diff options
author | Brad Bishop <bradleyb@fuzziesquirrel.com> | 2018-12-17 04:11:34 +0300 |
---|---|---|
committer | Brad Bishop <bradleyb@fuzziesquirrel.com> | 2019-01-09 02:21:44 +0300 |
commit | 1a4b7ee28bf7413af6513fb45ad0d0736048f866 (patch) | |
tree | 79f6d8ea698cab8f2eaf4f54b793d2ca7a1451ce /meta-openembedded/meta-python/recipes-devtools/python/python-requests/0002-Rework-authorization-stripping-logic-as-discussed.patch | |
parent | 5b9ede0403237c7dace972affa65cf64a1aadd0e (diff) | |
download | openbmc-1a4b7ee28bf7413af6513fb45ad0d0736048f866.tar.xz |
reset upstream subtrees to yocto 2.6
Reset the following subtrees on thud HEAD:
poky: 87e3a9739d
meta-openembedded: 6094ae18c8
meta-security: 31dc4e7532
meta-raspberrypi: a48743dc36
meta-xilinx: c42016e2e6
Also re-apply backports that didn't make it into thud:
poky:
17726d0 systemd-systemctl-native: handle Install wildcards
meta-openembedded:
4321a5d libtinyxml2: update to 7.0.1
042f0a3 libcereal: Add native and nativesdk classes
e23284f libcereal: Allow empty package
030e8d4 rsyslog: curl-less build with fmhttp PACKAGECONFIG
179a1b9 gtest: update to 1.8.1
Squashed OpenBMC subtree compatibility updates:
meta-aspeed:
Brad Bishop (1):
aspeed: add yocto 2.6 compatibility
meta-ibm:
Brad Bishop (1):
ibm: prepare for yocto 2.6
meta-ingrasys:
Brad Bishop (1):
ingrasys: set layer compatibility to yocto 2.6
meta-openpower:
Brad Bishop (1):
openpower: set layer compatibility to yocto 2.6
meta-phosphor:
Brad Bishop (3):
phosphor: set layer compatibility to thud
phosphor: libgpg-error: drop patches
phosphor: react to fitimage artifact rename
Ed Tanous (4):
Dropbear: upgrade options for latest upgrade
yocto2.6: update openssl options
busybox: remove upstream watchdog patch
systemd: Rebase CONFIG_CGROUP_BPF patch
Change-Id: I7b1fe71cca880d0372a82d94b5fd785323e3a9e7
Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
Diffstat (limited to 'meta-openembedded/meta-python/recipes-devtools/python/python-requests/0002-Rework-authorization-stripping-logic-as-discussed.patch')
-rw-r--r-- | meta-openembedded/meta-python/recipes-devtools/python/python-requests/0002-Rework-authorization-stripping-logic-as-discussed.patch | 118 |
1 files changed, 118 insertions, 0 deletions
diff --git a/meta-openembedded/meta-python/recipes-devtools/python/python-requests/0002-Rework-authorization-stripping-logic-as-discussed.patch b/meta-openembedded/meta-python/recipes-devtools/python/python-requests/0002-Rework-authorization-stripping-logic-as-discussed.patch new file mode 100644 index 000000000..ef069fb97 --- /dev/null +++ b/meta-openembedded/meta-python/recipes-devtools/python/python-requests/0002-Rework-authorization-stripping-logic-as-discussed.patch @@ -0,0 +1,118 @@ +From 698c2fa850bfc8b3bdb768e1c1cd6d57e643811d Mon Sep 17 00:00:00 2001 +From: Bruce Merry <bmerry@ska.ac.za> +Date: Tue, 14 Aug 2018 13:30:43 +0200 +Subject: [PATCH 2/2] Rework authorization stripping logic as discussed + +The exception for http->https upgrade now requires the standard HTTP(S) +ports to be used, either implicitly (no port specified) or explicitly. + +Upstream-Status: Backport + +Follow-up fix for CVE-2018-18074 + +Signed-off-by: Chen Qi <Qi.Chen@windriver.com> +--- + requests/sessions.py | 26 ++++++++++++++++++-------- + tests/test_requests.py | 33 ++++++++++++++++++++++----------- + 2 files changed, 40 insertions(+), 19 deletions(-) + +diff --git a/requests/sessions.py b/requests/sessions.py +index 2969d83..c11a3a2 100644 +--- a/requests/sessions.py ++++ b/requests/sessions.py +@@ -115,6 +115,22 @@ class SessionRedirectMixin(object): + return to_native_string(location, 'utf8') + return None + ++ def should_strip_auth(self, old_url, new_url): ++ """Decide whether Authorization header should be removed when redirecting""" ++ old_parsed = urlparse(old_url) ++ new_parsed = urlparse(new_url) ++ if old_parsed.hostname != new_parsed.hostname: ++ return True ++ # Special case: allow http -> https redirect when using the standard ++ # ports. This isn't specified by RFC 7235, but is kept to avoid ++ # breaking backwards compatibility with older versions of requests ++ # that allowed any redirects on the same host. ++ if (old_parsed.scheme == 'http' and old_parsed.port in (80, None) ++ and new_parsed.scheme == 'https' and new_parsed.port in (443, None)): ++ return False ++ # Standard case: root URI must match ++ return old_parsed.port != new_parsed.port or old_parsed.scheme != new_parsed.scheme ++ + def resolve_redirects(self, resp, req, stream=False, timeout=None, + verify=True, cert=None, proxies=None, yield_requests=False, **adapter_kwargs): + """Receives a Response. Returns a generator of Responses or Requests.""" +@@ -236,16 +252,10 @@ class SessionRedirectMixin(object): + headers = prepared_request.headers + url = prepared_request.url + +- if 'Authorization' in headers: ++ if 'Authorization' in headers and self.should_strip_auth(response.request.url, url): + # If we get redirected to a new host, we should strip out any + # authentication headers. +- original_parsed = urlparse(response.request.url) +- redirect_parsed = urlparse(url) +- +- if (original_parsed.hostname != redirect_parsed.hostname +- or original_parsed.port != redirect_parsed.port +- or original_parsed.scheme != redirect_parsed.scheme): +- del headers['Authorization'] ++ del headers['Authorization'] + + # .netrc might have more auth for us on our new host. + new_auth = get_netrc_auth(url) if self.trust_env else None +diff --git a/tests/test_requests.py b/tests/test_requests.py +index e0e801a..148067b 100644 +--- a/tests/test_requests.py ++++ b/tests/test_requests.py +@@ -1567,17 +1567,7 @@ class TestRequests: + preq = req.prepare() + assert test_url == preq.url + +- @pytest.mark.xfail(raises=ConnectionError) +- def test_auth_is_stripped_on_redirect_off_host(self, httpbin): +- r = requests.get( +- httpbin('redirect-to'), +- params={'url': 'http://www.google.co.uk'}, +- auth=('user', 'pass'), +- ) +- assert r.history[0].request.headers['Authorization'] +- assert 'Authorization' not in r.request.headers +- +- def test_auth_is_stripped_on_scheme_redirect(self, httpbin, httpbin_secure, httpbin_ca_bundle): ++ def test_auth_is_stripped_on_http_downgrade(self, httpbin, httpbin_secure, httpbin_ca_bundle): + r = requests.get( + httpbin_secure('redirect-to'), + params={'url': httpbin('get')}, +@@ -1594,6 +1584,27 @@ class TestRequests: + + assert h1 == h2 + ++ def test_should_strip_auth_host_change(self): ++ s = requests.Session() ++ assert s.should_strip_auth('http://example.com/foo', 'http://another.example.com/') ++ ++ def test_should_strip_auth_http_downgrade(self): ++ s = requests.Session() ++ assert s.should_strip_auth('https://example.com/foo', 'http://example.com/bar') ++ ++ def test_should_strip_auth_https_upgrade(self): ++ s = requests.Session() ++ assert not s.should_strip_auth('http://example.com/foo', 'https://example.com/bar') ++ assert not s.should_strip_auth('http://example.com:80/foo', 'https://example.com/bar') ++ assert not s.should_strip_auth('http://example.com/foo', 'https://example.com:443/bar') ++ # Non-standard ports should trigger stripping ++ assert s.should_strip_auth('http://example.com:8080/foo', 'https://example.com/bar') ++ assert s.should_strip_auth('http://example.com/foo', 'https://example.com:8443/bar') ++ ++ def test_should_strip_auth_port_change(self): ++ s = requests.Session() ++ assert s.should_strip_auth('http://example.com:1234/foo', 'https://example.com:4321/bar') ++ + def test_manual_redirect_with_partial_body_read(self, httpbin): + s = requests.Session() + r1 = s.get(httpbin('redirect/2'), allow_redirects=False, stream=True) +-- +2.7.4 + |