main/python3: fix CVE-2024-8088

Add patch to fix CVE-2024-8088: Infinite loop when iterating over zip archive entry names. - python/cpython#122905 - https://mail.python.org/archives/list/[email protected]/thread/GNFCKVI4TCATKQLALJ5SN4L4CSPSMILU/
alpinelinux · Aug 27, 2024 · 99375d3 · 99375d3
1 parent 9199af9
commit 99375d3
Show file tree

Hide file tree

Showing 2 changed files with 145 additions and 1 deletion.
diff --git a/main/python3/APKBUILD b/main/python3/APKBUILD
@@ -4,7 +4,7 @@ pkgname=python3
 # the python3-tkinter's pkgver needs to be synchronized with this.
 pkgver=3.11.8
 _basever="${pkgver%.*}"
-pkgrel=0
+pkgrel=1
 pkgdesc="High-level scripting language"
 url="https://www.python.org/"
 arch="all"
@@ -42,11 +42,14 @@ makedepends="
 source="https://www.python.org/ftp/python/$pkgver/Python-$pkgver.tar.xz
 	musl-find_library.patch
 	fix-test_xml_etree-expat-2.6.0.patch
+	CVE-2024-8088.patch
 	"
 options="net" # Required for tests
 builddir="$srcdir/Python-$pkgver"
 
 # secfixes:
+#   3.11.8-r1:
+#     - CVE-2024-8088
 #   3.11.5-r0:
 #     - CVE-2023-40217
 #   3.11.1-r0:
@@ -254,4 +257,5 @@ sha512sums="
 434e727fa370def348838fd84acb69b4d309cfb03f61bf5069150164e9ca005637ac01dfbf997f445607d4e28d02c8bed0858b36589240ccadaa4c14c19f2320  Python-3.11.8.tar.xz
 ab8eaa2858d5109049b1f9f553198d40e0ef8d78211ad6455f7b491af525bffb16738fed60fc84e960c4889568d25753b9e4a1494834fea48291b33f07000ec2  musl-find_library.patch
 4a7f835feae30dfee6b524d2acceb3f8acd5448303ec312abb3e8de936fa665a1a2fba04410dc108f12a661d21f7920026668f8ff35f265d92c8a88b6f3311d2  fix-test_xml_etree-expat-2.6.0.patch
+31e66b45abf4146a2a988cf8520b32f60ff3f970d0f4380f52ecc5eff746c1efd95f479e30426adcdfac5af7c84c7e09be467f8421cab6025c83d9e740618a8a  CVE-2024-8088.patch
 "
diff --git a/main/python3/CVE-2024-8088.patch b/main/python3/CVE-2024-8088.patch
@@ -0,0 +1,140 @@
+From 0d480f2766db5313cf311c4f7ec3fd6f9e09615f Mon Sep 17 00:00:00 2001
+From: "Jason R. Coombs" <[email protected]>
+Date: Sun, 11 Aug 2024 19:48:50 -0400
+Subject: [PATCH 1/2] gh-122905: Sanitize names in zipfile.Path. (#122906)
+
+Ported from zipp 3.19.1; ref jaraco/zipp#119.
+
+(cherry picked from commit 9cd03263100ddb1657826cc4a71470786cab3932)
+---
+ Lib/test/test_zipfile.py                      | 17 ++++++
+ Lib/zipfile.py                                | 61 ++++++++++++++++++-
+ ...-08-11-14-08-04.gh-issue-122905.7tDsxA.rst |  1 +
+ 3 files changed, 78 insertions(+), 1 deletion(-)
+ create mode 100644 Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst
+
+diff --git a/Lib/test/test_zipfile.py b/Lib/test/test_zipfile.py
+index 4de6f379a47891..8bdc7a1b7d656a 100644
+--- a/Lib/test/test_zipfile.py
++++ b/Lib/test/test_zipfile.py
+@@ -3651,6 +3651,23 @@ def test_extract_orig_with_implied_dirs(self, alpharep):
+         zipfile.Path(zf)
+         zf.extractall(source_path.parent)
+
++    def test_malformed_paths(self):
++        """
++        Path should handle malformed paths.
++        """
++        data = io.BytesIO()
++        zf = zipfile.ZipFile(data, "w")
++        zf.writestr("/one-slash.txt", b"content")
++        zf.writestr("//two-slash.txt", b"content")
++        zf.writestr("../parent.txt", b"content")
++        zf.filename = ''
++        root = zipfile.Path(zf)
++        assert list(map(str, root.iterdir())) == [
++            'one-slash.txt',
++            'two-slash.txt',
++            'parent.txt',
++        ]
++
+
+ class EncodedMetadataTests(unittest.TestCase):
+     file_names = ['\u4e00', '\u4e8c', '\u4e09']  # Han 'one', 'two', 'three'
+diff --git a/Lib/zipfile.py b/Lib/zipfile.py
+index 86829abce4edaa..b7bf9ef7e37e60 100644
+--- a/Lib/zipfile.py
++++ b/Lib/zipfile.py
+@@ -9,6 +9,7 @@
+ import itertools
+ import os
+ import posixpath
++import re
+ import shutil
+ import stat
+ import struct
+@@ -2243,7 +2244,65 @@ def _difference(minuend, subtrahend):
+     return itertools.filterfalse(set(subtrahend).__contains__, minuend)
+
+
+-class CompleteDirs(ZipFile):
++class SanitizedNames:
++    """
++    ZipFile mix-in to ensure names are sanitized.
++    """
++
++    def namelist(self):
++        return list(map(self._sanitize, super().namelist()))
++
++    @staticmethod
++    def _sanitize(name):
++        r"""
++        Ensure a relative path with posix separators and no dot names.
++        Modeled after
++        https://github.com/python/cpython/blob/bcc1be39cb1d04ad9fc0bd1b9193d3972835a57c/Lib/zipfile/__init__.py#L1799-L1813
++        but provides consistent cross-platform behavior.
++        >>> san = SanitizedNames._sanitize
++        >>> san('/foo/bar')
++        'foo/bar'
++        >>> san('//foo.txt')
++        'foo.txt'
++        >>> san('foo/.././bar.txt')
++        'foo/bar.txt'
++        >>> san('foo../.bar.txt')
++        'foo../.bar.txt'
++        >>> san('\\foo\\bar.txt')
++        'foo/bar.txt'
++        >>> san('D:\\foo.txt')
++        'D/foo.txt'
++        >>> san('\\\\server\\share\\file.txt')
++        'server/share/file.txt'
++        >>> san('\\\\?\\GLOBALROOT\\Volume3')
++        '?/GLOBALROOT/Volume3'
++        >>> san('\\\\.\\PhysicalDrive1\\root')
++        'PhysicalDrive1/root'
++        Retain any trailing slash.
++        >>> san('abc/')
++        'abc/'
++        Raises a ValueError if the result is empty.
++        >>> san('../..')
++        Traceback (most recent call last):
++        ...
++        ValueError: Empty filename
++        """
++
++        def allowed(part):
++            return part and part not in {'..', '.'}
++
++        # Remove the drive letter.
++        # Don't use ntpath.splitdrive, because that also strips UNC paths
++        bare = re.sub('^([A-Z]):', r'\1', name, flags=re.IGNORECASE)
++        clean = bare.replace('\\', '/')
++        parts = clean.split('/')
++        joined = '/'.join(filter(allowed, parts))
++        if not joined:
++            raise ValueError("Empty filename")
++        return joined + '/' * name.endswith('/')
++
++
++class CompleteDirs(SanitizedNames, ZipFile):
+     """
+     A ZipFile subclass that ensures that implied directories
+     are always included in the namelist.
+diff --git a/Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst b/Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst
+new file mode 100644
+index 00000000000000..1be44c906c4f30
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst
+@@ -0,0 +1 @@
++:class:`zipfile.Path` objects now sanitize names from the zipfile.
+
+From ed03fe914ad449938e6afd5e6f4d79cfdb16a066 Mon Sep 17 00:00:00 2001
+From: "Jason R. Coombs" <[email protected]>
+Date: Sun, 11 Aug 2024 20:21:56 -0400
+Subject: [PATCH 2/2] [3.11] gh-122905: Sanitize names in zipfile.Path.
+ (GH-122906)
+
+Ported from zipp 3.19.1; ref jaraco/zippGH-119.
+(cherry picked from commit 9cd03263100ddb1657826cc4a71470786cab3932)
+
+Co-authored-by: Jason R. Coombs <[email protected]>