From d17a7718d468812051560ceb5e0fb0d7035e444c Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Mon, 14 Sep 2026 15:12:56 +1200 Subject: [PATCH] python3-sqlparse: patch CVE-2026-59894 Backport commit associated with GitHub advisory. Details: https://nvd.nist.gov/vuln/detail/cve-2026-59894 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../python3-sqlparse/CVE-2026-59894.patch | 79 +++++++++++++++++++ .../python/python3-sqlparse_0.5.5.bb | 1 + 2 files changed, 80 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-sqlparse/CVE-2026-59894.patch diff --git a/meta-python/recipes-devtools/python/python3-sqlparse/CVE-2026-59894.patch b/meta-python/recipes-devtools/python/python3-sqlparse/CVE-2026-59894.patch new file mode 100644 index 0000000000..0bd7bbc967 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-sqlparse/CVE-2026-59894.patch @@ -0,0 +1,79 @@ +From a1ce7931eda6262f0fe94a0b2cb25854f12d6be5 Mon Sep 17 00:00:00 2001 +From: Andi Albrecht +Date: Mon, 29 Jun 2026 08:29:32 +0200 +Subject: [PATCH] Escape backslashes in output formatters. + +(cherry picked from commit 53ff44b53e27cff78259acc1af015506fea60f63) + +CVE: CVE-2026-59894 +Upstream-Status: Backport [https://github.com/andialbrecht/sqlparse/commit/53ff44b53e27cff78259acc1af015506fea60f63] + +Dropped changes to the CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + sqlparse/filters/output.py | 16 ++++++++++------ + tests/test_format.py | 16 ++++++++++++++++ + 2 files changed, 26 insertions(+), 6 deletions(-) + +diff --git a/sqlparse/filters/output.py b/sqlparse/filters/output.py +index 253537e..697ebc3 100644 +--- a/sqlparse/filters/output.py ++++ b/sqlparse/filters/output.py +@@ -61,9 +61,11 @@ class OutputPythonFilter(OutputFilter): + yield sql.Token(T.Whitespace, after_lb) + continue + +- # Token has escape chars +- elif "'" in token.value: +- token.value = token.value.replace("'", "\\'") ++ # Escape backslashes before quotes so a backslash preceding a ++ # quote cannot break out of the generated string literal ++ # (GHSA-3496-9g83-7v6x). ++ else: ++ token.value = token.value.replace('\\', '\\\\').replace("'", "\\'") + + # Put the token + yield sql.Token(T.Text, token.value) +@@ -110,9 +112,11 @@ class OutputPHPFilter(OutputFilter): + yield sql.Token(T.Whitespace, after_lb) + continue + +- # Token has escape chars +- elif '"' in token.value: +- token.value = token.value.replace('"', '\\"') ++ # Escape backslashes before quotes so a backslash preceding a ++ # quote cannot break out of the generated string literal ++ # (GHSA-3496-9g83-7v6x). ++ else: ++ token.value = token.value.replace('\\', '\\\\').replace('"', '\\"') + + # Put the token + yield sql.Token(T.Text, token.value) +diff --git a/tests/test_format.py b/tests/test_format.py +index 0cdbcf8..9349506 100644 +--- a/tests/test_format.py ++++ b/tests/test_format.py +@@ -689,6 +689,22 @@ class TestOutputFormat: + '$sql = "select * ";', + '$sql .= "from foo;";']) + ++ def test_python_escapes_backslashes(self): ++ # GHSA-3496-9g83-7v6x: backslashes must be escaped before quotes so ++ # crafted SQL cannot break out of the generated Python string literal. ++ # SQL select '\foo\' -> each \ doubled, each ' escaped. ++ sql = "select '\\foo\\'" ++ f = lambda sql: sqlparse.format(sql, output_format='python') ++ assert f(sql) == "sql = 'select \\'\\\\foo\\\\\\''" ++ ++ def test_php_escapes_backslashes(self): ++ # GHSA-3496-9g83-7v6x: PHP double-quoted output must escape backslashes ++ # before quotes; a backslash before a quote otherwise closes the string. ++ # SQL select '\foo\' -> each \ doubled (single quotes need no escaping). ++ sql = "select '\\foo\\'" ++ f = lambda sql: sqlparse.format(sql, output_format='php') ++ assert f(sql) == '$sql = "select \'\\\\foo\\\\\'";' ++ + def test_sql(self): + # "sql" is an allowed option but has no effect + sql = 'select * from foo;' diff --git a/meta-python/recipes-devtools/python/python3-sqlparse_0.5.5.bb b/meta-python/recipes-devtools/python/python3-sqlparse_0.5.5.bb index a1dc52db49..a23f5ec0e2 100644 --- a/meta-python/recipes-devtools/python/python3-sqlparse_0.5.5.bb +++ b/meta-python/recipes-devtools/python/python3-sqlparse_0.5.5.bb @@ -9,6 +9,7 @@ SRC_URI[sha256sum] = "e20d4a9b0b8585fdf63b10d30066c7c94c5d7a7ec47c889a2d83a3caa9 SRC_URI += "file://CVE-2026-54284-1.patch \ file://CVE-2026-54284-2.patch \ file://CVE-2026-59893.patch \ + file://CVE-2026-59894.patch \ " CVE_PRODUCT = "sqlparse"