in { pylru = callPackage ../development/python-modules/pylru { }; + pylsqpack = callPackage ../development/python-modules/pylsqpack { }; + pyls-black = callPackage ../development/python-modules/pyls-black { }; pyls-flake8 = callPackage ../development/python-modules/pyls-flake8 { };