Files
shredos.x86_64/package/python3/0016-Add-option-to-disable-the-sqlite3-module.patch

70 lines
1.9 KiB
Diff
Raw Normal View History

From f2965dfb1aa4f6b3216f3bb1d20f99326f127079 Mon Sep 17 00:00:00 2001
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Date: Wed, 22 Feb 2017 17:20:45 -0800
Subject: [PATCH] Add option to disable the sqlite3 module
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Samuel Martin <s.martin49@gmail.com>
[ Andrey Smirnov: ported to Python 3.6 ]
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
---
Makefile.pre.in | 7 +++++--
configure.ac | 9 +++++++++
2 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/Makefile.pre.in b/Makefile.pre.in
index 931cc3ed07..a1ce0712cd 100644
--- a/Makefile.pre.in
+++ b/Makefile.pre.in
package/python3: security bump to version 3.7.4 Fixes the following security issues: - bpo-37463: ssl.match_hostname() no longer accepts IPv4 addresses with additional text after the address and only quad-dotted notation without trailing whitespaces. Some inet_aton() implementations ignore whitespace and all data after whitespace, e.g. ‘127.0.0.1 whatever’. - bpo-35907: CVE-2019-9948: Avoid file reading by disallowing local-file:// and local_file:// URL schemes in URLopener().open() and URLopener().retrieve() of urllib.request. - bpo-30458: Address CVE-2019-9740 by disallowing URL paths with embedded whitespace or control characters through into the underlying http client request. Such potentially malicious header injection URLs now cause an http.client.InvalidURL exception to be raised. - bpo-33529: Prevent fold function used in email header encoding from entering infinite loop when there are too many non-ASCII characters in a header. - bpo-35755: shutil.which() now uses os.confstr("CS_PATH") if available and if the PATH environment variable is not set. Remove also the current directory from posixpath.defpath. On Unix, shutil.which() and the subprocess module no longer search the executable in the current directory if the PATH environment variable is not set. Also remove the following upstreamed patches: - 0033-bpo-36742-Fixes-handling-of-pre-normalization-charac.patch - 0034-bpo-36742-Corrects-fix-to-handle-decomposition-in-us.patch Signed-off-by: Adam Duskett <Aduskett@gmail.com> [Peter: mention security fixes] Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-07-10 17:21:37 -04:00
@@ -1272,7 +1272,6 @@ LIBSUBDIRS= tkinter site-packages \
email email/mime \
ensurepip ensurepip/_bundled \
html json http dbm xmlrpc \
- sqlite3 \
logging csv wsgiref urllib \
ctypes ctypes/macholib \
idlelib idlelib/Icons \
package/python3: security bump to version 3.7.4 Fixes the following security issues: - bpo-37463: ssl.match_hostname() no longer accepts IPv4 addresses with additional text after the address and only quad-dotted notation without trailing whitespaces. Some inet_aton() implementations ignore whitespace and all data after whitespace, e.g. ‘127.0.0.1 whatever’. - bpo-35907: CVE-2019-9948: Avoid file reading by disallowing local-file:// and local_file:// URL schemes in URLopener().open() and URLopener().retrieve() of urllib.request. - bpo-30458: Address CVE-2019-9740 by disallowing URL paths with embedded whitespace or control characters through into the underlying http client request. Such potentially malicious header injection URLs now cause an http.client.InvalidURL exception to be raised. - bpo-33529: Prevent fold function used in email header encoding from entering infinite loop when there are too many non-ASCII characters in a header. - bpo-35755: shutil.which() now uses os.confstr("CS_PATH") if available and if the PATH environment variable is not set. Remove also the current directory from posixpath.defpath. On Unix, shutil.which() and the subprocess module no longer search the executable in the current directory if the PATH environment variable is not set. Also remove the following upstreamed patches: - 0033-bpo-36742-Fixes-handling-of-pre-normalization-charac.patch - 0034-bpo-36742-Corrects-fix-to-handle-decomposition-in-us.patch Signed-off-by: Adam Duskett <Aduskett@gmail.com> [Peter: mention security fixes] Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-07-10 17:21:37 -04:00
@@ -1342,7 +1341,6 @@ TESTSUBDIRS= tkinter/test tkinter/test/test_tkinter \
test/test_asyncio \
test/test_email test/test_email/data \
test/test_json \
- sqlite3/test \
ctypes/test \
idlelib/idle_test \
distutils/tests \
package/python3: security bump to version 3.7.4 Fixes the following security issues: - bpo-37463: ssl.match_hostname() no longer accepts IPv4 addresses with additional text after the address and only quad-dotted notation without trailing whitespaces. Some inet_aton() implementations ignore whitespace and all data after whitespace, e.g. ‘127.0.0.1 whatever’. - bpo-35907: CVE-2019-9948: Avoid file reading by disallowing local-file:// and local_file:// URL schemes in URLopener().open() and URLopener().retrieve() of urllib.request. - bpo-30458: Address CVE-2019-9740 by disallowing URL paths with embedded whitespace or control characters through into the underlying http client request. Such potentially malicious header injection URLs now cause an http.client.InvalidURL exception to be raised. - bpo-33529: Prevent fold function used in email header encoding from entering infinite loop when there are too many non-ASCII characters in a header. - bpo-35755: shutil.which() now uses os.confstr("CS_PATH") if available and if the PATH environment variable is not set. Remove also the current directory from posixpath.defpath. On Unix, shutil.which() and the subprocess module no longer search the executable in the current directory if the PATH environment variable is not set. Also remove the following upstreamed patches: - 0033-bpo-36742-Fixes-handling-of-pre-normalization-charac.patch - 0034-bpo-36742-Corrects-fix-to-handle-decomposition-in-us.patch Signed-off-by: Adam Duskett <Aduskett@gmail.com> [Peter: mention security fixes] Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-07-10 17:21:37 -04:00
@@ -1358,6 +1356,11 @@ TESTSUBDIRS += lib2to3/tests \
lib2to3/tests/data/fixers/myfixes
endif
+ifeq (@SQLITE3@,yes)
+LIBSUBDIRS += sqlite3
+TESTSUBDIRS += sqlite3/test
+endif
+
ifeq (@TEST_MODULES@,yes)
LIBSUBDIRS += $(TESTSUBDIRS)
endif
diff --git a/configure.ac b/configure.ac
index 13b2edf8b7..d7582cfea4 100644
--- a/configure.ac
+++ b/configure.ac
@@ -3226,6 +3226,15 @@ if test "$posix_threads" = "yes"; then
python3: bump to 3.7.0 Other changes include: - Refreshing all necessary patches for 3.7.0 - Add a hash for the license file. - Python no longer has it's own internal libffi, as such, host-libffi is now required to build host-python3, and is added as a dependency. - Drop PYTHON3_LIBTOOL_PATCH = NO, since there is no longer any internal libffi copy that was causing the libtool patching process to fail. - A new core module "uuid" is now is added in the Config.in file, and relies on util-linux's uuid library. - Also, a new patch: 0030-Fix-cross-compiling-the-uuid-module.patch is required to fix compiling the uuid module, because the include directory search path for uuid.h is hardcoded to /usr/include/uuid, which causes an "unsafe for cross-compilation" error during compiling if the host pc has uuid headers installed. - 0031-Add-an-option-to-disable-uuid-module.patch is added to allow disabling the Python3 UUID module, so that when BR2_PACKAGE_PYTHON3_UUID is disabled by the UUID library is present, the uuid Python module is not built, as expected. - 0032-fix-building-on-older-distributions.patch is added to change os.replace by os.rename in the update_file.py script to fix building on older Linux distributions that have older versions of python that don't include os.replace. os.rename acts in the same way as os.replace, but is cross-platform compatible. Because Buildroot is guaranteed to be built in a POSIX environment, it is safe to change replace to rename. Tested on CentOS6 and Fedora28, All test results passed: br-arm-full [1/6]: OK br-arm-cortex-a9-glibc [2/6]: OK br-arm-cortex-m4-full [3/6]: SKIPPED br-x86-64-musl [4/6]: OK br-arm-full-static [5/6]: SKIPPED armv5-ctng-linux-gnueabi [6/6]: OK 6 builds, 2 skipped, 0 build failed, 0 legal-info failed Signed-off-by: Adam Duskett <aduskett@gmail.com> [Thomas: - remove PYTHON3_LIBTOOL_PATCH = NO - improve the solution in patch 0030-Fix-cross-compiling-the-uuid-module - add patch 0031-Add-an-option-to-disable-uuid-module] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-07-20 12:10:21 -04:00
AC_CHECK_FUNCS(pthread_getcpuclockid)
fi
+AC_SUBST(SQLITE3)
+AC_ARG_ENABLE(sqlite3,
+ AS_HELP_STRING([--disable-sqlite3], [disable sqlite3]),
+ [ SQLITE3="${enableval}" ], [ SQLITE3=yes ])
+
+if test "$SQLITE3" = "no" ; then
+ DISABLED_EXTENSIONS="${DISABLED_EXTENSIONS} _sqlite3"
+fi
+
AC_SUBST(PYDOC)
AC_ARG_ENABLE(pydoc,
--
2.13.5