mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-10-15 06:17:16 +00:00
Code Issues Projects Releases Wiki Activity

python3-sqlparse: patch CVE-2026-59894

Browse Source 
Backport commit associated with GitHub advisory.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-59894

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi authored and Anuj Mittal committed 2026-10-05 14:40:47 +05:30
1 parent 2fa32e5e27
commit d17a7718d4
2 files changed
+80
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-python/recipes-devtools/python/python3-sqlparse/CVE-2026-59894.patch
+79
View File
@@ -0,0 +1,79 @@
From a1ce7931eda6262f0fe94a0b2cb25854f12d6be5 Mon Sep 17 00:00:00 2001
From: Andi Albrecht <albrecht.andi@gmail.com>
Date: Mon, 29 Jun 2026 08:29:32 +0200
Subject: [PATCH] Escape backslashes in output formatters.
(cherry picked from commit 53ff44b53e27cff78259acc1af015506fea60f63)
CVE: CVE-2026-59894
Upstream-Status: Backport [https://github.com/andialbrecht/sqlparse/commit/53ff44b53e27cff78259acc1af015506fea60f63]
Dropped changes to the CHANGELOG file.
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
sqlparse/filters/output.py | 16 ++++++++++------
tests/test_format.py | 16 ++++++++++++++++
2 files changed, 26 insertions(+), 6 deletions(-)
diff --git a/sqlparse/filters/output.py b/sqlparse/filters/output.py
index 253537e..697ebc3 100644
--- a/sqlparse/filters/output.py
+++ b/sqlparse/filters/output.py
@@ -61,9 +61,11 @@ class OutputPythonFilter(OutputFilter):
yield sql.Token(T.Whitespace, after_lb)
continue
- # Token has escape chars
- elif "'" in token.value:
- token.value = token.value.replace("'", "\\'")
+ # Escape backslashes before quotes so a backslash preceding a
+ # quote cannot break out of the generated string literal
+ # (GHSA-3496-9g83-7v6x).
+ else:
+ token.value = token.value.replace('\\', '\\\\').replace("'", "\\'")
# Put the token
yield sql.Token(T.Text, token.value)
@@ -110,9 +112,11 @@ class OutputPHPFilter(OutputFilter):
yield sql.Token(T.Whitespace, after_lb)
continue
- # Token has escape chars
- elif '"' in token.value:
- token.value = token.value.replace('"', '\\"')
+ # Escape backslashes before quotes so a backslash preceding a
+ # quote cannot break out of the generated string literal
+ # (GHSA-3496-9g83-7v6x).
+ else:
+ token.value = token.value.replace('\\', '\\\\').replace('"', '\\"')
# Put the token
yield sql.Token(T.Text, token.value)
diff --git a/tests/test_format.py b/tests/test_format.py
index 0cdbcf8..9349506 100644
--- a/tests/test_format.py
+++ b/tests/test_format.py
@@ -689,6 +689,22 @@ class TestOutputFormat:
'$sql = "select * ";',
'$sql .= "from foo;";'])
+ def test_python_escapes_backslashes(self):
+ # GHSA-3496-9g83-7v6x: backslashes must be escaped before quotes so
+ # crafted SQL cannot break out of the generated Python string literal.
+ # SQL select '\foo\' -> each \ doubled, each ' escaped.
+ sql = "select '\\foo\\'"
+ f = lambda sql: sqlparse.format(sql, output_format='python')
+ assert f(sql) == "sql = 'select \\'\\\\foo\\\\\\''"
+
+ def test_php_escapes_backslashes(self):
+ # GHSA-3496-9g83-7v6x: PHP double-quoted output must escape backslashes
+ # before quotes; a backslash before a quote otherwise closes the string.
+ # SQL select '\foo\' -> each \ doubled (single quotes need no escaping).
+ sql = "select '\\foo\\'"
+ f = lambda sql: sqlparse.format(sql, output_format='php')
+ assert f(sql) == '$sql = "select \'\\\\foo\\\\\'";'
+
def test_sql(self):
# "sql" is an allowed option but has no effect
sql = 'select * from foo;'
meta-python/recipes-devtools/python/python3-sqlparse_0.5.5.bb
+1
View File
@@ -9,6 +9,7 @@ SRC_URI[sha256sum] = "e20d4a9b0b8585fdf63b10d30066c7c94c5d7a7ec47c889a2d83a3caa9
SRC_URI += "file://CVE-2026-54284-1.patch \
file://CVE-2026-54284-2.patch \
file://CVE-2026-59893.patch \
file://CVE-2026-59894.patch \
"
CVE_PRODUCT = "sqlparse"