python-mako/CVE-2022-40023.patch
hongjinghao c433a4fc14 sync by 22.03-lts-sp1
(cherry picked from commit 7bd409e4ac89cc0e0a8bad3afd0d86675d1575fd)
2024-05-28 14:27:01 +08:00

34 lines
1008 B
Diff

diff -urN mako/lexer.py mako.new/lexer.py
--- mako/lexer.py 2021-01-15 02:28:51.000000000 +0800
+++ mako.new/lexer.py 2022-09-22 11:19:51.277358075 +0800
@@ -295,20 +295,24 @@
return self.template
def match_tag_start(self):
- match = self.match(
- r"""
+ reg = r"""
\<% # opening tag
([\w\.\:]+) # keyword
- ((?:\s+\w+|\s*=\s*|".*?"|'.*?')*) # attrname, = \
- # sign, string expression
+ ((?:\s+\w+|\s*=\s*|"[^"]*?"|'[^']*?'|\s*,\s*)*) # attrname, = \
+ # sign, string expression
+ # comma is for backwards compat
+ # identified in #366
\s* # more whitespace
(/)?> # closing
- """,
+ """
+
+ match = self.match(
+ reg,
re.I | re.S | re.X,
)