diff --git a/1.26.18.tar.gz b/1.26.18.tar.gz deleted file mode 100644 index 61208b3126ab5c336c508da53aef0b3f3bafe5fb..0000000000000000000000000000000000000000 Binary files a/1.26.18.tar.gz and /dev/null differ diff --git a/backport-CVE-2024-37891-Strip-Proxy-Authorization-header-on-redirects.patch b/backport-CVE-2024-37891-Strip-Proxy-Authorization-header-on-redirects.patch deleted file mode 100644 index dd9c8f32cc2921503b3fa168b55af638568f2ab6..0000000000000000000000000000000000000000 --- a/backport-CVE-2024-37891-Strip-Proxy-Authorization-header-on-redirects.patch +++ /dev/null @@ -1,72 +0,0 @@ -From accff72ecc2f6cf5a76d9570198a93ac7c90270e Mon Sep 17 00:00:00 2001 -From: Quentin Pradet <quentin.pradet@gmail.com> -Date: Mon, 17 Jun 2024 11:09:06 +0400 -Subject: [PATCH] Merge pull request from GHSA-34jh-p97f-mpxf - -* Strip Proxy-Authorization header on redirects - -* Fix test_retry_default_remove_headers_on_redirect - -* Set release date - -Conflict:test/with_dummyserver/test_poolmanager.py hsa not been modified -because it has been deleted in the pre-phase of the spec file -Reference:https://github.com/urllib3/urllib3/commit/accff72ecc2f6cf5a76d9570198a93ac7c90270e - ---- - CHANGES.rst | 5 +++++ - src/urllib3/util/retry.py | 4 +++- - test/test_retry.py | 6 +++++- - 3 files changed, 13 insertions(+), 2 deletions(-) - -diff --git a/CHANGES.rst b/CHANGES.rst -index 3a0a4f0..eba0814 100644 ---- a/CHANGES.rst -+++ b/CHANGES.rst -@@ -1,6 +1,11 @@ - Changes - ======= - -+2.2.2 (2024-06-17) -+================== -+ -+- Added the ``Proxy-Authorization`` header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via ``Retry.remove_headers_on_redirect``. -+ - 1.26.18 (2023-10-17) - -------------------- - -diff --git a/src/urllib3/util/retry.py b/src/urllib3/util/retry.py -index 60ef6c4..9a1e90d 100644 ---- a/src/urllib3/util/retry.py -+++ b/src/urllib3/util/retry.py -@@ -235,7 +235,9 @@ class Retry(object): - RETRY_AFTER_STATUS_CODES = frozenset([413, 429, 503]) - - #: Default headers to be used for ``remove_headers_on_redirect`` -- DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset(["Cookie", "Authorization"]) -+ DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset( -+ ["Cookie", "Authorization", "Proxy-Authorization"] -+ ) - - #: Maximum backoff time. - DEFAULT_BACKOFF_MAX = 120 -diff --git a/test/test_retry.py b/test/test_retry.py -index 6475f2a..a0463e4 100644 ---- a/test/test_retry.py -+++ b/test/test_retry.py -@@ -296,7 +296,11 @@ class TestRetry(object): - def test_retry_default_remove_headers_on_redirect(self): - retry = Retry() - -- assert retry.remove_headers_on_redirect == {"authorization", "cookie"} -+ assert retry.remove_headers_on_redirect == { -+ "authorization", -+ "proxy-authorization", -+ "cookie", -+ } - - def test_retry_set_remove_headers_on_redirect(self): - retry = Retry(remove_headers_on_redirect=["X-API-Secret"]) --- -2.33.0 - diff --git a/python-urllib3.spec b/python-urllib3.spec index 51d96ce184985cfa85e55c4ff34aa85bb853f2d8..b7a1b4f888ec813b0d2ebc5b40befccacd23b177 100644 --- a/python-urllib3.spec +++ b/python-urllib3.spec @@ -2,18 +2,14 @@ %bcond_without tests Name: python-%{srcname} -Version: 1.26.18 -Release: 2 +Version: 2.3.0 +Release: 1 Summary: Sanity-friendly HTTP client for Python License: MIT -URL: https://urllib3.readthedocs.io -Source0: https://github.com/urllib3/urllib3/archive/refs/tags/%{version}.tar.gz +URL: https://github.com/urllib3/urllib3 +Source0: %{url}/archive/%{version}/%{srcname}-%{version}.tar.gz Source1: ssl_match_hostname_py3.py -Patch0001: remove_mock.patch - -Patch6000: backport-CVE-2024-37891-Strip-Proxy-Authorization-header-on-redirects.patch - BuildArch: noarch %description @@ -24,10 +20,16 @@ Summary: Python3 HTTP library with thread-safe connection pooling and fil BuildRequires: python3-devel BuildRequires: python3-setuptools +BuildRequires: python3-pip +BuildRequires: python3-wheel +BuildRequires: python3-editables +BuildRequires: python3-hatch-vcs +BuildRequires: python3-hatchling %if %{with tests} BuildRequires: python3-cryptography python3-mock python3-six python-idna python-dateutil BuildRequires: python3-pysocks python3-pytest python3-tornado python-trustme +BuildRequires: python3-trio python3-quart %endif Requires: ca-certificates python3-idna python3-six python3-pysocks @@ -48,16 +50,18 @@ rm -rf test/contrib/ rm -rf test/test_no_ssl.py %build -%py3_build +export SETUPTOOLS_SCM_PRETEND_VERSION='%{version}' +%pyproject_build %install -%py3_install +%pyproject_install rm -rf %{buildroot}%{python3_sitelib}/urllib3/packages/six.py rm -rf %{buildroot}%{python3_sitelib}/urllib3/packages/__pycache__/six.* rm -rf %{buildroot}%{python3_sitelib}/urllib3/packages/ssl_match_hostname/ mkdir -p %{buildroot}/%{python3_sitelib}/urllib3/packages/ +mkdir -p %{buildroot}/%{python3_sitelib}/urllib3/packages/__pycache__/ cp -a %{SOURCE1} %{buildroot}/%{python3_sitelib}/urllib3/packages/ssl_match_hostname.py ln -s %{python3_sitelib}/six.py %{buildroot}/%{python3_sitelib}/urllib3/packages/six.py ln -s %{python3_sitelib}/__pycache__/six.cpython-%{python3_version_nodots}.opt-1.pyc %{buildroot}/%{python3_sitelib}/urllib3/packages/__pycache__/ @@ -73,11 +77,19 @@ PYTHONPATH=%{buildroot}%{python3_sitelib}:%{python3_sitelib} %{__python3} -m pyt %files -n python3-urllib3 %defattr(-,root,root) %license LICENSE.txt -%doc CHANGES.rst README.rst +%doc CHANGES.rst README.md %{python3_sitelib}/urllib3/ -%{python3_sitelib}/urllib3-*.egg-info +%{python3_sitelib}/urllib3-*.dist-info %changelog +* Wed Feb 26 2025 Dongxing Wang <dongxing.wang_a@thundersoft.com> - 2.3.0-1 +- Update to 2.3.0 + Added the proxy_is_tunneling property to HTTPConnection and HTTPSConnection + Added pickling support to NewConnectionError and NameResolutionError + Added support for JavaScript Promise Integration on Emscripten + Added HTTPResponse.shutdown() to stop any ongoing or future reads for a specific response + Fixed an issue in debug logs where the HTTP version was rendering as "HTTP/11" instead of "HTTP/1.1" + * Tue Jun 25 2024 chengyechun <chengyechun1@huawei.com> - 1.26.18-2 - Type:CVE - CVE:CVE-2024-37891 diff --git a/remove_mock.patch b/remove_mock.patch deleted file mode 100644 index ab16381db82d2b0d81d35c899d407f5b1febf92c..0000000000000000000000000000000000000000 --- a/remove_mock.patch +++ /dev/null @@ -1,251 +0,0 @@ -Index: urllib3-1.26.3/docs/conf.py -=================================================================== ---- urllib3-1.26.3.orig/docs/conf.py -+++ urllib3-1.26.3/docs/conf.py -@@ -14,7 +14,10 @@ sys.path.insert(0, root_path) - # Mock some expensive/platform-specific modules so build will work. - # (https://read-the-docs.readthedocs.io/en/latest/faq.html#\ - # i-get-import-errors-on-libraries-that-depend-on-c-modules) --import mock -+try: -+ import unittest.mock as mock -+except ImportError: -+ import mock - - - class MockModule(mock.Mock): -Index: urllib3-1.26.3/test/appengine/test_urlfetch.py -=================================================================== ---- urllib3-1.26.3.orig/test/appengine/test_urlfetch.py -+++ urllib3-1.26.3/test/appengine/test_urlfetch.py -@@ -5,7 +5,10 @@ Engine-patched version of httplib to mak - import httplib - import pytest - import StringIO --from mock import patch -+try: -+ from unittest.mock import patch -+except ImportError: -+ from mock import patch - - from ..test_no_ssl import TestWithoutSSL - -Index: urllib3-1.26.3/test/contrib/test_pyopenssl.py -=================================================================== ---- urllib3-1.26.3.orig/test/contrib/test_pyopenssl.py -+++ urllib3-1.26.3/test/contrib/test_pyopenssl.py -@@ -1,7 +1,10 @@ - # -*- coding: utf-8 -*- - import os - --import mock -+try: -+ import unittest.mock as mock -+except ImportError: -+ import mock - import pytest - - try: -Index: urllib3-1.26.3/test/contrib/test_pyopenssl_dependencies.py -=================================================================== ---- urllib3-1.26.3.orig/test/contrib/test_pyopenssl_dependencies.py -+++ urllib3-1.26.3/test/contrib/test_pyopenssl_dependencies.py -@@ -1,6 +1,9 @@ - # -*- coding: utf-8 -*- - import pytest --from mock import Mock, patch -+try: -+ from unittest.mock import Mock, patch -+except ImportError: -+ from mock import Mock, patch - - try: - from urllib3.contrib.pyopenssl import extract_from_urllib3, inject_into_urllib3 -Index: urllib3-1.26.3/test/test_connection.py -=================================================================== ---- urllib3-1.26.3.orig/test/test_connection.py -+++ urllib3-1.26.3/test/test_connection.py -@@ -1,6 +1,9 @@ - import datetime - --import mock -+try: -+ import unittest.mock as mock -+except ImportError: -+ import mock - import pytest - - from urllib3.connection import RECENT_DATE, CertificateError, _match_hostname -Index: urllib3-1.26.3/test/test_connectionpool.py -=================================================================== ---- urllib3-1.26.3.orig/test/test_connectionpool.py -+++ urllib3-1.26.3/test/test_connectionpool.py -@@ -6,7 +6,10 @@ from ssl import SSLError as BaseSSLError - from test import SHORT_TIMEOUT - - import pytest --from mock import Mock -+try: -+ from unittest.mock import Mock -+except ImportError: -+ from mock import Mock - - from dummyserver.server import DEFAULT_CA - from urllib3._collections import HTTPHeaderDict -Index: urllib3-1.26.3/test/test_queue_monkeypatch.py -=================================================================== ---- urllib3-1.26.3.orig/test/test_queue_monkeypatch.py -+++ urllib3-1.26.3/test/test_queue_monkeypatch.py -@@ -1,6 +1,9 @@ - from __future__ import absolute_import - --import mock -+try: -+ import unittest.mock as mock -+except ImportError: -+ import mock - import pytest - - from urllib3 import HTTPConnectionPool -Index: urllib3-1.26.3/test/test_response.py -=================================================================== ---- urllib3-1.26.3.orig/test/test_response.py -+++ urllib3-1.26.3/test/test_response.py -@@ -9,7 +9,10 @@ from base64 import b64decode - from io import BufferedReader, BytesIO, TextIOWrapper - from test import onlyBrotlipy - --import mock -+try: -+ import unittest.mock as mock -+except ImportError: -+ import mock - import pytest - import six - -Index: urllib3-1.26.3/test/test_retry.py -=================================================================== ---- urllib3-1.26.3.orig/test/test_retry.py -+++ urllib3-1.26.3/test/test_retry.py -@@ -1,6 +1,9 @@ - import warnings - --import mock -+try: -+ import unittest.mock as mock -+except ImportError: -+ import mock - import pytest - - from urllib3.exceptions import ( -Index: urllib3-1.26.3/test/test_retry_deprecated.py -=================================================================== ---- urllib3-1.26.3.orig/test/test_retry_deprecated.py -+++ urllib3-1.26.3/test/test_retry_deprecated.py -@@ -1,7 +1,10 @@ - # This is a copy-paste of test_retry.py with extra asserts about deprecated options. It will be removed for v2. - import warnings - --import mock -+try: -+ import unittest.mock as mock -+except ImportError: -+ import mock - import pytest - - from urllib3.exceptions import ( -Index: urllib3-1.26.3/test/test_ssl.py -=================================================================== ---- urllib3-1.26.3.orig/test/test_ssl.py -+++ urllib3-1.26.3/test/test_ssl.py -@@ -1,6 +1,9 @@ - from test import notPyPy2 - --import mock -+try: -+ import unittest.mock as mock -+except ImportError: -+ import mock - import pytest - - from urllib3.exceptions import SNIMissingWarning -Index: urllib3-1.26.3/test/test_ssltransport.py -=================================================================== ---- urllib3-1.26.3.orig/test/test_ssltransport.py -+++ urllib3-1.26.3/test/test_ssltransport.py -@@ -4,7 +4,10 @@ import socket - import ssl - import sys - --import mock -+try: -+ import unittest.mock as mock -+except ImportError: -+ import mock - import pytest - - from dummyserver.server import DEFAULT_CA, DEFAULT_CERTS -Index: urllib3-1.26.3/test/test_util.py -=================================================================== ---- urllib3-1.26.3.orig/test/test_util.py -+++ urllib3-1.26.3/test/test_util.py -@@ -9,7 +9,10 @@ from itertools import chain - from test import notBrotlipy, onlyBrotlipy, onlyPy2, onlyPy3 - - import pytest --from mock import Mock, patch -+try: -+ from unittest.mock import Mock, patch -+except ImportError: -+ from mock import Mock, patch - - from urllib3 import add_stderr_logger, disable_warnings, util - from urllib3.exceptions import ( -Index: urllib3-1.26.3/test/with_dummyserver/test_connectionpool.py -=================================================================== ---- urllib3-1.26.3.orig/test/with_dummyserver/test_connectionpool.py -+++ urllib3-1.26.3/test/with_dummyserver/test_connectionpool.py -@@ -10,7 +10,10 @@ import warnings - from test import LONG_TIMEOUT, SHORT_TIMEOUT, onlyPy2 - from threading import Event - --import mock -+try: -+ import unittest.mock as mock -+except ImportError: -+ import mock - import pytest - import six - -Index: urllib3-1.26.3/test/with_dummyserver/test_https.py -=================================================================== ---- urllib3-1.26.3.orig/test/with_dummyserver/test_https.py -+++ urllib3-1.26.3/test/with_dummyserver/test_https.py -@@ -19,7 +19,10 @@ from test import ( - resolvesLocalhostFQDN, - ) - --import mock -+try: -+ import unittest.mock as mock -+except ImportError: -+ import mock - import pytest - import trustme - -Index: urllib3-1.26.3/test/with_dummyserver/test_socketlevel.py -=================================================================== ---- urllib3-1.26.3.orig/test/with_dummyserver/test_socketlevel.py -+++ urllib3-1.26.3/test/with_dummyserver/test_socketlevel.py -@@ -52,7 +52,10 @@ from test import ( - ) - from threading import Event - --import mock -+try: -+ import unittest.mock as mock -+except ImportError: -+ import mock - import pytest - import trustme - diff --git a/urllib3-2.3.0.tar.gz b/urllib3-2.3.0.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..61650ab6e93dec08fc9a87aa50ba7f051214c4ec Binary files /dev/null and b/urllib3-2.3.0.tar.gz differ