!33 [sync] PR-27: Fix CVE-2024-34062

From: @openeuler-sync-bot 
Reviewed-by: @cherry530 
Signed-off-by: @cherry530

CVE-2024-34062.patch

@@ -0,0 +1,60 @@
+From b53348c73080b4edeb30b4823d1fa0d8d2c06721 Mon Sep 17 00:00:00 2001
+From: Casper da Costa-Luis <tqdm@cdcl.ml>
+Date: Wed, 1 May 2024 14:56:01 +0100
+Subject: [PATCH] cli: eval safety
+
+- fixes GHSA-g7vv-2v7x-gj9p
+---
+ tqdm/cli.py | 33 ++++++++++++++++++++++-----------
+ 1 file changed, 22 insertions(+), 11 deletions(-)
+
+diff --git a/tqdm/cli.py b/tqdm/cli.py
+index 1223d4977..7284f28d5 100644
+--- a/tqdm/cli.py
++++ b/tqdm/cli.py
+@@ -21,23 +21,34 @@ def cast(val, typ):
+                 return cast(val, t)
+             except TqdmTypeError:
+                 pass
+-        raise TqdmTypeError(val + ' : ' + typ)
++        raise TqdmTypeError(f"{val} : {typ}")
+ 
+     # sys.stderr.write('\ndebug | `val:type`: `' + val + ':' + typ + '`.\n')
+     if typ == 'bool':
+         if (val == 'True') or (val == ''):
+             return True
+-        elif val == 'False':
++        if val == 'False':
+             return False
+-        else:
+-            raise TqdmTypeError(val + ' : ' + typ)
+-    try:
+-        return eval(typ + '("' + val + '")')
+-    except Exception:
+-        if typ == 'chr':
+-            return chr(ord(eval('"' + val + '"'))).encode()
+-        else:
+-            raise TqdmTypeError(val + ' : ' + typ)
++        raise TqdmTypeError(val + ' : ' + typ)
++    if typ == 'chr':
++        if len(val) == 1:
++            return val.encode()
++        if re.match(r"^\\\w+$", val):
++            return eval(f'"{val}"').encode()
++        raise TqdmTypeError(f"{val} : {typ}")
++    if typ == 'str':
++        return val
++    if typ == 'int':
++        try:
++            return int(val)
++        except ValueError as exc:
++            raise TqdmTypeError(f"{val} : {typ}") from exc
++    if typ == 'float':
++        try:
++            return float(val)
++        except ValueError as exc:
++            raise TqdmTypeError(f"{val} : {typ}") from exc
++    raise TqdmTypeError(f"{val} : {typ}")
+ 
+ 
+ def posix_pipe(fin, fout, delim=b'\\n', buf_size=256,

python-tqdm.spec

@@ -1,14 +1,16 @@
 %global debug_package %{nil}
 
 Name:           python-tqdm
-Version:        4.28.1
+Version:        4.56.0
-Release:        2
+Release:        4
 Summary:        A Fast and Extensible Progress Bar for Python and CLI
 License:        MPLv2.0 and MIT
 URL:            https://github.com/tqdm/tqdm
-Source0:        https://github.com/tqdm/tqdm/archive/v%{version}/tqdm-%{version}.tar.gz
+Source0:        https://files.pythonhosted.org/packages/69/50/9f29874d835945b845812799edc732ba30c41e9d20431f9f69c8ffb9c670/tqdm-%{version}.tar.gz
+# https://github.com/tqdm/tqdm/commit/b53348c73080b4edeb30b4823d1fa0d8d2c06721
+Patch0:         CVE-2024-34062.patch
 
-BuildRequires:  python3-devel python3-setuptools
+BuildRequires:  python3-devel python3-setuptools gcc python3-toml python3-setuptools_scm
 
 %description
 tqdm derives from the Arabic word taqaddum which can mean "progress". Instantly 
@@ -52,7 +54,19 @@ mv -v %{buildroot}%{python3_sitelib}/tqdm/tqdm.1 %{buildroot}%{_mandir}/man1/
 %{_mandir}/man1/tqdm.1*
 
 %changelog
-* Thu Mar 28 2020 huanghaitao <huanghaitao8@huawei.com> - 4.28.1-2
+* Mon May 06 2024 yaoxin <yao_xin001@hoperun.com> - 4.56.0-4
+- Fix CVE-2024-34062
+
+* Mon Nov 14 2022 xu_ping <xuping33@h-partners.com> - 4.56.0-3
+- change source path
+
+* Thu Jun 24 2021 hanhui <hanhui15@huawei.com> - 4.56.0-2
+- add BuildRequires:gcc python3-toml python3-setuptools_scm
+
+* Mon Feb 1 2021 chengguipeng <chengguiopeng1@huawei.com> - 4.56.0-1
+- Update to 4.56.0
+
+* Thu May 28 2020 huanghaitao <huanghaitao8@huawei.com> - 4.28.1-2
 - Remove tests
 
 * Wed Mar 4 2020 hexiujun <hexiujun1@huawei.com> - 4.28.1-1