!35 [sync] PR-32: fix CVE-2022-40897

From: @openeuler-sync-bot 
Reviewed-by: @gaoruoshu 
Signed-off-by: @gaoruoshu

backport-CVE-2022-40897.patch

@@ -0,0 +1,43 @@
+From 43a9c9bfa6aa626ec2a22540bea28d2ca77964be Mon Sep 17 00:00:00 2001
+From: "Jason R. Coombs" <jaraco@jaraco.com>
+Date: Fri, 4 Nov 2022 13:47:53 -0400
+Subject: [PATCH] Limit the amount of whitespace to search/backtrack.Fixes
+ #3659.
+
+---
+ setuptools/package_index.py           | 2 +-
+ setuptools/tests/test_packageindex.py | 8 ++++++++
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/setuptools/package_index.py b/setuptools/package_index.py
+index 270e7f3..e93fcc6 100644
+--- a/setuptools/package_index.py
++++ b/setuptools/package_index.py
+@@ -197,7 +197,7 @@ def unique_values(func):
+     return wrapper
+ 
+ 
+-REL = re.compile(r"""<([^>]*\srel\s*=\s*['"]?([^'">]+)[^>]*)>""", re.I)
++REL = re.compile(r"""<([^>]*\srel\s{0,10}=\s{0,10}['"]?([^'" >]+)[^>]*)>""", re.I)
+ # this line is here to fix emacs' cruddy broken syntax highlighting
+ 
+ 
+diff --git a/setuptools/tests/test_packageindex.py b/setuptools/tests/test_packageindex.py
+index 8e9435e..fc544c0 100644
+--- a/setuptools/tests/test_packageindex.py
++++ b/setuptools/tests/test_packageindex.py
+@@ -308,3 +308,11 @@ class TestPyPIConfig:
+         cred = cfg.creds_by_repository['https://pypi.org']
+         assert cred.username == 'jaraco'
+         assert cred.password == 'pity%'
++
++
++@pytest.mark.timeout(1)
++def test_REL_DoS():
++    """
++    REL should not hang on a contrived attack string.
++    """
++    setuptools.package_index.REL.search('< rel=' + ' ' * 2**12)
+-- 
+2.27.0
+

python-setuptools.spec

@@ -1,3 +1,4 @@
+%bcond_with bootstrap
 %bcond_with tests
 
 %global python3_record %{python3_sitelib}/setuptools-%{version}.dist-info/RECORD
@@ -7,12 +8,15 @@
 
 Name: python-setuptools
 Version: 59.4.0
-Release: 1
+Release: 5
 Summary: Easily build and distribute Python packages
 
 License: MIT and (BSD or ASL 2.0)
 URL: https://pypi.python.org/pypi/setuptools
 Source0: %{pypi_source setuptools %{version}}
+
+Patch6000: backport-CVE-2022-40897.patch
+
 Patch9000: bugfix-eliminate-random-order-in-metadata.patch
 
 BuildArch: noarch
@@ -23,7 +27,9 @@ BuildRequires: python3-pip, python3-mock
 BuildRequires: python3-pytest, python3-pytest-fixture-config
 BuildRequires: python3-pytest-virtualenv
 %endif
+%if %{without bootstrap}
 BuildRequires: python3-pip, python3-wheel
+%endif
 
 Provides: python-distribute = %{version}-%{release}, %{name}-wheel
 Obsoletes: python-distribute < 0.6.36-2, %{name}-wheel
@@ -37,6 +43,8 @@ This package contains a python wheel of setuptools to use with venv.
 
 %package -n python3-setuptools
 Summary: Easily build and distribute Python 3 packages
+Provides:  python%{python3_pkgversion}dist(setuptools) = %{version}
+Provides:  python%{python3_version}dist(setuptools) = %{version}
 Conflicts: python-setuptools < %{version}-%{release}
 
 %description -n python3-setuptools
@@ -58,9 +66,14 @@ rm setuptools/tests/test_integration.py
 chmod -x README.rst
 
 %build
+%if %{without bootstrap}
 %py3_build_wheel
+%else
+%py3_build
+%endif
 
 %install
+%if %{without bootstrap}
 %py3_install_wheel %{python_whlname}
 sed -i '/\/usr\/bin\/easy_install,/d' %{buildroot}%{python3_record}
 rm -rf %{buildroot}%{python3_sitelib}/{setuptools, pkg_resources}/tests
@@ -70,6 +83,9 @@ find %{buildroot}%{python3_sitelib} -name '*.exe' | xargs rm -f
 rm -r docs/{conf.py,_*}
 mkdir -p %{buildroot}%{python_whldir}
 install -p dist/%{python_whlname} -t %{buildroot}%{python_whldir}
+%else
+%py3_install
+%endif
 
 %if %{with tests}
 %check
@@ -79,8 +95,10 @@ PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=$(pwd) py.test-%{python3_version} --ignore=
 %files
 %defattr(-,root,root)
 %license LICENSE
+%if %{without bootstrap}
 %dir %{python_whldir}/
 %{python_whldir}/%{python_whlname}
+%endif
 
 %files -n python3-setuptools
 %defattr(-,root,root)
@@ -95,6 +113,21 @@ PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=$(pwd) py.test-%{python3_version} --ignore=
 
 
 %changelog
+* Wed Jan 04 2023 zhuofeng <zhuofeng2@huawei.com> - 59.4.0-5                                     
+- Type:CVE
+- CVE:CVE-2022-40897
+- SUG:NA
+- DESC:fix CVE-2022-40897
+
+* Thu Oct 27 2022 zhangruifang <zhangruifang1@h-partners.com> - 59.4.0-4
+- Rebuild for next release
+
+* Tue Jan 04 2022 shixuantong <shixuantong@huawei.com> - 59.4.0-3
+- Bootstrap for Python 3.9.9
+
+* Wed Dec 29 2021 shixuantong <shixuantong@huawei.com> - 59.4.0-2
+- add bootstrap for rebuild python3-3.9.9
+
 * Wed Dec 22 2021 renhongxun<renhongxun@huawei.com> - 59.4.0-1
 - upgrade version to 59.4.0