mirror of
https://git.yoctoproject.org/poky
synced 2026-09-20 12:49:33 +02:00
81c4f97c54
This patch applies the upstream fix as referenced in [2], using
the commit shown in [1].
The backport makes Template URI normalization strip all leading
slashes, preventing a double-slash URI from bypassing the path
traversal check while keeping Mako at version 1.3.2.
[1] e05ac61989
[2] https://github.com/advisories/GHSA-v92g-xgxw-vvmm
(From OE-Core rev: 0c13fdc7798a24dadb60b7dba60049558bf5c021)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
23 lines
634 B
BlitzBasic
23 lines
634 B
BlitzBasic
SUMMARY = "Templating library for Python"
|
|
HOMEPAGE = "http://www.makotemplates.org/"
|
|
SECTION = "devel/python"
|
|
LICENSE = "MIT"
|
|
LIC_FILES_CHKSUM = "file://LICENSE;md5=d0995d6f7ba3f186a03118f244e88f57"
|
|
|
|
PYPI_PACKAGE = "Mako"
|
|
|
|
inherit pypi python_setuptools_build_meta
|
|
|
|
SRC_URI += "file://CVE-2026-41205.patch \
|
|
"
|
|
SRC_URI[sha256sum] = "2a0c8ad7f6274271b3bb7467dd37cf9cc6dab4bc19cb69a4ef10669402de698e"
|
|
|
|
RDEPENDS:${PN} = "python3-html \
|
|
python3-markupsafe \
|
|
python3-netclient \
|
|
python3-pygments \
|
|
python3-threading \
|
|
"
|
|
|
|
BBCLASSEXTEND = "native nativesdk"
|