diff mbox series

[meta-python,1/1] python3-sqlparse: fix CVE-2023-30608

Message ID 20230615185022.2927768-1-joe.slater@windriver.com
State Under Review
Headers show
Series [meta-python,1/1] python3-sqlparse: fix CVE-2023-30608 | expand

Commit Message

Slater, Joseph June 15, 2023, 6:50 p.m. UTC 
From: Joe Slater <joe.slater@windriver.com>

Backport from commit c457abd5f... upstream.

Signed-off-by: Joe Slater <joe.slater@windriver.com>
---
 .../python3-sqlparse/CVE-2023-30608.patch     | 51 +++++++++++++++++++
 .../python/python3-sqlparse_0.4.3.bb          |  1 +
 2 files changed, 52 insertions(+)
 create mode 100644 meta-python/recipes-devtools/python/python3-sqlparse/CVE-2023-30608.patch
diff mbox series

Patch

diff --git a/meta-python/recipes-devtools/python/python3-sqlparse/CVE-2023-30608.patch b/meta-python/recipes-devtools/python/python3-sqlparse/CVE-2023-30608.patch
new file mode 100644
index 0000000000..f5526c5b88
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-sqlparse/CVE-2023-30608.patch
@@ -0,0 +1,51 @@ 
+From c457abd5f097dd13fb21543381e7cfafe7d31cfb Mon Sep 17 00:00:00 2001
+From: Andi Albrecht <albrecht.andi@gmail.com>
+Date: Mon, 20 Mar 2023 08:33:46 +0100
+Subject: [PATCH] Remove unnecessary parts in regex for bad escaping.
+
+The regex tried to deal with situations where escaping in the
+SQL to be parsed was suspicious.
+
+Upstream-Status: Backport
+CVE: CVE-2023-30608
+
+Reference to upstream patch:
+https://github.com/andialbrecht/sqlparse/commit/c457abd5f097dd13fb21543381e7cfafe7d31cfb
+
+[AZ: drop changes to CHANGELOG file and adjust context whitespaces]
+Signed-off-by: Adrian Zaharia <Adrian.Zaharia@windriver.com>
+
+Adjust indentation in keywords.py.
+Signed-off-by: Joe Slater <joe.slater@windriver.com>
+---
+ sqlparse/keywords.py | 4 ++--
+ tests/test_split.py  | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- sqlparse-0.4.3.orig/sqlparse/keywords.py
++++ sqlparse-0.4.3/sqlparse/keywords.py
+@@ -72,9 +72,9 @@ SQL_REGEX = {
+         (r'(?![_A-ZÀ-Ü])-?(\d+(\.\d*)|\.\d+)(?![_A-ZÀ-Ü])',
+          tokens.Number.Float),
+         (r'(?![_A-ZÀ-Ü])-?\d+(?![_A-ZÀ-Ü])', tokens.Number.Integer),
+-        (r"'(''|\\\\|\\'|[^'])*'", tokens.String.Single),
++        (r"'(''|\\'|[^'])*'", tokens.String.Single),
+         # not a real string literal in ANSI SQL:
+-        (r'"(""|\\\\|\\"|[^"])*"', tokens.String.Symbol),
++        (r'"(""|\\"|[^"])*"', tokens.String.Symbol),
+         (r'(""|".*?[^\\]")', tokens.String.Symbol),
+         # sqlite names can be escaped with [square brackets]. left bracket
+         # cannot be preceded by word character or a right bracket --
+--- sqlparse-0.4.3.orig/tests/test_split.py
++++ sqlparse-0.4.3/tests/test_split.py
+@@ -18,8 +18,8 @@ def test_split_semicolon():
+ 
+ 
+ def test_split_backslash():
+-    stmts = sqlparse.parse(r"select '\\'; select '\''; select '\\\'';")
+-    assert len(stmts) == 3
++    stmts = sqlparse.parse("select '\'; select '\'';")
++    assert len(stmts) == 2
+ 
+ 
+ @pytest.mark.parametrize('fn', ['function.sql',
diff --git a/meta-python/recipes-devtools/python/python3-sqlparse_0.4.3.bb b/meta-python/recipes-devtools/python/python3-sqlparse_0.4.3.bb
index c952c71d0b..a402f991f7 100644
--- a/meta-python/recipes-devtools/python/python3-sqlparse_0.4.3.bb
+++ b/meta-python/recipes-devtools/python/python3-sqlparse_0.4.3.bb
@@ -5,6 +5,7 @@  LICENSE = "BSD-3-Clause"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=2b136f573f5386001ea3b7b9016222fc"
 
 SRC_URI += "file://0001-sqlparse-change-shebang-to-python3.patch \
+            file://CVE-2023-30608.patch \
             file://run-ptest \
 	    "