mirror of
https://git.yoctoproject.org/poky
synced 2026-09-20 12:49:33 +02:00
96afd71237
This patch applies the upstream 3.1.48 backport for CVE-2026-44243. The upstream fix merge is referenced in [1], and the public CVE advisory is referenced in [2]. The individual backported commits are referenced in [3] and [4]. [1]dbfa264764[2] https://nvd.nist.gov/vuln/detail/CVE-2026-44243 [3]25ba54dd3f[4]4af8463cca(From OE-Core rev: 0853d0c72e96a3c4e3a5329589a9aa151e2f2c46) Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
87 lines
3.1 KiB
Diff
87 lines
3.1 KiB
Diff
From 2d1f681978b51ffff0db57cf89b0bcd6bffc7418 Mon Sep 17 00:00:00 2001
|
|
From: "GPT 5.5" <codex@openai.com>
|
|
Date: Tue, 28 Apr 2026 09:30:41 +0800
|
|
Subject: [PATCH] address review feedback and CI failures
|
|
|
|
Consolidate follow-up fixes from review and CI:
|
|
|
|
- fix lint and mypy issues in reference log path handling
|
|
- validate remote reference paths before invoking git branch deletion
|
|
- add symlink escape coverage where realpath resolves symlinks
|
|
- ensure temporary test repositories release git resources during cleanup
|
|
|
|
CVE: CVE-2026-44243
|
|
Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/4af8463cca31c2369312fcaa5309dfc30756c7b6]
|
|
|
|
Backport Changes:
|
|
- Keep the 3.1.42 docstring layout and path coercion while
|
|
applying upstream validation documentation and return type.
|
|
- Omit regression test updates because the Scarthgap PyPI
|
|
source archive does not include the upstream test suite.
|
|
|
|
Co-authored-by: Sebastian Thiel <sebastian.thiel@icloud.com>
|
|
(cherry picked from commit 4af8463cca31c2369312fcaa5309dfc30756c7b6)
|
|
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
|
|
---
|
|
git/refs/log.py | 3 ++-
|
|
git/refs/remote.py | 4 +++-
|
|
git/util.py | 2 +-
|
|
3 files changed, 6 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/git/refs/log.py b/git/refs/log.py
|
|
index 29293f4a..eef525e7 100644
|
|
--- a/git/refs/log.py
|
|
+++ b/git/refs/log.py
|
|
@@ -21,7 +21,6 @@ from git.util import (
|
|
file_contents_ro_filepath,
|
|
)
|
|
|
|
-import os.path as osp
|
|
|
|
|
|
# typing ------------------------------------------------------------------
|
|
@@ -203,6 +202,8 @@ class RefLog(List[RefLogEntry], Serializable):
|
|
instance would be found. The path is not guaranteed to point to a valid
|
|
file though.
|
|
:param ref: SymbolicReference instance
|
|
+ :raise ValueError:
|
|
+ If `ref.path` is invalid or escapes the repository's reflog directory.
|
|
"""
|
|
return to_native_path(ref._get_validated_reflog_path(ref.repo, ref.path))
|
|
|
|
diff --git a/git/refs/remote.py b/git/refs/remote.py
|
|
index e50c54eb..70eada81 100644
|
|
--- a/git/refs/remote.py
|
|
+++ b/git/refs/remote.py
|
|
@@ -59,12 +59,14 @@ class RemoteReference(Head):
|
|
kwargs are given for comparability with the base class method as we
|
|
should not narrow the signature.
|
|
"""
|
|
+ for ref in refs:
|
|
+ cls._check_ref_name_valid(ref.path)
|
|
+
|
|
repo.git.branch("-d", "-r", *refs)
|
|
# The official deletion method will ignore remote symbolic refs - these
|
|
# are generally ignored in the refs/ folder. We don't though
|
|
# and delete remainders manually.
|
|
for ref in refs:
|
|
- cls._check_ref_name_valid(ref.path)
|
|
try:
|
|
os.remove(cls._get_validated_path(repo.common_dir, ref.path))
|
|
except OSError:
|
|
diff --git a/git/util.py b/git/util.py
|
|
index 03d62ffc..5a136d18 100644
|
|
--- a/git/util.py
|
|
+++ b/git/util.py
|
|
@@ -272,7 +272,7 @@ def join_path(a: PathLike, *p: PathLike) -> PathLike:
|
|
|
|
if os.name == "nt":
|
|
|
|
- def to_native_path_windows(path: PathLike) -> PathLike:
|
|
+ def to_native_path_windows(path: PathLike) -> str:
|
|
path = str(path)
|
|
return path.replace("/", "\\")
|
|
|
|
--
|
|
2.35.6
|