From 0ac140ef7d74bd144e665e7406dff7d5f384925b Mon Sep 17 00:00:00 2001 From: "Liguros - Gitlab CI/CD [develop]" Date: Tue, 25 Jun 2024 17:37:42 +0000 Subject: Adding metadata --- .../js2py/files/js2py-0.74-CVE-2024-28397.patch | 21 ++++++++ .../js2py/files/js2py-0.74-py312-load_attr.patch | 57 ++++++++++++++++++++++ dev-python/js2py/js2py-0.74-r2.ebuild | 47 ++++++++++++++++++ dev-python/js2py/js2py-0.74.ebuild | 40 --------------- 4 files changed, 125 insertions(+), 40 deletions(-) create mode 100644 dev-python/js2py/files/js2py-0.74-CVE-2024-28397.patch create mode 100644 dev-python/js2py/files/js2py-0.74-py312-load_attr.patch create mode 100644 dev-python/js2py/js2py-0.74-r2.ebuild delete mode 100644 dev-python/js2py/js2py-0.74.ebuild (limited to 'dev-python/js2py') diff --git a/dev-python/js2py/files/js2py-0.74-CVE-2024-28397.patch b/dev-python/js2py/files/js2py-0.74-CVE-2024-28397.patch new file mode 100644 index 000000000000..c8ecfab22485 --- /dev/null +++ b/dev-python/js2py/files/js2py-0.74-CVE-2024-28397.patch @@ -0,0 +1,21 @@ +# https://nvd.nist.gov/vuln/detail/CVE-2024-28397 +# https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape/blob/main/patch.txt +# https://github.com/PiotrDabkowski/Js2Py/pull/323 +# https://github.com/Marven11/Js2Py/commit/56e244eb + +Author: Marven11 <110723864+Marven11@users.noreply.github.com> +Date: Fri, 1 Mar 2024 12:53:58 +0800 + +diff --git a/js2py/constructors/jsobject.py b/js2py/constructors/jsobject.py +index c4e0ada3..b1806ea6 100644 +--- a/js2py/constructors/jsobject.py ++++ b/js2py/constructors/jsobject.py +@@ -49,7 +49,7 @@ def getOwnPropertyNames(obj): + raise MakeError( + 'TypeError', + 'Object.getOwnPropertyDescriptor called on non-object') +- return obj.own.keys() ++ return list(obj.own.keys()) + + def create(obj): + if not (obj.is_object() or obj.is_null()): diff --git a/dev-python/js2py/files/js2py-0.74-py312-load_attr.patch b/dev-python/js2py/files/js2py-0.74-py312-load_attr.patch new file mode 100644 index 000000000000..6dfa467cc41f --- /dev/null +++ b/dev-python/js2py/files/js2py-0.74-py312-load_attr.patch @@ -0,0 +1,57 @@ +From fd7df4a91fb08060914c7b1d9e94583d18f3371b Mon Sep 17 00:00:00 2001 +From: Felix Yan +Date: Wed, 17 Apr 2024 16:47:47 +0300 +Subject: [PATCH] Fix bytecode for Python 3.12 + +`LOAD_ATTR` has been changed in Python 3.12 and it seems reusing the +`LOAD_GLOBAL` logic makes the simple tests passing. + +I am not sure if this is correct since I'm pretty new to the code, but +maybe it's still helpful. +--- + js2py/translators/translating_nodes.py | 2 +- + js2py/utils/injector.py | 4 +++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/js2py/translators/translating_nodes.py b/js2py/translators/translating_nodes.py +index 4e2b5760..a780ba73 100644 +--- a/js2py/translators/translating_nodes.py ++++ b/js2py/translators/translating_nodes.py +@@ -543,7 +543,7 @@ def TryStatement(type, block, handler, handlers, guardedHandlers, finalizer): + if handler: + identifier = handler['param']['name'] + holder = 'PyJsHolder_%s_%d' % (to_hex(identifier), +- random.randrange(1e8)) ++ random.randrange(six.integer_types[-1](1e8))) + identifier = repr(identifier) + result += 'except PyJsException as PyJsTempException:\n' + # fill in except ( catch ) block and remember to recover holder variable to its previous state +diff --git a/js2py/utils/injector.py b/js2py/utils/injector.py +index 88e0d93e..835229f0 100644 +--- a/js2py/utils/injector.py ++++ b/js2py/utils/injector.py +@@ -14,6 +14,7 @@ + # Opcode constants used for comparison and replacecment + LOAD_FAST = opcode.opmap['LOAD_FAST'] + LOAD_GLOBAL = opcode.opmap['LOAD_GLOBAL'] ++LOAD_ATTR = opcode.opmap['LOAD_ATTR'] + STORE_FAST = opcode.opmap['STORE_FAST'] + + +@@ -79,6 +80,7 @@ def append_arguments(code_obj, new_locals): + (co_names.index(name), varnames.index(name)) for name in new_locals) + + is_new_bytecode = sys.version_info >= (3, 11) ++ is_new_load_attr = sys.version_info >= (3, 12) + # Now we modify the actual bytecode + modified = [] + drop_future_cache = False +@@ -97,7 +99,7 @@ def append_arguments(code_obj, new_locals): + # it's one of the globals that we are replacing. Either way, + # update its arg using the appropriate dict. + drop_future_cache = False +- if inst.opcode == LOAD_GLOBAL: ++ if inst.opcode == LOAD_GLOBAL or (is_new_load_attr and inst.opcode == LOAD_ATTR): + idx = inst.arg + if is_new_bytecode: + idx = idx // 2 diff --git a/dev-python/js2py/js2py-0.74-r2.ebuild b/dev-python/js2py/js2py-0.74-r2.ebuild new file mode 100644 index 000000000000..b6dd9b3a86dc --- /dev/null +++ b/dev-python/js2py/js2py-0.74-r2.ebuild @@ -0,0 +1,47 @@ +# Copyright 1999-2024 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +DISTUTILS_USE_PEP517=setuptools +PYPI_NO_NORMALIZE=1 +PYPI_PN="Js2Py" +PYTHON_COMPAT=( python3_{8,9,10,11,12} ) + +inherit distutils-r1 pypi + +DESCRIPTION="JavaScript to Python Translator & JavaScript interpreter in Python" +HOMEPAGE="http://piter.io/projects/js2py + https://github.com/PiotrDabkowski/Js2Py + https://pypi.org/project/Js2Py/" + +LICENSE="MIT" +SLOT="0" +KEYWORDS="amd64 ~arm arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sparc x86" +RESTRICT="test" + +RDEPEND=" + >=dev-python/pyjsparser-2.5.1[${PYTHON_USEDEP}] + >=dev-python/tzlocal-1.2.0[${PYTHON_USEDEP}] + >=dev-python/six-1.10.0[${PYTHON_USEDEP}] +" + +PATCHES=( + "${FILESDIR}/${PN}-0.74-CVE-2024-28397.patch" + "${FILESDIR}/${PN}-0.74-py312-load_attr.patch" +) + +python_test() { + pushd ./tests >/dev/null || die + + # run.py requires "node_failed.txt" file + touch ./node_failed.txt || die + + # https://bugs.gentoo.org/831356 + # make run.py return a non-zero exit code if any test failed + echo 'sys.exit(len(FAILING))' >> ./run.py || die + + "${EPYTHON}" ./run.py || die "tests failed with ${EPYTHON}" + + popd >/dev/null || die +} diff --git a/dev-python/js2py/js2py-0.74.ebuild b/dev-python/js2py/js2py-0.74.ebuild deleted file mode 100644 index 15da7084cff4..000000000000 --- a/dev-python/js2py/js2py-0.74.ebuild +++ /dev/null @@ -1,40 +0,0 @@ -# Copyright 1999-2023 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=8 - -DISTUTILS_USE_PEP517=setuptools -PYPI_NO_NORMALIZE=1 -PYPI_PN="Js2Py" -PYTHON_COMPAT=( python3_{8,9,10,11,12} ) - -inherit distutils-r1 pypi - -DESCRIPTION="JavaScript to Python Translator & JavaScript interpreter in Python" -HOMEPAGE="http://piter.io/projects/js2py/ - https://github.com/PiotrDabkowski/Js2Py/ - https://pypi.org/project/Js2Py/" - -LICENSE="MIT" -SLOT="0" -KEYWORDS="amd64 ~arm arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sparc x86" - -RDEPEND=" - >=dev-python/pyjsparser-2.5.1[${PYTHON_USEDEP}] - >=dev-python/tzlocal-1.2.0[${PYTHON_USEDEP}] - >=dev-python/six-1.10.0[${PYTHON_USEDEP}] -" - -python_test() { - pushd ./tests >/dev/null || die - - # Tests require "node_failed.txt" file where the logs are kept - if [[ -f ./node_failed.txt ]] ; then - rm ./node_failed.txt || die - fi - - touch ./node_failed.txt || die - "${EPYTHON}" ./run.py || die "tests failed with ${EPYTHON}" - - popd >/dev/null || die -} -- cgit v1.3