mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-09-09 06:40:17 +00:00
Hetvi Thakar
6752204aad
Manually backport the three upstream security fixes for CVE-2026-32640 to the Scarthgap simpleeval 0.9.13 recipe [1][2][3]. Include the required unhashable-container correction [4], which prevents the recursive security checks from raising TypeError on legitimate list and tuple values. Harden the recursive callback-argument validation to inspect sets, frozensets, and dictionary keys, and safely handle cyclic containers. Add regression coverage for each of these cases. Do not include the separate generator/coroutine hardening or the optional performance follow-up. Omit the new ModuleWrapper API so this stable-branch fix adds no unrelated public feature. [1] https://github.com/danthedeckie/simpleeval/commit/9cb4a7b99498 [2] https://github.com/danthedeckie/simpleeval/commit/1654cbf02193 [3] https://github.com/danthedeckie/simpleeval/commit/cffa9f68cee5 [4] https://github.com/danthedeckie/simpleeval/commit/d1e4569db678 Signed-off-by: Hetvi Thakar <hthakar@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
32 lines
771 B
BlitzBasic
32 lines
771 B
BlitzBasic
SUMMARY = "A simple, safe single expression evaluator library"
|
|
HOMEPAGE = "https://pypi.org/project/simpleeval/"
|
|
LICENSE = "MIT"
|
|
LIC_FILES_CHKSUM = "file://LICENCE;md5=dc9277482effe59b734b004cbcc1fee7"
|
|
|
|
SRC_URI[sha256sum] = "4a30f9cc01825fe4c719c785e3762623e350c4840d5e6855c2a8496baaa65fac"
|
|
|
|
inherit pypi python_setuptools_build_meta ptest
|
|
|
|
BBCLASSEXTEND = "native nativesdk"
|
|
|
|
SRC_URI += " \
|
|
file://CVE-2026-32640_p1.patch \
|
|
file://CVE-2026-32640_p2.patch \
|
|
file://CVE-2026-32640_p3.patch \
|
|
file://CVE-2026-32640_p4.patch \
|
|
file://run-ptest \
|
|
"
|
|
|
|
RDEPENDS:${PN} += " \
|
|
python3-math \
|
|
"
|
|
|
|
RDEPENDS:${PN}-ptest += " \
|
|
python3-pytest \
|
|
python3-unittest-automake-output \
|
|
"
|
|
|
|
do_install_ptest() {
|
|
cp -f ${S}/test_simpleeval.py ${D}${PTEST_PATH}/
|
|
}
|