diff --git a/lang/python315/Makefile b/lang/python315/Makefile new file mode 100644 index 000000000000..404a636e7cf6 --- /dev/null +++ b/lang/python315/Makefile @@ -0,0 +1,201 @@ +PORTNAME= python +DISTVERSION= ${PYTHON_DISTVERSION} # see Makefile.version +PORTREVISION= 2 +CATEGORIES= lang python +MASTER_SITES= PYTHON/ftp/python/${DISTVERSION:C/[a-z].*//} +PKGNAMESUFFIX= ${PYTHON_SUFFIX} +DISTNAME= Python-${DISTVERSION} +DIST_SUBDIR= python + +MAINTAINER= mandree@FreeBSD.org +COMMENT= Interpreted object-oriented programming language +WWW= https://www.python.org/ + +LICENSE= PSFL + +LIB_DEPENDS= libexpat.so:textproc/expat2 \ + libffi.so:devel/libffi \ + libzstd.so:archivers/zstd + +USES= compiler:c11 cpe ncurses pathfix pkgconfig readline \ + shebangfix ssl tar:xz +PATHFIX_MAKEFILEIN= Makefile.pre.in +USE_LDCONFIG= yes +GNU_CONFIGURE= yes +python_CMD= ${PREFIX}/bin/python${PYTHON_DISTVERSION:R} +SHEBANG_FILES= Lib/*.py Lib/*/*.py Lib/*/*/*.py Lib/*/*/*/*.py +SHEBANG_FILES+= Lib/test/archivetestdata/exe_with_z64 \ + Lib/test/archivetestdata/exe_with_zip \ + Lib/test/archivetestdata/header.sh + +# Duplicate python.mk variables. TODO: Let lang/python?? ports use python.mk bits. +PYTHON_VER= ${PYTHON_DISTVERSION:R} +PYTHON_VERSION= python${PYTHON_VER} +PYTHON_SUFFIX= ${PYTHON_VER:S/.//g} + +DISABLED_EXTENSIONS= _gdbm _sqlite3 _tkinter +CONFIGURE_ARGS+= --enable-shared --without-ensurepip --with-system-expat +CONFIGURE_ENV+= OPT="" # Null out OPT to respect user CFLAGS and remove optimizations + +INSTALL_TARGET= altinstall # Don't want cloberring of unprefixed files + +# TEST_TARGET= buildbottest # that's the --slow-ci with more resources/longer timeouts +TEST_TARGET= test # that's the --fast-ci with tighter timeouts and using less resources +# TEST_ARGS: test_gdb requires debug symbols for the test_gdb.test_pretty_print test, so skip it unless defined(WITH_DEBUG) +TEST_ARGS= TESTOPTS="-j${MAKE_JOBS_NUMBER} ${WITH_DEBUG:U-x test_gdb}" + +MAKE_ARGS+= COMPILEALL_OPTS=-j${MAKE_JOBS_NUMBER} \ + INSTALL_SHARED="${INSTALL_LIB}" # Strip shared library + +SUB_FILES= pkg-message +SUB_LIST= PYTHON_SUFFIX=${PYTHON_SUFFIX} + +PLIST_SUB= ABI=${ABIFLAGS} \ + XY=${PYTHON_SUFFIX} \ + XYDOT=${PYTHON_VER} \ + XYZDOT=${DISTVERSION:C/[a-z].*//} \ + OSMAJOR=${OSVERSION:C/([0-9]*)[0-9]{5}/\1/} # For plat-freebsd* in pkg-plist. https://bugs.python.org/issue19554 + +OPTIONS_DEFINE= DEBUG IPV6 LIBMPDEC LTO NLS PYMALLOC +OPTIONS_DEFAULT= LIBMPDEC LTO PYMALLOC +OPTIONS_EXCLUDE_powerpc64= LTO +OPTIONS_EXCLUDE_riscv64= LTO +OPTIONS_RADIO= HASH +OPTIONS_RADIO_HASH= FNV SIPHASH +OPTIONS_SUB= yes + +LIBMPDEC_DESC= Use libmpdec from ports instead of bundled version +LTO_DESC= Use Link-Time Optimization with -flto=thin +LTOFULL_DESC= Use -flto=full (not =thin) (faster build at more CPU time) +NLS_DESC= Enable gettext support for the locale module +PYMALLOC_DESC= Enable specialized mallocs + +HASH_DESC= Hash Algorithm (PEP-456) +FNV_DESC= Modified Fowler-Noll-Vo Algorithm +SIPHASH_DESC= SipHash24 Algorithm + +FNV_CONFIGURE_ON= --with-hash-algorithm=fnv +SIPHASH_CONFIGURE_ON= --with-hash-algorithm=siphash24 + +DEBUG_CONFIGURE_WITH= pydebug +IPV6_CONFIGURE_ENABLE= ipv6 + +LIBMPDEC_CONFIGURE_ON= --with-system-libmpdec +LIBMPDEC_LIB_DEPENDS= libmpdec.so:math/mpdecimal + +LTO_CONFIGURE_ON= --with-lto=full + +# Use CPPFLAGS over CFLAGS due to -I ordering, causing elementtree and pyexpat +# to break in Python 2.7, or preprocessor complaints in Python >= 3.3 +# Upstream Issue: https://bugs.python.org/issue6299 +NLS_USES= gettext-runtime +NLS_CPPFLAGS= -I${LOCALBASE}/include +NLS_LIBS= -L${LOCALBASE}/lib -lintl +NLS_CONFIGURE_ENV_OFF= ac_cv_lib_intl_textdomain=no ac_cv_header_libintl_h=no + +PYMALLOC_CONFIGURE_WITH= pymalloc + +.include "${.CURDIR}/Makefile.version" +.include + +.if ${PORT_OPTIONS:MDEBUG} +ABIFLAGS:= d${ABIFLAGS} +.endif + +.if !empty(ABIFLAGS) +PLIST_FILES+= bin/python${PYTHON_VER}${ABIFLAGS} \ + bin/python${PYTHON_VER}${ABIFLAGS}-config \ + libdata/pkgconfig/python-${PYTHON_VER}${ABIFLAGS}.pc \ + libdata/pkgconfig/python-${PYTHON_VER}${ABIFLAGS}-embed.pc +.endif + +.if ${ARCH} == sparc64 +CFLAGS+= -DPYTHON_DEFAULT_RECURSION_LIMIT=900 +.endif + +# See https://bugs.freebsd.org/115940 and https://bugs.freebsd.org/193650 +.if !exists(/usr/bin/ypcat) || defined(WITHOUT_NIS) +PLIST_SUB+= NO_NIS="@comment " +DISABLED_EXTENSIONS+= nis +.else +PLIST_SUB+= NO_NIS="" +.endif + +# Python 3.10 requires OpenSSL >= 1.1.1 (PEP 644), so with +# libressl, some modules are not built +.if ${SSL_DEFAULT:Mlibressl*} +PLIST_SUB+= SUPPORTED_OPENSSL="@comment " +.else +PLIST_SUB+= SUPPORTED_OPENSSL="" +.endif + +post-patch: +# disable the detection of includes and library from e2fsprogs-libuuid, +# which introduces hidden dependency and breaks build + @${REINPLACE_CMD} -e 's|uuid/uuid.h|ignore_&|' ${WRKSRC}/configure +# disable detection of multiarch as it breaks with clang >= 13, which adds a +# major.minor version number in -print-multiarch output, confusing Python + @${REINPLACE_CMD} -e 's|^\( *MULTIARCH=\).*--print-multiarch.*|\1|' ${WRKSRC}/configure +# Apply DISABLED_EXTENSIONS + @${ECHO_CMD} '*disabled*' > ${WRKSRC}/Modules/Setup.local +. for _module in ${DISABLED_EXTENSIONS} + @${ECHO_CMD} ${_module} >> ${WRKSRC}/Modules/Setup.local +. endfor +# Strip Expat module + ${RM} -R ${WRKSRC}/Modules/expat + +post-install: +.if ! ${PORT_OPTIONS:MDEBUG} + ${RM} ${STAGEDIR}${PREFIX}/lib/libpython3.so # Upstream Issue: https://bugs.python.org/issue17975 +.endif + ${LN} -sf libpython${PYTHON_VER}${ABIFLAGS}.so.1.0 ${STAGEDIR}${PREFIX}/lib/libpython${PYTHON_VER}${ABIFLAGS}.so.1 +# This code block exists for the qemu-user enabled cross build environment. +# When using this environment in poudriere, CC is not set to the default +# of /usr/bin/cc and a cross-compile toolchain is used. We need to hand +# edit this so that the run time configuration for python matches what the +# FreeBSD base system provides. sbruno 02Aug2017 +.if ${CC} == /nxb-bin/usr/bin/cc + @${REINPLACE_CMD} -e 's=/nxb-bin==g' \ + ${STAGEDIR}${PREFIX}/lib/python${PYTHON_VER}/_sysconfigdata_${ABIFLAGS}_freebsd_.py + @cd ${WRKSRC} && ${SETENV} LD_LIBRARY_PATH=${WRKSRC} \ + ./python -E -m compileall -d ${PREFIX}/lib/python${PYTHON_VER} \ + ${STAGEDIR}${PREFIX}/lib/python${PYTHON_VER}/_sysconfigdata_${ABIFLAGS}_freebsd_.py + @cd ${WRKSRC} && ${SETENV} LD_LIBRARY_PATH=${WRKSRC} \ + ./python -E -O -m compileall -d ${PREFIX}/lib/python${PYTHON_VER} \ + ${STAGEDIR}${PREFIX}/lib/python${PYTHON_VER}/_sysconfigdata_${ABIFLAGS}_freebsd_.py + @${REINPLACE_CMD} -e 's=/nxb-bin==g' \ + ${STAGEDIR}${PREFIX}/lib/python${PYTHON_VER}/config-${PYTHON_VER}${ABIFLAGS}/Makefile +.endif + for i in ${STAGEDIR}${PREFIX}/lib/python${PYTHON_VER}/lib-dynload/*.so; do \ + ${STRIP_CMD} $$i; done # Strip shared extensions + ${INSTALL_DATA} ${WRKSRC}/Tools/gdb/libpython.py \ + ${STAGEDIR}${PREFIX}/lib/libpython${PYTHON_VER}${ABIFLAGS}.so.1.0-gdb.py + +_sigstorebundle=${DISTFILES}.sigstore +${_sigstorebundle}: + ${FETCH_CMD} ${MASTER_SITES}/${_sigstorebundle} + +sigstore-verify: ${_sigstorebundle} checksum + sigstore verify identity \ + --bundle ${DISTFILES}.sigstore \ + --cert-identity hugo@python.org \ + --cert-oidc-issuer https://github.com/login/oauth \ + ${DISTDIR}/${DIST_SUBDIR}/${DISTFILES} + +pre-test: + @${ECHO_CMD} "=== NOTE: the py314-* gdbm, sqlite3, tkinter modules must be rebuilt before the test ===" +.if ${PORT_OPTIONS:MDEBUG} + @${ECHO_CMD} "=== NOTE: The test_ssl test is known to fail with DEBUG option enabled ===" +.endif +.if empty(PORT_OPTIONS:MIPV6) + @${ECHO_CMD} "=== NOTE: Some asynch tests require IPV6 support enabled, expect some test failures ===" +.endif +.if empty(PORT_OPTIONS:MPYMALLOC) + @${ECHO_CMD} "=== NOTE: Some tests depend on PYMALLOC option enabled, expect some test failures ===" +.endif + sleep 5 + +post-clean: + @${RM} ${_sigstorebundle} + +.include diff --git a/lang/python315/Makefile.version b/lang/python315/Makefile.version new file mode 100644 index 000000000000..c8ccfa3963b0 --- /dev/null +++ b/lang/python315/Makefile.version @@ -0,0 +1,7 @@ +# Mk/Uses/python.mk includes this file, don't remove it! + +# Do not forget to +# 1. Update python documentation (lang/python-doc-*) +# Run "make -C lang/python-doc-html makesum" +# 2. Remove PORTREVISION in Makefile +PYTHON_DISTVERSION= 3.14.4 diff --git a/lang/python315/distinfo b/lang/python315/distinfo new file mode 100644 index 000000000000..7c5dead58955 --- /dev/null +++ b/lang/python315/distinfo @@ -0,0 +1,3 @@ +TIMESTAMP = 1775640582 +SHA256 (python/Python-3.14.4.tar.xz) = d923c51303e38e249136fc1bdf3568d56ecb03214efdef48516176d3d7faaef8 +SIZE (python/Python-3.14.4.tar.xz) = 23855332 diff --git a/lang/python315/files/patch-Lib_test_test__posix.py b/lang/python315/files/patch-Lib_test_test__posix.py new file mode 100644 index 000000000000..6dc5ab44b540 --- /dev/null +++ b/lang/python315/files/patch-Lib_test_test__posix.py @@ -0,0 +1,18 @@ +--- Lib/test/test_posix.py.orig 2025-11-01 21:42:35 UTC ++++ Lib/test/test_posix.py +@@ -412,11 +412,12 @@ class PosixTester(unittest.TestCase): + # so skip Solaris-based since they are likely to have ZFS. + # issue33655: Also ignore EINVAL on *BSD since ZFS is also + # often used there. +- if inst.errno == errno.EINVAL and sys.platform.startswith( ++ if (inst.errno == errno.EINVAL or inst.errno == errno.ENODEV) and sys.platform.startswith( + ('sunos', 'freebsd', 'openbsd', 'gnukfreebsd')): + raise unittest.SkipTest("test may fail on ZFS filesystems") +- elif inst.errno == errno.EOPNOTSUPP and sys.platform.startswith("netbsd"): +- raise unittest.SkipTest("test may fail on FFS filesystems") ++ # FreeBSD may return EOPNOTSUPP in some versions ++ elif inst.errno == errno.EOPNOTSUPP and sys.platform.startswith(('netbsd', 'freebsd')): ++ raise unittest.SkipTest("test may fail on ZFS and FFS filesystems") + else: + raise + finally: diff --git a/lang/python315/files/patch-Makefile.pre.in b/lang/python315/files/patch-Makefile.pre.in new file mode 100644 index 000000000000..e5e8bfa7e0e9 --- /dev/null +++ b/lang/python315/files/patch-Makefile.pre.in @@ -0,0 +1,62 @@ +--- Makefile.pre.in.orig 2025-11-01 17:59:00 UTC ++++ Makefile.pre.in +@@ -84,7 +84,6 @@ BASECPPFLAGS= @BASECPPFLAGS@ + OPT= @OPT@ + BASECFLAGS= @BASECFLAGS@ + BASECPPFLAGS= @BASECPPFLAGS@ +-CONFIGURE_CFLAGS= @CFLAGS@ + # CFLAGS_NODIST is used for building the interpreter and stdlib C extensions. + # Use it when a compiler flag should _not_ be part of the distutils CFLAGS + # once Python is installed (Issue #21121). +@@ -96,18 +95,16 @@ CONFIGURE_LDFLAGS_NOLTO=@LDFLAGS_NOLTO@ + # LDFLAGS_NOLTO is an extra flag to disable lto. It is used to speed up building + # of _bootstrap_python and _freeze_module tools, which don't need LTO. + CONFIGURE_LDFLAGS_NOLTO=@LDFLAGS_NOLTO@ +-CONFIGURE_CPPFLAGS= @CPPFLAGS@ +-CONFIGURE_LDFLAGS= @LDFLAGS@ + # Avoid assigning CFLAGS, LDFLAGS, etc. so users can use them on the + # command line to append to these values without stomping the pre-set + # values. +-PY_CFLAGS= $(BASECFLAGS) $(OPT) $(CONFIGURE_CFLAGS) $(CFLAGS) $(EXTRA_CFLAGS) ++PY_CFLAGS= $(BASECFLAGS) $(OPT) $(CFLAGS) $(EXTRA_CFLAGS) + PY_CFLAGS_NODIST=$(CONFIGURE_CFLAGS_NODIST) $(CFLAGS_NODIST) -I$(srcdir)/Include/internal -I$(srcdir)/Include/internal/mimalloc + # Both CPPFLAGS and LDFLAGS need to contain the shell's value for setup.py to + # be able to build extension modules using the directories specified in the + # environment variables +-PY_CPPFLAGS= $(BASECPPFLAGS) -I. -I$(srcdir)/Include $(CONFIGURE_CPPFLAGS) $(CPPFLAGS) +-PY_LDFLAGS= $(CONFIGURE_LDFLAGS) $(LDFLAGS) ++PY_CPPFLAGS= $(BASECPPFLAGS) -I. -I$(srcdir)/Include $(CPPFLAGS) ++PY_LDFLAGS= $(LDFLAGS) + PY_LDFLAGS_NODIST=$(CONFIGURE_LDFLAGS_NODIST) $(LDFLAGS_NODIST) + PY_LDFLAGS_NOLTO=$(PY_LDFLAGS) $(CONFIGURE_LDFLAGS_NOLTO) $(LDFLAGS_NODIST) + NO_AS_NEEDED= @NO_AS_NEEDED@ +@@ -2492,14 +2489,6 @@ bininstall: commoninstall altbininstall + else true; \ + fi + (cd $(DESTDIR)$(BINDIR); $(LN) -s python$(VERSION)$(EXE) python3$(EXE)) +- -if test "$(VERSION)" != "$(LDVERSION)"; then \ +- rm -f $(DESTDIR)$(BINDIR)/python$(VERSION)-config; \ +- (cd $(DESTDIR)$(BINDIR); $(LN) -s python$(LDVERSION)-config python$(VERSION)-config); \ +- rm -f $(DESTDIR)$(LIBPC)/python-$(VERSION).pc; \ +- (cd $(DESTDIR)$(LIBPC); $(LN) -s python-$(LDVERSION).pc python-$(VERSION).pc); \ +- rm -f $(DESTDIR)$(LIBPC)/python-$(VERSION)-embed.pc; \ +- (cd $(DESTDIR)$(LIBPC); $(LN) -s python-$(LDVERSION)-embed.pc python-$(VERSION)-embed.pc); \ +- fi + -rm -f $(DESTDIR)$(BINDIR)/python3-config + (cd $(DESTDIR)$(BINDIR); $(LN) -s python$(VERSION)-config python3-config) + -rm -f $(DESTDIR)$(LIBPC)/python3.pc +@@ -2952,6 +2941,14 @@ libainstall: all scripts + $(INSTALL_SCRIPT) $(srcdir)/install-sh $(DESTDIR)$(LIBPL)/install-sh + $(INSTALL_SCRIPT) python-config.py $(DESTDIR)$(LIBPL)/python-config.py + $(INSTALL_SCRIPT) python-config $(DESTDIR)$(BINDIR)/python$(LDVERSION)-config ++ -if test "$(VERSION)" != "$(LDVERSION)"; then \ ++ rm -f $(DESTDIR)$(BINDIR)/python$(VERSION)-config; \ ++ (cd $(DESTDIR)$(BINDIR); $(LN) -s python$(LDVERSION)-config python$(VERSION)-config); \ ++ rm -f $(DESTDIR)$(LIBPC)/python-$(VERSION).pc; \ ++ (cd $(DESTDIR)$(LIBPC); $(LN) -s python-$(LDVERSION).pc python-$(VERSION).pc); \ ++ rm -f $(DESTDIR)$(LIBPC)/python-$(VERSION)-embed.pc; \ ++ (cd $(DESTDIR)$(LIBPC); $(LN) -s python-$(LDVERSION)-embed.pc python-$(VERSION)-embed.pc); \ ++ fi + $(INSTALL_SCRIPT) $(SCRIPT_IDLE) $(DESTDIR)$(BINDIR)/idle$(VERSION) + $(INSTALL_SCRIPT) $(SCRIPT_PYDOC) $(DESTDIR)$(BINDIR)/pydoc$(VERSION) + @if [ -s Modules/python.exp -a \ diff --git a/lang/python315/files/patch-Misc_python-config.sh.in b/lang/python315/files/patch-Misc_python-config.sh.in new file mode 100644 index 000000000000..7da9da93d197 --- /dev/null +++ b/lang/python315/files/patch-Misc_python-config.sh.in @@ -0,0 +1,11 @@ +--- Misc/python-config.sh.in.orig 2025-01-16 01:47:29 UTC ++++ Misc/python-config.sh.in +@@ -21,7 +21,7 @@ installed_prefix () + # Returns the actual prefix where this script was installed to. + installed_prefix () + { +- RESULT=$(dirname $(cd $(dirname "$1") && pwd -P)) ++ RESULT=$(dirname $(cd $(dirname $(realpath "$1")) && pwd -P)) + if which readlink >/dev/null 2>&1 ; then + if readlink -f "$RESULT" >/dev/null 2>&1; then + RESULT=$(readlink -f "$RESULT") diff --git a/lang/python315/files/patch-gh-146211-reject-CR_LF-in-HTTP-tunnel-request-headers b/lang/python315/files/patch-gh-146211-reject-CR_LF-in-HTTP-tunnel-request-headers new file mode 100644 index 000000000000..989f22a0529b --- /dev/null +++ b/lang/python315/files/patch-gh-146211-reject-CR_LF-in-HTTP-tunnel-request-headers @@ -0,0 +1,108 @@ +From afdd351544e8112d4070a31f2218f99256697472 Mon Sep 17 00:00:00 2001 +From: Seth Larson +Date: Fri, 10 Apr 2026 10:21:42 -0500 +Subject: [PATCH] gh-146211: Reject CR/LF in HTTP tunnel request headers + (GH-146212) (cherry picked from commit + 05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69) + +Co-authored-by: Seth Larson +Co-authored-by: Illia Volochii +--- + Lib/http/client.py | 11 ++++- + Lib/test/test_httplib.py | 45 +++++++++++++++++++ + ...-03-20-09-29-42.gh-issue-146211.PQVbs7.rst | 2 + + 3 files changed, 57 insertions(+), 1 deletion(-) + create mode 100644 Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst + +diff --git a/Lib/http/client.py b/Lib/http/client.py +index 77f8d26291dfc2..6fb7d254ea9c27 100644 +--- ./Lib/http/client.py ++++ b/Lib/http/client.py +@@ -972,13 +972,22 @@ def _wrap_ipv6(self, ip): + return ip + + def _tunnel(self): ++ if _contains_disallowed_url_pchar_re.search(self._tunnel_host): ++ raise ValueError('Tunnel host can\'t contain control characters %r' ++ % (self._tunnel_host,)) + connect = b"CONNECT %s:%d %s\r\n" % ( + self._wrap_ipv6(self._tunnel_host.encode("idna")), + self._tunnel_port, + self._http_vsn_str.encode("ascii")) + headers = [connect] + for header, value in self._tunnel_headers.items(): +- headers.append(f"{header}: {value}\r\n".encode("latin-1")) ++ header_bytes = header.encode("latin-1") ++ value_bytes = value.encode("latin-1") ++ if not _is_legal_header_name(header_bytes): ++ raise ValueError('Invalid header name %r' % (header_bytes,)) ++ if _is_illegal_header_value(value_bytes): ++ raise ValueError('Invalid header value %r' % (value_bytes,)) ++ headers.append(b"%s: %s\r\n" % (header_bytes, value_bytes)) + headers.append(b"\r\n") + # Making a single send() call instead of one per line encourages + # the host OS to use a more optimal packet size instead of +diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py +index bcb828edec7c39..6f3eac6b98a4de 100644 +--- ./Lib/test/test_httplib.py ++++ b/Lib/test/test_httplib.py +@@ -369,6 +369,51 @@ def test_invalid_headers(self): + with self.assertRaisesRegex(ValueError, 'Invalid header'): + conn.putheader(name, value) + ++ def test_invalid_tunnel_headers(self): ++ cases = ( ++ ('Invalid\r\nName', 'ValidValue'), ++ ('Invalid\rName', 'ValidValue'), ++ ('Invalid\nName', 'ValidValue'), ++ ('\r\nInvalidName', 'ValidValue'), ++ ('\rInvalidName', 'ValidValue'), ++ ('\nInvalidName', 'ValidValue'), ++ (' InvalidName', 'ValidValue'), ++ ('\tInvalidName', 'ValidValue'), ++ ('Invalid:Name', 'ValidValue'), ++ (':InvalidName', 'ValidValue'), ++ ('ValidName', 'Invalid\r\nValue'), ++ ('ValidName', 'Invalid\rValue'), ++ ('ValidName', 'Invalid\nValue'), ++ ('ValidName', 'InvalidValue\r\n'), ++ ('ValidName', 'InvalidValue\r'), ++ ('ValidName', 'InvalidValue\n'), ++ ) ++ for name, value in cases: ++ with self.subTest((name, value)): ++ conn = client.HTTPConnection('example.com') ++ conn.set_tunnel('tunnel', headers={ ++ name: value ++ }) ++ conn.sock = FakeSocket('') ++ with self.assertRaisesRegex(ValueError, 'Invalid header'): ++ conn._tunnel() # Called in .connect() ++ ++ def test_invalid_tunnel_host(self): ++ cases = ( ++ 'invalid\r.host', ++ '\ninvalid.host', ++ 'invalid.host\r\n', ++ 'invalid.host\x00', ++ 'invalid host', ++ ) ++ for tunnel_host in cases: ++ with self.subTest(tunnel_host): ++ conn = client.HTTPConnection('example.com') ++ conn.set_tunnel(tunnel_host) ++ conn.sock = FakeSocket('') ++ with self.assertRaisesRegex(ValueError, 'Tunnel host can\'t contain control characters'): ++ conn._tunnel() # Called in .connect() ++ + def test_headers_debuglevel(self): + body = ( + b'HTTP/1.1 200 OK\r\n' +diff --git a/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst b/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst +new file mode 100644 +index 00000000000000..4993633b8ebebb +--- /dev/null ++++ ./Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst +@@ -0,0 +1,2 @@ ++Reject CR/LF characters in tunnel request headers for the ++HTTPConnection.set_tunnel() method. diff --git a/lang/python315/files/patch-gh-146333-Fix-quadratic-regex-backtracking-in-configparser b/lang/python315/files/patch-gh-146333-Fix-quadratic-regex-backtracking-in-configparser new file mode 100644 index 000000000000..7dffa8ff1cfe --- /dev/null +++ b/lang/python315/files/patch-gh-146333-Fix-quadratic-regex-backtracking-in-configparser @@ -0,0 +1,83 @@ +From ab8704a8e05e2f926c10f994e4085e8726048fa4 Mon Sep 17 00:00:00 2001 +From: Joshua Swanson <22283299+joshuaswanson@users.noreply.github.com> +Date: Tue, 7 Apr 2026 16:10:34 +0200 +Subject: [PATCH] gh-146333: Fix quadratic regex backtracking in configparser + option parsing (GH-146399) + +Use negative lookahead in option regex to prevent backtracking, and to avoid changing logic outside the regexes (since people could use the regex directly). +(cherry picked from commit 7e0a0be4097f9d29d66fe23f5af86f18a34ed7dd) + +Co-authored-by: Joshua Swanson <22283299+joshuaswanson@users.noreply.github.com> +--- + Lib/configparser.py | 8 ++++++-- + Lib/test/test_configparser.py | 20 +++++++++++++++++++ + ...3-25-00-51-03.gh-issue-146333.LqdL__bn.rst | 3 +++ + 3 files changed, 29 insertions(+), 2 deletions(-) + create mode 100644 Misc/NEWS.d/next/Security/2026-03-25-00-51-03.gh-issue-146333.LqdL__bn.rst + +diff --git a/Lib/configparser.py b/Lib/configparser.py +index d435a5c2fe0da2..e76647d339e913 100644 +--- ./Lib/configparser.py ++++ b/Lib/configparser.py +@@ -613,7 +613,9 @@ class RawConfigParser(MutableMapping): + \] # ] + """ + _OPT_TMPL = r""" +- (?P