diff options
Diffstat (limited to 'dev-python/js2py')
| -rw-r--r-- | dev-python/js2py/Manifest | 1 | ||||
| -rw-r--r-- | dev-python/js2py/files/js2py-0.74-CVE-2024-28397.patch | 21 | ||||
| -rw-r--r-- | dev-python/js2py/files/js2py-0.74-py312-load_attr.patch | 57 | ||||
| -rw-r--r-- | dev-python/js2py/js2py-0.74-r2.ebuild | 47 | ||||
| -rw-r--r-- | dev-python/js2py/metadata.xml | 9 |
5 files changed, 135 insertions, 0 deletions
diff --git a/dev-python/js2py/Manifest b/dev-python/js2py/Manifest new file mode 100644 index 000000000000..b697ae236583 --- /dev/null +++ b/dev-python/js2py/Manifest @@ -0,0 +1 @@ +DIST Js2Py-0.74.tar.gz 2504984 BLAKE2B 1e4f34ad94947118aeaf84ff438f9bec5b2a8ca3c722d907d3b8015acfcaafe1f229cfe401ae0f3d07c0f074ecf2f9ca3aeb94ef9c394b7ed6d90f1279c1ffa2 SHA512 cb2f42c2bec0c15dadc301ee0a7ac452cc8c4bba4669e95f1155863590d6d00781883b54d4dab755a0f66eb6e30990fedca732494b1f8b6c07dc29f5203a8c8c diff --git a/dev-python/js2py/files/js2py-0.74-CVE-2024-28397.patch b/dev-python/js2py/files/js2py-0.74-CVE-2024-28397.patch new file mode 100644 index 000000000000..c8ecfab22485 --- /dev/null +++ b/dev-python/js2py/files/js2py-0.74-CVE-2024-28397.patch @@ -0,0 +1,21 @@ +# https://nvd.nist.gov/vuln/detail/CVE-2024-28397 +# https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape/blob/main/patch.txt +# https://github.com/PiotrDabkowski/Js2Py/pull/323 +# https://github.com/Marven11/Js2Py/commit/56e244eb + +Author: Marven11 <110723864+Marven11@users.noreply.github.com> +Date: Fri, 1 Mar 2024 12:53:58 +0800 + +diff --git a/js2py/constructors/jsobject.py b/js2py/constructors/jsobject.py +index c4e0ada3..b1806ea6 100644 +--- a/js2py/constructors/jsobject.py ++++ b/js2py/constructors/jsobject.py +@@ -49,7 +49,7 @@ def getOwnPropertyNames(obj): + raise MakeError( + 'TypeError', + 'Object.getOwnPropertyDescriptor called on non-object') +- return obj.own.keys() ++ return list(obj.own.keys()) + + def create(obj): + if not (obj.is_object() or obj.is_null()): diff --git a/dev-python/js2py/files/js2py-0.74-py312-load_attr.patch b/dev-python/js2py/files/js2py-0.74-py312-load_attr.patch new file mode 100644 index 000000000000..6dfa467cc41f --- /dev/null +++ b/dev-python/js2py/files/js2py-0.74-py312-load_attr.patch @@ -0,0 +1,57 @@ +From fd7df4a91fb08060914c7b1d9e94583d18f3371b Mon Sep 17 00:00:00 2001 +From: Felix Yan <felixonmars@archlinux.org> +Date: Wed, 17 Apr 2024 16:47:47 +0300 +Subject: [PATCH] Fix bytecode for Python 3.12 + +`LOAD_ATTR` has been changed in Python 3.12 and it seems reusing the +`LOAD_GLOBAL` logic makes the simple tests passing. + +I am not sure if this is correct since I'm pretty new to the code, but +maybe it's still helpful. +--- + js2py/translators/translating_nodes.py | 2 +- + js2py/utils/injector.py | 4 +++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/js2py/translators/translating_nodes.py b/js2py/translators/translating_nodes.py +index 4e2b5760..a780ba73 100644 +--- a/js2py/translators/translating_nodes.py ++++ b/js2py/translators/translating_nodes.py +@@ -543,7 +543,7 @@ def TryStatement(type, block, handler, handlers, guardedHandlers, finalizer): + if handler: + identifier = handler['param']['name'] + holder = 'PyJsHolder_%s_%d' % (to_hex(identifier), +- random.randrange(1e8)) ++ random.randrange(six.integer_types[-1](1e8))) + identifier = repr(identifier) + result += 'except PyJsException as PyJsTempException:\n' + # fill in except ( catch ) block and remember to recover holder variable to its previous state +diff --git a/js2py/utils/injector.py b/js2py/utils/injector.py +index 88e0d93e..835229f0 100644 +--- a/js2py/utils/injector.py ++++ b/js2py/utils/injector.py +@@ -14,6 +14,7 @@ + # Opcode constants used for comparison and replacecment + LOAD_FAST = opcode.opmap['LOAD_FAST'] + LOAD_GLOBAL = opcode.opmap['LOAD_GLOBAL'] ++LOAD_ATTR = opcode.opmap['LOAD_ATTR'] + STORE_FAST = opcode.opmap['STORE_FAST'] + + +@@ -79,6 +80,7 @@ def append_arguments(code_obj, new_locals): + (co_names.index(name), varnames.index(name)) for name in new_locals) + + is_new_bytecode = sys.version_info >= (3, 11) ++ is_new_load_attr = sys.version_info >= (3, 12) + # Now we modify the actual bytecode + modified = [] + drop_future_cache = False +@@ -97,7 +99,7 @@ def append_arguments(code_obj, new_locals): + # it's one of the globals that we are replacing. Either way, + # update its arg using the appropriate dict. + drop_future_cache = False +- if inst.opcode == LOAD_GLOBAL: ++ if inst.opcode == LOAD_GLOBAL or (is_new_load_attr and inst.opcode == LOAD_ATTR): + idx = inst.arg + if is_new_bytecode: + idx = idx // 2 diff --git a/dev-python/js2py/js2py-0.74-r2.ebuild b/dev-python/js2py/js2py-0.74-r2.ebuild new file mode 100644 index 000000000000..d1e190e17b9d --- /dev/null +++ b/dev-python/js2py/js2py-0.74-r2.ebuild @@ -0,0 +1,47 @@ +# Copyright 1999-2024 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +DISTUTILS_USE_PEP517=setuptools +PYPI_NO_NORMALIZE=1 +PYPI_PN="Js2Py" +PYTHON_COMPAT=( python3_{13..14} ) + +inherit distutils-r1 pypi + +DESCRIPTION="JavaScript to Python Translator & JavaScript interpreter in Python" +HOMEPAGE="http://piter.io/projects/js2py + https://github.com/PiotrDabkowski/Js2Py + https://pypi.org/project/Js2Py/" + +LICENSE="MIT" +SLOT="0" +KEYWORDS="amd64 ~arm arm64 ~hppa ~mips ~ppc ~ppc64 ~s390 ~sparc x86" +RESTRICT="test" + +RDEPEND=" + >=dev-python/pyjsparser-2.5.1[${PYTHON_USEDEP}] + >=dev-python/tzlocal-1.2.0[${PYTHON_USEDEP}] + >=dev-python/six-1.10.0[${PYTHON_USEDEP}] +" + +PATCHES=( + "${FILESDIR}/${PN}-0.74-CVE-2024-28397.patch" + "${FILESDIR}/${PN}-0.74-py312-load_attr.patch" +) + +python_test() { + pushd ./tests >/dev/null || die + + # run.py requires "node_failed.txt" file + touch ./node_failed.txt || die + + # https://bugs.gentoo.org/831356 + # make run.py return a non-zero exit code if any test failed + echo 'sys.exit(len(FAILING))' >> ./run.py || die + + "${EPYTHON}" ./run.py || die "tests failed with ${EPYTHON}" + + popd >/dev/null || die +} diff --git a/dev-python/js2py/metadata.xml b/dev-python/js2py/metadata.xml new file mode 100644 index 000000000000..b3a44919ce8d --- /dev/null +++ b/dev-python/js2py/metadata.xml @@ -0,0 +1,9 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd"> +<pkgmetadata> + <maintainer type="person"> + <email>xgqt@gentoo.org</email> + <name>Maciej Barć</name> + </maintainer> + <origin>baldeagleos-repo</origin> +</pkgmetadata> |