helium-3rd-party/meta-openembedded
1
0
Fork 0
mirror of git://git.openembedded.org/meta-openembedded synced 2025-12-31 13:38:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

python3-sqlparse: fix CVE-2023-30608

Browse Source 
Backport from commit c457abd5f... upstream.

Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This commit is contained in:
Joe Slater 2023-06-15 11:50:22 -07:00 committed by Khem Raj
parent f0cd4aca20
commit f8df473476
2 changed files with 52 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
meta-python/recipes-devtools/python/python3-sqlparse/CVE-2023-30608.patch Normal file
View File

@ -0,0 +1,51 @@
From c457abd5f097dd13fb21543381e7cfafe7d31cfb Mon Sep 17 00:00:00 2001
From: Andi Albrecht <albrecht.andi@gmail.com>
Date: Mon, 20 Mar 2023 08:33:46 +0100
Subject: [PATCH] Remove unnecessary parts in regex for bad escaping.
The regex tried to deal with situations where escaping in the
SQL to be parsed was suspicious.
Upstream-Status: Backport
CVE: CVE-2023-30608
Reference to upstream patch:
https://github.com/andialbrecht/sqlparse/commit/c457abd5f097dd13fb21543381e7cfafe7d31cfb
[AZ: drop changes to CHANGELOG file and adjust context whitespaces]
Signed-off-by: Adrian Zaharia <Adrian.Zaharia@windriver.com>
Adjust indentation in keywords.py.
Signed-off-by: Joe Slater <joe.slater@windriver.com>
---
sqlparse/keywords.py | 4 ++--
tests/test_split.py | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
--- sqlparse-0.4.3.orig/sqlparse/keywords.py
+++ sqlparse-0.4.3/sqlparse/keywords.py
@@ -72,9 +72,9 @@ SQL_REGEX = {
(r'(?![_A-ZÀ-Ü])-?(\d+(\.\d*)|\.\d+)(?![_A-ZÀ-Ü])',
tokens.Number.Float),
(r'(?![_A-ZÀ-Ü])-?\d+(?![_A-ZÀ-Ü])', tokens.Number.Integer),
- (r"'(''|\\\\|\\'|[^'])*'", tokens.String.Single),
+ (r"'(''|\\'|[^'])*'", tokens.String.Single),
# not a real string literal in ANSI SQL:
- (r'"(""|\\\\|\\"|[^"])*"', tokens.String.Symbol),
+ (r'"(""|\\"|[^"])*"', tokens.String.Symbol),
(r'(""|".*?[^\\]")', tokens.String.Symbol),
# sqlite names can be escaped with [square brackets]. left bracket
# cannot be preceded by word character or a right bracket --
--- sqlparse-0.4.3.orig/tests/test_split.py
+++ sqlparse-0.4.3/tests/test_split.py
@@ -18,8 +18,8 @@ def test_split_semicolon():
def test_split_backslash():
- stmts = sqlparse.parse(r"select '\\'; select '\''; select '\\\'';")
- assert len(stmts) == 3
+ stmts = sqlparse.parse("select '\'; select '\'';")
+ assert len(stmts) == 2
@pytest.mark.parametrize('fn', ['function.sql',

1
meta-python/recipes-devtools/python/python3-sqlparse_0.4.3.bb
View File

@ -5,6 +5,7 @@ LICENSE = "BSD-3-Clause"
LIC_FILES_CHKSUM = "file://LICENSE;md5=2b136f573f5386001ea3b7b9016222fc"
SRC_URI += "file://0001-sqlparse-change-shebang-to-python3.patch \
file://CVE-2023-30608.patch \
file://run-ptest \
"