[meta-virtualization][scarthgap][PATCH 1/2] python3-webob: fix CVE-2024-42353

From: Darsh Kelaiya <[email protected]>

This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/Pylons/webob/commit/f689bcf4f0a1f64f1735b1d5069aef5be6974b5b
[2] https://nvd.nist.gov/vuln/detail/CVE-2024-42353

Signed-off-by: Darsh Kelaiya <[email protected]>
---
 .../python/python3-webob/CVE-2024-42353.patch | 56 +++++++++++++++++++
 .../python/python3-webob_1.8.7.bb             |  2 +
 2 files changed, 58 insertions(+)
 create mode 100644 recipes-devtools/python/python3-webob/CVE-2024-42353.patch

diff --git a/recipes-devtools/python/python3-webob/CVE-2024-42353.patch b/recipes-devtools/python/python3-webob/CVE-2024-42353.patch
new file mode 100644
index 00000000..56e7543f
--- /dev/null
+++ b/recipes-devtools/python/python3-webob/CVE-2024-42353.patch
@@ -0,0 +1,56 @@
+From a14a5b798de5b1145513660be64c09c7117f2b0d Mon Sep 17 00:00:00 2001
+From: Delta Regeer <[email protected]>
+Date: Wed, 7 Aug 2024 11:15:35 -0600
+Subject: [PATCH] Add fix for open redirect
+
+CVE: CVE-2024-42353
+Upstream-Status: Backport [https://github.com/Pylons/webob/commit/f689bcf4f0a1f64f1735b1d5069aef5be6974b5b]
+
+(cherry picked from commit f689bcf4f0a1f64f1735b1d5069aef5be6974b5b)
+Signed-off-by: Darsh Kelaiya <[email protected]>
+---
+ src/webob/response.py  |  5 +++++
+ tests/test_response.py | 11 +++++++++++
+ 2 files changed, 16 insertions(+)
+
+diff --git a/src/webob/response.py b/src/webob/response.py
+index 2aad591..efc38ec 100644
+--- a/src/webob/response.py
++++ b/src/webob/response.py
+@@ -1284,6 +1284,11 @@ class Response(object):
+         if SCHEME_RE.search(value):
+             return value
+ 
++        # This is to fix an open redirect issue due to the way that
++        # urlparse.urljoin works. See CVE-2024-42353 and
++        # https://github.com/Pylons/webob/security/advisories/GHSA-mg3v-6m49-jhp3
++        if value.startswith("//"):
++            value = "/%2f{}".format(value[2:])
+         new_location = urlparse.urljoin(_request_uri(environ), value)
+         return new_location
+ 
+diff --git a/tests/test_response.py b/tests/test_response.py
+index 9d9f9d3..8a6ac06 100644
+--- a/tests/test_response.py
++++ b/tests/test_response.py
+@@ -1031,6 +1031,17 @@ def test_location():
+     assert req.get_response(res).location == 'http://localhost/test2.html'
+ 
+ 
++def test_location_no_open_redirect():
++    # This is a test for a fix for CVE-2024-42353 and
++    # https://github.com/Pylons/webob/security/advisories/GHSA-mg3v-6m49-jhp3
++    res = Response()
++    res.status = "301"
++    res.location = "//www.example.com/test"
++    assert res.location == "//www.example.com/test"
++    req = Request.blank("/")
++    assert req.get_response(res).location == "http://localhost/%2fwww.example.com/test"
++
++
+ @pytest.mark.xfail(sys.version_info < (3,0),
+                    reason="Python 2.x unicode != str, WSGI requires str. Test "
+                    "added due to https://github.com/Pylons/webob/issues/247. "
+-- 
+2.44.4
+
diff --git a/recipes-devtools/python/python3-webob_1.8.7.bb b/recipes-devtools/python/python3-webob_1.8.7.bb
index d23ddfd2..5d7f74c8 100644
--- a/recipes-devtools/python/python3-webob_1.8.7.bb
+++ b/recipes-devtools/python/python3-webob_1.8.7.bb
@@ -14,3 +14,5 @@ RDEPENDS:${PN} += " \
 	python3-sphinx \
 	"
 
+SRC_URI += "file://CVE-2024-42353.patch \
+           "
-- 
2.35.6