mirror of
https://github.com/godotengine/buildroot.git
synced 2026-01-05 14:09:53 +03:00
9e12fb0ebe
Fixes the following security issues:
- bpo-37463: ssl.match_hostname() no longer accepts IPv4 addresses with
additional text after the address and only quad-dotted notation without
trailing whitespaces. Some inet_aton() implementations ignore whitespace
and all data after whitespace, e.g. ‘127.0.0.1 whatever’.
- bpo-35907: CVE-2019-9948: Avoid file reading by disallowing local-file://
and local_file:// URL schemes in URLopener().open() and
URLopener().retrieve() of urllib.request.
- bpo-30458: Address CVE-2019-9740 by disallowing URL paths with embedded
whitespace or control characters through into the underlying http client
request. Such potentially malicious header injection URLs now cause an
http.client.InvalidURL exception to be raised.
- bpo-33529: Prevent fold function used in email header encoding from
entering infinite loop when there are too many non-ASCII characters in a
header.
- bpo-35755: shutil.which() now uses os.confstr("CS_PATH") if available and
if the PATH environment variable is not set. Remove also the current
directory from posixpath.defpath. On Unix, shutil.which() and the
subprocess module no longer search the executable in the current directory
if the PATH environment variable is not set.
Also remove the following upstreamed patches:
- 0033-bpo-36742-Fixes-handling-of-pre-normalization-charac.patch
- 0034-bpo-36742-Corrects-fix-to-handle-decomposition-in-us.patch
Signed-off-by: Adam Duskett <Aduskett@gmail.com>
[Peter: mention security fixes]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 906ed044aa)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
31 lines
979 B
Diff
31 lines
979 B
Diff
From 63ab4a20076740bd39985c7dee3d6231cdc74c75 Mon Sep 17 00:00:00 2001
|
|
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
|
|
Date: Wed, 23 Dec 2015 11:43:24 +0100
|
|
Subject: [PATCH] Abort on failed module build
|
|
|
|
When building a Python module fails, the setup.py script currently
|
|
doesn't exit with an error, and simply continues. This is not a really
|
|
nice behavior, so this patch changes setup.py to abort with an error,
|
|
so that the build issue is clearly noticeable.
|
|
|
|
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
|
|
---
|
|
setup.py | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/setup.py b/setup.py
|
|
index c956fa08d1..b3add2be76 100644
|
|
--- a/setup.py
|
|
+++ b/setup.py
|
|
@@ -402,6 +402,7 @@ class PyBuildExt(build_ext):
|
|
print("Failed to build these modules:")
|
|
print_three_column(failed)
|
|
print()
|
|
+ sys.exit(1)
|
|
|
|
if self.failed_on_import:
|
|
failed = self.failed_on_import[:]
|
|
--
|
|
2.13.5
|
|
|