mirror of
https://git.yoctoproject.org/poky
synced 2026-09-23 09:50:14 +00:00
Hetvi Thakar
b24d56a0b3
Apply the primary upstream fix referenced in [4] with commit [1]. Then apply the two follow-up regression-fix commits [2] and [3]. The primary fix rejects entry-point names that escape the configured scripts directory. The follow-up fixes handle doubled-slash roots and reuse the existing directory-containment helper. [1] https://github.com/pypa/pip/commit/8eb178480bd1a2b223f509fc430796b265158dfb [2] https://github.com/pypa/pip/commit/7ff8bdd81ec5edca2bebf78ad8506dda710d6af5 [3] https://github.com/pypa/pip/commit/fa7854f6b37113a2c4698cdde902e1fcc9bebdd5 [4] https://github.com/advisories/GHSA-wf93-45jw-7689 (From OE-Core rev: 2c276677d619bc6205872eb2b5a9948a4605d8ea) Signed-off-by: Hetvi Thakar <hthakar@cisco.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
35 lines
1.3 KiB
Diff
35 lines
1.3 KiB
Diff
From 7cac095948e86d8a0e0e17de6b763727e9b051ac Mon Sep 17 00:00:00 2001
|
|
From: Damian Shaw <damian.peter.shaw@gmail.com>
|
|
Date: Mon, 18 May 2026 23:22:51 -0400
|
|
Subject: [PATCH] Fix is_within_directory for doubled-slash roots
|
|
|
|
CVE: CVE-2026-8643
|
|
Upstream-Status: Backport [https://github.com/pypa/pip/commit/7ff8bdd81ec5edca2bebf78ad8506dda710d6af5]
|
|
|
|
Backport Changes:
|
|
- Omit tests/unit/test_utils_unpacking.py because the pip 24.0 PyPI sdist used
|
|
by this recipe does not ship the upstream tests directory.
|
|
|
|
(cherry picked from commit 7ff8bdd81ec5edca2bebf78ad8506dda710d6af5)
|
|
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
|
|
---
|
|
src/pip/_internal/utils/unpacking.py | 3 +--
|
|
1 file changed, 1 insertion(+), 2 deletions(-)
|
|
|
|
diff --git a/src/pip/_internal/utils/unpacking.py b/src/pip/_internal/utils/unpacking.py
|
|
index 0b26525fb..188f27e67 100644
|
|
--- a/src/pip/_internal/utils/unpacking.py
|
|
+++ b/src/pip/_internal/utils/unpacking.py
|
|
@@ -81,8 +81,7 @@ def is_within_directory(directory: str, target: str) -> bool:
|
|
abs_directory = os.path.abspath(directory)
|
|
abs_target = os.path.abspath(target)
|
|
|
|
- prefix = os.path.commonpath([abs_directory, abs_target])
|
|
- return prefix == abs_directory
|
|
+ return abs_target == abs_directory or abs_target.startswith(abs_directory + os.sep)
|
|
|
|
|
|
def set_extracted_file_to_default_mode_plus_executable(path: str) -> None:
|
|
--
|
|
2.35.6
|