Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[20.09] python3Packages.pygments: add patch for CVE-2021-27291 #117810

Merged
merged 1 commit into from Mar 28, 2021
Merged

[20.09] python3Packages.pygments: add patch for CVE-2021-27291 #117810

merged 1 commit into from Mar 28, 2021

Conversation

risicle
Copy link
Contributor

@risicle risicle commented Mar 27, 2021

Motivation for this change

https://nvd.nist.gov/vuln/detail/CVE-2021-27291

I'm quite confident in patching this:

  • the changes are entirely changes to regexes, in files which have largely been untouched in 4 years and likely have a fairly stable internal interface.
  • I've built it successfully with the tests enabled on linux x86_64 and macos 10.14 (I'll do another PR with some hackery to allow us to enable the pygments tests permanently)
Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@mweinelt
Copy link
Member

mweinelt commented Mar 27, 2021 •
edited

We should probably add knownVulnerabilities to python2Packages.pygments (pkgs/development/python-modules/pygments/2_5.nix.

Everything else lgtm.

@risicle
Copy link
Contributor Author

risicle commented Mar 27, 2021

Hold on I got so caught up in the whole pytest cycle thing I completely forgot about 2.5.x.. sure enough, the patch works fine there too and the tests pass. Will push another commit.

@mweinelt
Copy link
Member

Except python2Packages.pygments would need to go to master first and then be cherry-picked from there. Meh.

@risicle
Copy link
Contributor Author

risicle commented Mar 27, 2021

Ah yes I'll yank it from here and do that.

@risicle risicle force-pushed the ris-pygments-CVE-2021-27291-r20.09 branch from 9fee868 to ae81faa Compare March 27, 2021 17:54
@risicle
Copy link
Contributor Author

risicle commented Mar 27, 2021

Sigh. And this looks staging-bound too.

@risicle risicle force-pushed the ris-pygments-CVE-2021-27291-r20.09 branch from ae81faa to a5ed349 Compare March 27, 2021 17:58
@risicle risicle changed the base branch from release-20.09 to staging-20.09 March 27, 2021 17:58
@risicle risicle mentioned this pull request Mar 27, 2021
Merged
10 tasks
@r-rmcgibbo
Copy link

r-rmcgibbo commented Mar 27, 2021 •
edited

Result of nixpkgs-review pr 117810 at a5ed349 run on x86_64-linux 1

563 packages marked as broken and skipped:
  • Literate
  • adobe-reader
  • agdaPackages.iowa-stdlib
  • aldor
  • aliceml
  • alliance
  • amsn
  • appleseed
  • arora
  • autotrace
  • ...
18673 packages skipped due to time constraints:
  • AusweisApp2
  • DisnixWebService
  • EmptyEpsilon
  • Fabric
  • MMA
  • OVMF
  • OVMF-CSM
  • OVMF-secureBoot
  • R
  • SDL
  • ...
105 packages built successfully:
  • desktop-file-utils
  • fontconfig
  • gd
  • glib (gnome2.glib ,gnome3.glib)
  • gtk-doc (gnome2.gtkdoc)
  • gnome2.libIDL
  • gts
  • libva-minimal
  • python37Packages.Babel
  • python37Packages.alabaster
  • python37Packages.apipkg
  • python37Packages.async_generator
  • python37Packages.click
  • python37Packages.execnet
  • python37Packages.flake8
  • python37Packages.flaky
  • python37Packages.freezegun
  • python37Packages.gunicorn
  • python37Packages.iso8601
  • python37Packages.jdcal
  • python37Packages.jinja2
  • python37Packages.jsonpickle
  • python37Packages.junit-xml
  • python37Packages.mccabe
  • python37Packages.psutil
  • python37Packages.py-cpuinfo
  • python37Packages.pygments
  • python37Packages.pytest (python37Packages.pytest_5)
  • python37Packages.pytest-asyncio
  • python37Packages.pytest-benchmark
  • python37Packages.pytest-expect
  • python37Packages.pytest-flake8
  • python37Packages.pytest-forked
  • python37Packages.pytest-mock
  • python37Packages.pytest-relaxed
  • python37Packages.pytestCheckHook
  • python37Packages.pytest_xdist (python37Packages.pytest_xdist_1)
  • python37Packages.pytestcov
  • python37Packages.pytestrunner
  • python37Packages.simplejson
  • python37Packages.webencodings
  • python38Packages.Babel
  • python38Packages.alabaster
  • python38Packages.apipkg
  • python38Packages.async_generator
  • python38Packages.backcall
  • python38Packages.cffi
  • python38Packages.chardet
  • python38Packages.click
  • python38Packages.cryptography
  • python38Packages.entrypoints
  • python38Packages.execnet
  • python38Packages.flake8
  • python38Packages.flaky
  • python38Packages.fontforge
  • python38Packages.freezegun
  • python38Packages.gflags
  • python38Packages.google_apputils
  • python38Packages.gunicorn
  • python38Packages.html5lib
  • python38Packages.hypothesis
  • python38Packages.iso8601
  • python38Packages.isort
  • python38Packages.jdcal
  • python38Packages.jinja2
  • python38Packages.junit-xml
  • python38Packages.libevdev
  • python38Packages.mccabe
  • python38Packages.psutil
  • python38Packages.py-cpuinfo
  • python38Packages.pyasn1-modules
  • python38Packages.pyftpdlib
  • python38Packages.pygments
  • python38Packages.pyopenssl
  • python38Packages.pyroma
  • python38Packages.pytest (python38Packages.pytest_5)
  • python38Packages.pytest-asyncio
  • python38Packages.pytest-benchmark
  • python38Packages.pytest-expect
  • python38Packages.pytest-flake8
  • python38Packages.pytest-forked
  • python38Packages.pytest-mock
  • python38Packages.pytest-relaxed
  • python38Packages.pytestCheckHook
  • python38Packages.pytest_xdist (python38Packages.pytest_xdist_1)
  • python38Packages.pytestcache
  • python38Packages.pytestcov
  • python38Packages.pytestrunner
  • python38Packages.requests
  • python38Packages.responses
  • python38Packages.service-identity
  • python38Packages.simplejson
  • python38Packages.sphinx
  • python38Packages.sshpubkeys
  • python38Packages.text-unidecode
  • python38Packages.urllib3
  • python38Packages.validators
  • python38Packages.webencodings
  • python38Packages.whoosh
  • shared-mime-info
  • tarsnapper
  • wayland
  • wayland-protocols
  • xlibsWrapper (xorg.xlibsWrapper)
  • xorg.libXft
3 suggestions:
  • warning: maintainers-missing

    Package does not have a maintainer. Consider adding yourself?

    Near pkgs/development/python-modules/Pygments/default.nix:35:5:

       |
35 |     maintainers = with lib.maintainers; [ ];
   |     ^
  • warning: missing-patch-comment

    Please add a comment on the line above, explaining the purpose of this patch.
    Near pkgs/development/python-modules/Pygments/default.nix:18:5:

       |
18 |     (fetchpatch {
   |     ^
  • warning: python-include-tests

    Consider adding a checkPhase for tests, or if not feasible, pythonImportsCheck.

    Near pkgs/development/python-modules/Pygments/default.nix:33:0:

       |
33 |     description = "A generic syntax highlighter";
   | ^

Result of nixpkgs-review pr 117810 at a5ed349 run on aarch64-linux 1

674 packages marked as broken and skipped:
  • Literate
  • OVMF-CSM
  • agdaPackages.iowa-stdlib
  • aldor
  • alliance
  • ams-lv2
  • amsn
  • anki
  • ankisyncd
  • apfelgrid
  • ...
16924 packages skipped due to time constraints:
  • AusweisApp2
  • DisnixWebService
  • EmptyEpsilon
  • Fabric
  • MMA
  • OVMF
  • OVMF-secureBoot
  • R
  • SDL
  • SDL2
  • ...
86 packages built successfully:
  • gtk-doc (gnome2.gtkdoc)
  • python37Packages.alabaster
  • python37Packages.apipkg
  • python37Packages.async_generator
  • python37Packages.click
  • python37Packages.entrypoints
  • python37Packages.execnet
  • python37Packages.flake8
  • python37Packages.flaky
  • python37Packages.freezegun
  • python37Packages.gflags
  • python37Packages.google_apputils
  • python37Packages.gunicorn
  • python37Packages.iso8601
  • python37Packages.jdcal
  • python37Packages.jinja2
  • python37Packages.mccabe
  • python37Packages.py-cpuinfo
  • python37Packages.pygments
  • python37Packages.pytest (python37Packages.pytest_5)
  • python37Packages.pytest-asyncio
  • python37Packages.pytest-benchmark
  • python37Packages.pytest-expect
  • python37Packages.pytest-flake8
  • python37Packages.pytest-forked
  • python37Packages.pytest-mock
  • python37Packages.pytest_xdist (python37Packages.pytest_xdist_1)
  • python37Packages.pytestcov
  • python37Packages.pytestrunner
  • python37Packages.simplejson
  • python37Packages.webencodings
  • python38Packages.Babel
  • python38Packages.alabaster
  • python38Packages.apipkg
  • python38Packages.async_generator
  • python38Packages.backcall
  • python38Packages.betamax
  • python38Packages.cffi
  • python38Packages.chardet
  • python38Packages.click
  • python38Packages.cryptography
  • python38Packages.entrypoints
  • python38Packages.execnet
  • python38Packages.flake8
  • python38Packages.flaky
  • python38Packages.freezegun
  • python38Packages.gflags
  • python38Packages.google_apputils
  • python38Packages.gunicorn
  • python38Packages.html5lib
  • python38Packages.hypothesis
  • python38Packages.iso8601
  • python38Packages.isort
  • python38Packages.jdcal
  • python38Packages.jinja2
  • python38Packages.libevdev
  • python38Packages.mccabe
  • python38Packages.py-cpuinfo
  • python38Packages.pyasn1-modules
  • python38Packages.pyftpdlib
  • python38Packages.pygments
  • python38Packages.pyopenssl
  • python38Packages.pyroma
  • python38Packages.pytest (python38Packages.pytest_5)
  • python38Packages.pytest-asyncio
  • python38Packages.pytest-benchmark
  • python38Packages.pytest-expect
  • python38Packages.pytest-flake8
  • python38Packages.pytest-forked
  • python38Packages.pytest-mock
  • python38Packages.pytest_xdist (python38Packages.pytest_xdist_1)
  • python38Packages.pytestcache
  • python38Packages.pytestcov
  • python38Packages.pytestrunner
  • python38Packages.requests
  • python38Packages.responses
  • python38Packages.send2trash
  • python38Packages.service-identity
  • python38Packages.simplejson
  • python38Packages.sphinx
  • python38Packages.text-unidecode
  • python38Packages.urllib3
  • python38Packages.validators
  • python38Packages.webencodings
  • python38Packages.whoosh
  • tarsnapper
3 suggestions:
  • warning: maintainers-missing

    Package does not have a maintainer. Consider adding yourself?

    Near pkgs/development/python-modules/Pygments/default.nix:35:5:

       |
35 |     maintainers = with lib.maintainers; [ ];
   |     ^
  • warning: missing-patch-comment

    Please add a comment on the line above, explaining the purpose of this patch.
    Near pkgs/development/python-modules/Pygments/default.nix:18:5:

       |
18 |     (fetchpatch {
   |     ^
  • warning: python-include-tests

    Consider adding a checkPhase for tests, or if not feasible, pythonImportsCheck.

    Near pkgs/development/python-modules/Pygments/default.nix:33:0:

       |
33 |     description = "A generic syntax highlighter";
   | ^

@jonringer
Copy link
Contributor

if the 2.5 bump doesn't have breaking changes, I would much rather just take that.

@risicle
Copy link
Contributor Author

risicle commented Mar 27, 2021

Between 2.6.1 and 2.7.4 there are a lot of "updated lexers", it's hard to know what lies behind all of those.

There is a

Deprecated JsonBareObjectLexer ...

in there

@mweinelt
Copy link
Member

if the 2.5 bump doesn't have breaking changes, I would much rather just take that.

Not sure what the "2.5 bump" means. We have 2.5 as the last version with python2 support. We either backport that patch or mark it as vulnerable IMO.

@jonringer
Copy link
Contributor

sorry, I meant a non breaking bump. I'm also okay with a patch.

@risicle risicle mentioned this pull request Mar 28, 2021
Merged
10 tasks
@jonringer jonringer added this to In progress in 20.09-Staging via automation Mar 28, 2021
@jonringer jonringer merged commit 4d12ddf into NixOS:staging-20.09 Mar 28, 2021
20.09-Staging automation moved this from In progress to Done Mar 28, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@FRidh FRidh Awaiting requested review from FRidh FRidh is a code owner

@jonringer jonringer Awaiting requested review from jonringer jonringer is a code owner

Assignees
No one assigned
Labels
1.severity: security 6.topic: python 10.rebuild-darwin: 501+ 10.rebuild-darwin: 5001+ 10.rebuild-linux: 501+ 10.rebuild-linux: 5001+
Projects
No open projects
20.09-Staging
Done
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@risicle @mweinelt @r-rmcgibbo @jonringer