!24 [sync] PR-18: Fix CVE-2023-28370

From: @openeuler-sync-bot 
Reviewed-by: @lyn1001 
Signed-off-by: @lyn1001

CVE-2023-28370.patch

@@ -0,0 +1,35 @@
+From 32ad07c54e607839273b4e1819c347f5c8976b2f Mon Sep 17 00:00:00 2001
+From: Ben Darnell <ben@bendarnell.com>
+Date: Sat, 13 May 2023 20:58:52 -0400
+Subject: [PATCH] web: Fix an open redirect in StaticFileHandler
+
+Under some configurations the default_filename redirect could be exploited
+to redirect to an attacker-controlled site. This change refuses to redirect
+to URLs that could be misinterpreted.
+
+A test case for the specific vulnerable configuration will follow after the
+patch has been available.
+---
+ tornado/web.py | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/tornado/web.py b/tornado/web.py
+index 3b676e3c2..565140493 100644
+--- a/tornado/web.py
++++ b/tornado/web.py
+@@ -2879,6 +2879,15 @@ def validate_absolute_path(self, root: str, absolute_path: str) -> Optional[str]
+             # but there is some prefix to the path that was already
+             # trimmed by the routing
+             if not self.request.path.endswith("/"):
++                if self.request.path.startswith("//"):
++                    # A redirect with two initial slashes is a "protocol-relative" URL.
++                    # This means the next path segment is treated as a hostname instead
++                    # of a part of the path, making this effectively an open redirect.
++                    # Reject paths starting with two slashes to prevent this.
++                    # This is only reachable under certain configurations.
++                    raise HTTPError(
++                        403, "cannot redirect path with two initial slashes"
++                    )
+                 self.redirect(self.request.path + "/", permanent=True)
+                 return None
+             absolute_path = os.path.join(absolute_path, self.default_filename)

fix-erroneous-deprecation-warnings.patch

@@ -1,13 +0,0 @@
-diff --git a/tornado/test/runtests.py b/tornado/test/runtests.py
-index d5bd769..e4f938d 100644
---- a/tornado/test/runtests.py
-+++ b/tornado/test/runtests.py
-@@ -137,6 +137,8 @@ def main():
-     # 2.7 and 3.2
-     warnings.filterwarnings("ignore", category=DeprecationWarning,
-                             message="Please use assert.* instead")
-+    warnings.filterwarnings("ignore", category=PendingDeprecationWarning,
-+                            message="Please use assert.* instead")
-     # Twisted 15.0.0 triggers some warnings on py3 with -bb.
-     warnings.filterwarnings("ignore", category=BytesWarning,
-                             module=r"twisted\..*")

python-tornado.spec

@@ -1,65 +1,89 @@
-Name:             python-tornado
+%global _empty_manifest_terminate_build 0
-Version:          5.0.2
+Name:		python-tornado
-Release:          5
+Version:	6.1
-Summary:          a Python web framework and asynchronous networking library
+Release:	2
-License:          ASL 2.0
+Summary:	Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.
-URL:              http://www.tornadoweb.org
+License:	ASL 2.0
-Source0:          https://files.pythonhosted.org/packages/source/t/tornado/tornado-%{version}.tar.gz
+URL:		http://www.tornadoweb.org/
-Patch0:           fix-erroneous-deprecation-warnings.patch
+Source0:	https://files.pythonhosted.org/packages/cf/44/cc9590db23758ee7906d40cacff06c02a21c2a6166602e095a56cbf2f6f6/tornado-6.1.tar.gz
-
+Patch0:         CVE-2023-28370.patch
-BuildRequires:    gcc python2-devel python2-singledispatch python3-devel
 
 %description
-Tornado is a Python web framework and asynchronous networking library, originally
+Tornado is an open source version of the scalable, non-blocking web server and tools.
-developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to
-tens of thousands of open connections, making it ideal for long polling, WebSockets,
-and other applications that require a long-lived connection to each user.
-
-%package -n python2-tornado
-Summary:          a Python web framework and asynchronous networking library
-Requires:         python2-pycurl python2-backports_abc python2-singledispatch python2-futures
-
-%description -n python2-tornado
-Tornado is a Python web framework and asynchronous networking library, originally
-developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to
-tens of thousands of open connections, making it ideal for long polling, WebSockets,
-and other applications that require a long-lived connection to each user.
 
 %package -n python3-tornado
-Summary:          a Python web framework and asynchronous networking library
+Summary:	Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.
-Requires:         python3-pycurl
+Provides:	python-tornado
+BuildRequires:	python3-devel
+BuildRequires:	python3-setuptools
+BuildRequires:	python3-cffi
+BuildRequires:  python3-pycurl
+BuildRequires:	gcc
+BuildRequires:	gdb
 
 %description -n python3-tornado
-Tornado is a Python web framework and asynchronous networking library, originally
+Tornado is an open source version of the scalable, non-blocking web server and tools.
-developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to
+
-tens of thousands of open connections, making it ideal for long polling, WebSockets,
+%package help
-and other applications that require a long-lived connection to each user.
+Summary:	Development documents and examples for tornado
+Provides:	python3-tornado-doc
+
+%description help
+Tornado is an open source version of the scalable, non-blocking web server and tools.
 
 %prep
 %autosetup -n tornado-%{version} -p1
-%{__sed} -i.orig -e '/^#!\//, 1d' *py tornado/*.py tornado/*/*.py
 
 %build
-%py2_build
 %py3_build
 
 %install
-%py2_install
 %py3_install
+install -d -m755 %{buildroot}/%{_pkgdocdir}
+if [ -d doc ]; then cp -arf doc %{buildroot}/%{_pkgdocdir}; fi
+if [ -d docs ]; then cp -arf docs %{buildroot}/%{_pkgdocdir}; fi
+if [ -d example ]; then cp -arf example %{buildroot}/%{_pkgdocdir}; fi
+if [ -d examples ]; then cp -arf examples %{buildroot}/%{_pkgdocdir}; fi
+pushd %{buildroot}
+if [ -d usr/lib ]; then
+	find usr/lib -type f -printf "/%h/%f\n" >> filelist.lst
+fi
+if [ -d usr/lib64 ]; then
+	find usr/lib64 -type f -printf "/%h/%f\n" >> filelist.lst
+fi
+if [ -d usr/bin ]; then
+	find usr/bin -type f -printf "/%h/%f\n" >> filelist.lst
+fi
+if [ -d usr/sbin ]; then
+	find usr/sbin -type f -printf "/%h/%f\n" >> filelist.lst
+fi
+touch doclist.lst
+if [ -d usr/share/man ]; then
+	find usr/share/man -type f -printf "/%h/%f.gz\n" >> doclist.lst
+fi
+popd
+mv %{buildroot}/filelist.lst .
+mv %{buildroot}/doclist.lst .
 
-%files -n python2-tornado
-%defattr(-,root,root)
-%license LICENSE
-%doc README.rst
-%{python2_sitearch}/*
 
-%files -n python3-tornado
+%files -n python3-tornado -f filelist.lst
-%defattr(-,root,root)
+%dir %{python3_sitearch}/*
-%license LICENSE
+
-%doc README.rst
+%files help -f doclist.lst
-%{python3_sitearch}/*
+%{_docdir}/*
 
 %changelog
+* Fri Jun 16 2023 yaoxin <yao_xin001@hoperun.com> - 6.1-2
+- Fix CVE-2023-28370
+
+* Thu Jul 08 2021 yaozc701 <yaozc7@foxmail.com> - 6.1-1
+- Upgrade version to 6.1
+
+* Mon May 31 2021 huanghaitao <huanghaitao8@huawei.com> - 5.0.2-7
+- Completing build dependencies
+
+* Fri Sep 11 2020 zhangjiapeng <zhangjiapeng9@huawei.com> - 5.0.2-6
+- Remove python2-tornado subpackage
+
 * Tue Dec 10 2019 openEuler Buildteam <buildteam@openeuler.org> - 5.0.2-5
 - Package init
-