summaryrefslogtreecommitdiff
path: root/gnu/packages/patches/python-CVE-2020-26116.patch
diff options
context:
space:
mode:
authorLeo Famulari <leo@famulari.name>2022-02-06 23:18:52 -0500
committerLeo Famulari <leo@famulari.name>2022-02-16 11:57:14 -0500
commitd2bb4847b96e51b71126778bb16daa7674a6690c (patch)
tree30b42d5f903857a55e30fb1756a52c0f475ebc60 /gnu/packages/patches/python-CVE-2020-26116.patch
parent5fffd8352b97295303c4782a5835566338119382 (diff)
downloadguix-patches-d2bb4847b96e51b71126778bb16daa7674a6690c.tar
guix-patches-d2bb4847b96e51b71126778bb16daa7674a6690c.tar.gz
gnu: Remove leftover patch files.base-for-series-11411base-for-series-11410
These patches aren't used anywhere in Guix and we forgot to remove them. * gnu/packages/patches/bash-reproducible-linux-pgrp-pipe.patch, gnu/packages/patches/ghc-monad-par-fix-tests.patch, gnu/packages/patches/glibc-CVE-2018-11236.patch, gnu/packages/patches/glibc-CVE-2018-11237.patch, gnu/packages/patches/glibc-hurd-magic-pid.patch, gnu/packages/patches/grocsvs-dont-use-admiral.patch, gnu/packages/patches/hydra-disable-darcs-test.patch, gnu/packages/patches/inkscape-poppler-0.76.patch, gnu/packages/patches/libvirt-create-machine-cgroup.patch, gnu/packages/patches/linux-libre-arm64-generic-pinebook-lcd.patch, gnu/packages/patches/marble-qt-add-qt-headers.patch, gnu/packages/patches/maven-enforcer-api-fix-old-dependencies.patch, gnu/packages/patches/mescc-tools-boot.patch, gnu/packages/patches/nettle-3.5-CVE-2021-3580-pt1.patch, gnu/packages/patches/nettle-3.5-CVE-2021-3580-pt2.patch, gnu/packages/patches/nettle-3.5-check-_pkcs1_sec_decrypt-msg-len.patch, gnu/packages/patches/ocaml-Add-a-.file-directive.patch, gnu/packages/patches/ocaml-CVE-2015-8869.patch, gnu/packages/patches/ocaml-bitstring-fix-configure.patch, gnu/packages/patches/ocaml-enable-ocamldoc-reproducibility.patch, gnu/packages/patches/openbabel-fix-crash-on-nwchem-output.patch, gnu/packages/patches/openjdk-14-builtins.patch, gnu/packages/patches/openssl-c-rehash-in.patch, gnu/packages/patches/openssl-runpath.patch, gnu/packages/patches/passwordsafe-meson-remove-extra-argument.patch, gnu/packages/patches/patchutils-test-perms.patch, gnu/packages/patches/python-CVE-2018-14647.patch, gnu/packages/patches/python-CVE-2020-26116.patch, gnu/packages/patches/python-axolotl-AES-fix.patch, gnu/packages/patches/python-babel-fix-parse-future-test.patch, gnu/packages/patches/python-matplotlib-run-under-wayland-gtk3.patch, gnu/packages/patches/python-pytest-asyncio-python-3.8.patch, gnu/packages/patches/python2-larch-coverage-4.0a6-compatibility.patch, gnu/packages/patches/qt4-ldflags.patch, gnu/packages/patches/rust-coresimd-doctest.patch, gnu/packages/patches/streamlink-update-test.patch, gnu/packages/patches/tcc-boot-0.9.27.patch, gnu/packages/patches/vtk-8-fix-freetypetools-build-failure.patch: Delete files. * gnu/local.mk (dist_patch_DATA): Remove them.
Diffstat (limited to 'gnu/packages/patches/python-CVE-2020-26116.patch')
-rw-r--r--gnu/packages/patches/python-CVE-2020-26116.patch47
1 files changed, 0 insertions, 47 deletions
diff --git a/gnu/packages/patches/python-CVE-2020-26116.patch b/gnu/packages/patches/python-CVE-2020-26116.patch
deleted file mode 100644
index dc0571e964..0000000000
--- a/gnu/packages/patches/python-CVE-2020-26116.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-Fix CVE-2020-26116:
-
-https://cve.circl.lu/cve/CVE-2020-26116
-https://bugs.python.org/issue39603
-
-Taken from upstream (sans test and NEWS update):
-https://github.com/python/cpython/commit/668d321476d974c4f51476b33aaca870272523bf
-
-diff --git a/Lib/http/client.py b/Lib/http/client.py
---- a/Lib/http/client.py
-+++ b/Lib/http/client.py
-@@ -147,6 +147,10 @@
- # _is_allowed_url_pchars_re = re.compile(r"^[/!$&'()*+,;=:@%a-zA-Z0-9._~-]+$")
- # We are more lenient for assumed real world compatibility purposes.
-
-+# These characters are not allowed within HTTP method names
-+# to prevent http header injection.
-+_contains_disallowed_method_pchar_re = re.compile('[\x00-\x1f]')
-+
- # We always set the Content-Length header for these methods because some
- # servers will otherwise respond with a 411
- _METHODS_EXPECTING_BODY = {'PATCH', 'POST', 'PUT'}
-@@ -1087,6 +1091,8 @@ def putrequest(self, method, url, skip_host=False,
- else:
- raise CannotSendRequest(self.__state)
-
-+ self._validate_method(method)
-+
- # Save the method for use later in the response phase
- self._method = method
-
-@@ -1177,6 +1183,15 @@ def _encode_request(self, request):
- # ASCII also helps prevent CVE-2019-9740.
- return request.encode('ascii')
-
-+ def _validate_method(self, method):
-+ """Validate a method name for putrequest."""
-+ # prevent http header injection
-+ match = _contains_disallowed_method_pchar_re.search(method)
-+ if match:
-+ raise ValueError(
-+ f"method can't contain control characters. {method!r} "
-+ f"(found at least {match.group()!r})")
-+
- def _validate_path(self, url):
- """Validate a url for putrequest."""
- # Prevent CVE-2019-9740.