!24 [sync] PR-23: Fix CVE-2023-45139

From: @openeuler-sync-bot 
Reviewed-by: @lyn1001 
Signed-off-by: @lyn1001

CVE-2023-45139.patch

@@ -0,0 +1,26 @@
+From 9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4c Mon Sep 17 00:00:00 2001
+From: Cosimo Lupo <clupo@google.com>
+Date: Fri, 15 Sep 2023 16:50:38 +0200
+Subject: [PATCH] subset: parse OT-SVG with resolve_entities=False
+
+Origin: https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4c
+
+to guard against XXE attacks as recommended in https://codeql.github.com/codeql-query-help/python/py-xxe/
+---
+ Lib/fontTools/subset/svg.py | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/Lib/fontTools/subset/svg.py b/Lib/fontTools/subset/svg.py
+index f6d74a4002..2e55bf54c0 100644
+--- a/Lib/fontTools/subset/svg.py
++++ b/Lib/fontTools/subset/svg.py
+@@ -225,6 +225,9 @@ def subset_glyphs(self, s) -> bool:
+                 # ignore blank text as it's not meaningful in OT-SVG; it also prevents
+                 # dangling tail text after removing an element when pretty_print=True
+                 remove_blank_text=True,
++                # don't replace entities; we don't expect any in OT-SVG and they may
++                # aboused for XXE attacks
++                resolve_entities=False,
+             ),
+         )
+ 

python-fonttools.spec

@@ -1,11 +1,13 @@
 Name:           fonttools
-Version:        3.29.0
+Version:        4.39.4
-Release:        3
+Release:        2
 Summary:        Tools to manipulate font files
 License:        MIT
 URL:            https://github.com/fonttools/fonttools/
-Source0:        %{url}/releases/download/%{version}/fonttools-%{version}.zip
+Source0:        %{url}/archive/refs/tags/%{version}.tar.gz
+Patch0:         CVE-2023-45139.patch
 Requires:       python3-fonttools
+Requires:       python3-setuptools
 BuildArch:      noarch
 Provides:       ttx = %{version}-%{release}
 
@@ -19,8 +21,9 @@ project has an MIT open-source licence.
 %package -n python3-fonttools
 Summary:        Python 3 fonttools library
 BuildRequires:  python3-devel python3-numpy python3-setuptools_scm
+BuildRequires:  python3-setuptools
 BuildArch:      noarch
-Requires:       python3-numpy
+
 %{?python_provide:%python_provide python3-fonttools}
 
 %description -n python3-fonttools
@@ -59,9 +62,24 @@ rm -rf *.egg-info
 %files -n python3-fonttools
 %doc LICENSE
 %{python3_sitelib}/fontTools
-%{python3_sitelib}/fonttools-%{version}-py3.?.egg-info
+%{python3_sitelib}/fonttools-%{version}-py3.*.egg-info
 
 %changelog
+* Thu Jan 11 2024 wangkai <13474090681@163.com> - 4.39.4-2
+- Fix CVE-2023-45139
+
+* Mon Dec 11 2023 wangkai <13474090681@163.com> - 4.39.4-1
+- Update fonttools to 4.39.4
+
+* Mon Jan 9 2023 zhangliangpengkun<zhangliangpengkun@xfusion.com> - 3.29.0-6 
+- fix test
+
+* Tue Jan 11 2022 houyingchao <houyingchao@huawei.com> - 3.29.0-5
+- Replace totring with tobytes
+
+* Fri Jan 07 2022 houyingchao <houyingchao@huawei.com> - 3.29.0-4
+- Replace fromtring with frombytes
+
 * Thu Oct 22 2020 huanghaitao <huannghaitao8@huawei.com> - 3.29.0-3
 - Disable python2 module