mirror of
https://git.yoctoproject.org/poky
synced 2026-06-27 20:13:41 +02:00
python3: Fix CVE-2026-4519 and CVE-2026-4786
Apply the upstream v3.12 fix [1], aligned with the original v3.11 fix [2], and follow-up fix [3] to address CVE-2026-4519 by disallowing URLs with leading dashes when invoking browser commands, as referenced in [5]. CVE-2026-4786 [6] revealed the CVE-2026-4519 fix was incomplete, as %action in URLs could bypass dash-prefix checks. Apply follow-up fix [4], noted in [5], to revalidate the URL after %action expansion. [1]cbba611939[2]ceac1efc66[3]96fc504860[4]f4654824ae[5] https://security-tracker.debian.org/tracker/CVE-2026-4519 [6] https://security-tracker.debian.org/tracker/CVE-2026-4786 References: https://nvd.nist.gov/vuln/detail/CVE-2026-4519 https://nvd.nist.gov/vuln/detail/CVE-2026-4786 (From OE-Core rev: e6d81b3be531e97058366c81056a38c0b6fa7380) Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Sudhir Dumbhare
committed by
Paul Barker
Paul Barker
parent
703b680089
commit
1401e6e003
159
meta/recipes-devtools/python/python3/CVE-2026-4519_p2.patch
Normal file
159
meta/recipes-devtools/python/python3/CVE-2026-4519_p2.patch
Normal file
@@ -0,0 +1,159 @@
|
||||
From 3ca64ff1722d2410a4e50e760de70f6279fa99fa Mon Sep 17 00:00:00 2001
|
||||
From: "Miss Islington (bot)"
|
||||
<31488909+miss-islington@users.noreply.github.com>
|
||||
Date: Sat, 4 Apr 2026 00:53:49 +0200
|
||||
Subject: [PATCH] [3.11] gh-143930: Tweak the exception message and
|
||||
increase test coverage (GH-146476) (GH-148045) (GH-148051) (GH-148052)
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
CVE: CVE-2026-4519
|
||||
Upstream-Status: Backport [https://github.com/python/cpython/commit/96fc5048605863c7b6fd6289643feb0e97edd96c]
|
||||
|
||||
Backport Changes:
|
||||
- This file is not present in the current version and is therefore omitted.
|
||||
Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
|
||||
- The file introduced in v3.12 by this commit;
|
||||
https://github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48
|
||||
|
||||
(cherry picked from commit cc023511238ad93ecc8796157c6f9139a2bb2932)
|
||||
(cherry picked from commit 89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4)
|
||||
(cherry picked from commit 3681d47a440865aead912a054d4599087b4270dd)
|
||||
|
||||
Co-authored-by: Łukasz Langa <lukasz@langa.pl>
|
||||
(cherry picked from commit 96fc5048605863c7b6fd6289643feb0e97edd96c)
|
||||
Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
|
||||
---
|
||||
Lib/test/test_webbrowser.py | 81 ++++++++++++++++++++++++++++++++++---
|
||||
Lib/webbrowser.py | 2 +-
|
||||
2 files changed, 76 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/Lib/test/test_webbrowser.py b/Lib/test/test_webbrowser.py
|
||||
index 60f094fd6a1..c9bf525360d 100644
|
||||
--- a/Lib/test/test_webbrowser.py
|
||||
+++ b/Lib/test/test_webbrowser.py
|
||||
@@ -1,6 +1,7 @@
|
||||
+import io
|
||||
+import os
|
||||
import webbrowser
|
||||
import unittest
|
||||
-import os
|
||||
import sys
|
||||
import subprocess
|
||||
from unittest import mock
|
||||
@@ -49,6 +50,14 @@ class CommandTestMixin:
|
||||
popen_args.pop(popen_args.index(option))
|
||||
self.assertEqual(popen_args, arguments)
|
||||
|
||||
+ def test_reject_dash_prefixes(self):
|
||||
+ browser = self.browser_class(name=CMD_NAME)
|
||||
+ with self.assertRaisesRegex(
|
||||
+ ValueError,
|
||||
+ r"^Invalid URL \(leading dash disallowed\): '--key=val http.*'$"
|
||||
+ ):
|
||||
+ browser.open(f"--key=val {URL}")
|
||||
+
|
||||
|
||||
class GenericBrowserCommandTest(CommandTestMixin, unittest.TestCase):
|
||||
|
||||
@@ -59,11 +68,6 @@ class GenericBrowserCommandTest(CommandTestMixin, unittest.TestCase):
|
||||
options=[],
|
||||
arguments=[URL])
|
||||
|
||||
- def test_reject_dash_prefixes(self):
|
||||
- browser = self.browser_class(name=CMD_NAME)
|
||||
- with self.assertRaises(ValueError):
|
||||
- browser.open(f"--key=val {URL}")
|
||||
-
|
||||
|
||||
class BackgroundBrowserCommandTest(CommandTestMixin, unittest.TestCase):
|
||||
|
||||
@@ -224,6 +228,71 @@ class ELinksCommandTest(CommandTestMixin, unittest.TestCase):
|
||||
arguments=['openURL({},new-tab)'.format(URL)])
|
||||
|
||||
|
||||
+class MockPopenPipe:
|
||||
+ def __init__(self, cmd, mode):
|
||||
+ self.cmd = cmd
|
||||
+ self.mode = mode
|
||||
+ self.pipe = io.StringIO()
|
||||
+ self._closed = False
|
||||
+
|
||||
+ def write(self, buf):
|
||||
+ self.pipe.write(buf)
|
||||
+
|
||||
+ def close(self):
|
||||
+ self._closed = True
|
||||
+ return None
|
||||
+
|
||||
+
|
||||
+@unittest.skipUnless(sys.platform == "darwin", "macOS specific test")
|
||||
+class MacOSXOSAScriptTest(unittest.TestCase):
|
||||
+ def setUp(self):
|
||||
+ # Ensure that 'BROWSER' is not set to 'open' or something else.
|
||||
+ # See: https://github.com/python/cpython/issues/131254.
|
||||
+ env = self.enterContext(os_helper.EnvironmentVarGuard())
|
||||
+ env.unset("BROWSER")
|
||||
+
|
||||
+ support.patch(self, os, "popen", self.mock_popen)
|
||||
+ self.browser = webbrowser.MacOSXOSAScript("default")
|
||||
+
|
||||
+ def mock_popen(self, cmd, mode):
|
||||
+ self.popen_pipe = MockPopenPipe(cmd, mode)
|
||||
+ return self.popen_pipe
|
||||
+
|
||||
+ def test_default(self):
|
||||
+ browser = webbrowser.get()
|
||||
+ assert isinstance(browser, webbrowser.MacOSXOSAScript)
|
||||
+ self.assertEqual(browser.name, "default")
|
||||
+
|
||||
+ def test_default_open(self):
|
||||
+ url = "https://python.org"
|
||||
+ self.browser.open(url)
|
||||
+ self.assertTrue(self.popen_pipe._closed)
|
||||
+ self.assertEqual(self.popen_pipe.cmd, "osascript")
|
||||
+ script = self.popen_pipe.pipe.getvalue()
|
||||
+ self.assertEqual(script.strip(), f'open location "{url}"')
|
||||
+
|
||||
+ def test_url_quote(self):
|
||||
+ self.browser.open('https://python.org/"quote"')
|
||||
+ script = self.popen_pipe.pipe.getvalue()
|
||||
+ self.assertEqual(
|
||||
+ script.strip(), 'open location "https://python.org/%22quote%22"'
|
||||
+ )
|
||||
+
|
||||
+ def test_explicit_browser(self):
|
||||
+ browser = webbrowser.MacOSXOSAScript("safari")
|
||||
+ browser.open("https://python.org")
|
||||
+ script = self.popen_pipe.pipe.getvalue()
|
||||
+ self.assertIn('tell application "safari"', script)
|
||||
+ self.assertIn('open location "https://python.org"', script)
|
||||
+
|
||||
+ def test_reject_dash_prefixes(self):
|
||||
+ with self.assertRaisesRegex(
|
||||
+ ValueError,
|
||||
+ r"^Invalid URL \(leading dash disallowed\): '--key=val http.*'$"
|
||||
+ ):
|
||||
+ self.browser.open(f"--key=val {URL}")
|
||||
+
|
||||
+
|
||||
class BrowserRegistrationTest(unittest.TestCase):
|
||||
|
||||
def setUp(self):
|
||||
diff --git a/Lib/webbrowser.py b/Lib/webbrowser.py
|
||||
index 0bdb644d7db..000e89275b7 100755
|
||||
--- a/Lib/webbrowser.py
|
||||
+++ b/Lib/webbrowser.py
|
||||
@@ -162,7 +162,7 @@ class BaseBrowser(object):
|
||||
def _check_url(url):
|
||||
"""Ensures that the URL is safe to pass to subprocesses as a parameter"""
|
||||
if url and url.lstrip().startswith("-"):
|
||||
- raise ValueError(f"Invalid URL: {url}")
|
||||
+ raise ValueError(f"Invalid URL (leading dash disallowed): {url!r}")
|
||||
|
||||
|
||||
class GenericBrowser(BaseBrowser):
|
||||
--
|
||||
2.35.6
|
||||
|
||||
Reference in New Issue
Block a user