mirror of
https://git.yoctoproject.org/poky
synced 2026-02-12 03:33:02 +01:00
e5f6e0853e
(From OE-Core rev: 9d23b982fa4e0290761b3d15f6959779fed72ad6) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
56 lines
2.2 KiB
Diff
56 lines
2.2 KiB
Diff
From 179a5f75f1121dab271fe8f90eb35145f9dcbbda Mon Sep 17 00:00:00 2001
|
|
From: Sihoon Lee <push0ebp@gmail.com>
|
|
Date: Fri, 17 May 2019 02:41:06 +0900
|
|
Subject: [PATCH] Update test_urllib.py and urllib.py\nchange assertEqual into
|
|
assertRasies in DummyURLopener test, and simplify mitigation
|
|
|
|
Upstream-Status: Submitted https://github.com/python/cpython/pull/11842
|
|
|
|
CVE: CVE-2019-9948
|
|
|
|
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
|
|
---
|
|
Lib/test/test_urllib.py | 11 +++--------
|
|
Lib/urllib.py | 4 ++--
|
|
2 files changed, 5 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/Lib/test/test_urllib.py b/Lib/test/test_urllib.py
|
|
index e5f210e62a18..1e23dfb0bb16 100644
|
|
--- a/Lib/test/test_urllib.py
|
|
+++ b/Lib/test/test_urllib.py
|
|
@@ -1027,14 +1027,9 @@ def test_local_file_open(self):
|
|
class DummyURLopener(urllib.URLopener):
|
|
def open_local_file(self, url):
|
|
return url
|
|
- self.assertEqual(DummyURLopener().open(
|
|
- 'local-file://example'), '//example')
|
|
- self.assertEqual(DummyURLopener().open(
|
|
- 'local_file://example'), '//example')
|
|
- self.assertRaises(IOError, urllib.urlopen,
|
|
- 'local-file://example')
|
|
- self.assertRaises(IOError, urllib.urlopen,
|
|
- 'local_file://example')
|
|
+ for url in ('local_file://example', 'local-file://example'):
|
|
+ self.assertRaises(IOError, DummyURLopener().open, url)
|
|
+ self.assertRaises(IOError, urllib.urlopen, url)
|
|
|
|
# Just commented them out.
|
|
# Can't really tell why keep failing in windows and sparc.
|
|
diff --git a/Lib/urllib.py b/Lib/urllib.py
|
|
index a24e9a5c68fb..39b834054e9e 100644
|
|
--- a/Lib/urllib.py
|
|
+++ b/Lib/urllib.py
|
|
@@ -203,10 +203,10 @@ def open(self, fullurl, data=None):
|
|
name = 'open_' + urltype
|
|
self.type = urltype
|
|
name = name.replace('-', '_')
|
|
-
|
|
+
|
|
# bpo-35907: # disallow the file reading with the type not allowed
|
|
if not hasattr(self, name) or \
|
|
- (self == _urlopener and name == 'open_local_file'):
|
|
+ getattr(self, name) == self.open_local_file:
|
|
if proxy:
|
|
return self.open_unknown_proxy(proxy, fullurl, data)
|
|
else:
|