diff --git a/lang/python314/Makefile b/lang/python314/Makefile index 554ce96668af..6830b8f512e0 100644 --- a/lang/python314/Makefile +++ b/lang/python314/Makefile @@ -1,188 +1,194 @@ PORTNAME= python -DISTVERSION= ${PYTHON_DISTVERSION} -PORTREVISION= 1 +DISTVERSION= ${PYTHON_DISTVERSION} # see Makefile.version CATEGORIES= lang python MASTER_SITES= PYTHON/ftp/python/${DISTVERSION:C/[a-z].*//} PKGNAMESUFFIX= ${PYTHON_SUFFIX} DISTNAME= Python-${DISTVERSION} DIST_SUBDIR= python MAINTAINER= mandree@FreeBSD.org COMMENT= Interpreted object-oriented programming language WWW= https://www.python.org/ LICENSE= PSFL LIB_DEPENDS= libffi.so:devel/libffi \ libzstd.so:archivers/zstd USES= compiler:c11 cpe ncurses pathfix pkgconfig readline \ shebangfix ssl tar:xz PATHFIX_MAKEFILEIN= Makefile.pre.in USE_LDCONFIG= yes GNU_CONFIGURE= yes python_CMD= ${PREFIX}/bin/python${PYTHON_DISTVERSION:R} SHEBANG_FILES= Lib/*.py Lib/*/*.py Lib/*/*/*.py Lib/*/*/*/*.py SHEBANG_FILES+= Lib/test/archivetestdata/exe_with_z64 \ Lib/test/archivetestdata/exe_with_zip \ Lib/test/archivetestdata/header.sh # Duplicate python.mk variables. TODO: Let lang/python?? ports use python.mk bits. PYTHON_VER= ${PYTHON_DISTVERSION:R} PYTHON_VERSION= python${PYTHON_VER} PYTHON_SUFFIX= ${PYTHON_VER:S/.//g} DISABLED_EXTENSIONS= _gdbm _sqlite3 _tkinter CONFIGURE_ARGS+= --enable-shared --without-ensurepip CONFIGURE_ENV+= OPT="" # Null out OPT to respect user CFLAGS and remove optimizations INSTALL_TARGET= altinstall # Don't want cloberring of unprefixed files # TEST_TARGET= buildbottest # that's the --slow-ci with more resources/longer timeouts TEST_TARGET= test # that's the --fast-ci with tighter timeouts and using less resources # TEST_ARGS: test_gdb requires debug symbols for the test_gdb.test_pretty_print test, so skip it unless defined(WITH_DEBUG) TEST_ARGS= TESTOPTS="-j${MAKE_JOBS_NUMBER} ${WITH_DEBUG:U-x test_gdb}" MAKE_ARGS+= COMPILEALL_OPTS=-j${MAKE_JOBS_NUMBER} \ INSTALL_SHARED="${INSTALL_LIB}" # Strip shared library SUB_FILES= pkg-message SUB_LIST= PYTHON_SUFFIX=${PYTHON_SUFFIX} PLIST_SUB= ABI=${ABIFLAGS} \ XY=${PYTHON_SUFFIX} \ XYDOT=${PYTHON_VER} \ XYZDOT=${DISTVERSION:C/[a-z].*//} \ OSMAJOR=${OSVERSION:C/([0-9]*)[0-9]{5}/\1/} # For plat-freebsd* in pkg-plist. https://bugs.python.org/issue19554 -OPTIONS_DEFINE= DEBUG IPV6 LIBMPDEC LTO NLS PYMALLOC +OPTIONS_DEFINE= DEBUG IPV6 LIBMPDEC NLS PYMALLOC OPTIONS_DEFAULT= LIBMPDEC LTO PYMALLOC -OPTIONS_EXCLUDE_powerpc64= LTO -OPTIONS_EXCLUDE_riscv64= LTO -OPTIONS_RADIO= HASH +OPTIONS_EXCLUDE_powerpc64= LTO LTOFULL +OPTIONS_EXCLUDE_riscv64= LTO LTOFULL +OPTIONS_RADIO= HASH LTO OPTIONS_RADIO_HASH= FNV SIPHASH +OPTIONS_RADIO_LTO= LTO LTOFULL OPTIONS_SUB= yes LIBMPDEC_DESC= Use libmpdec from ports instead of bundled version +LTO_DESC= Use Link-Time Optimization with -flto=thin +LTOFULL_DESC= Use -flto=full (not =thin) (faster build at more CPU time) NLS_DESC= Enable gettext support for the locale module PYMALLOC_DESC= Enable specialized mallocs HASH_DESC= Hash Algorithm (PEP-456) FNV_DESC= Modified Fowler-Noll-Vo Algorithm SIPHASH_DESC= SipHash24 Algorithm FNV_CONFIGURE_ON= --with-hash-algorithm=fnv SIPHASH_CONFIGURE_ON= --with-hash-algorithm=siphash24 DEBUG_CONFIGURE_WITH= pydebug IPV6_CONFIGURE_ENABLE= ipv6 LIBMPDEC_CONFIGURE_ON= --with-system-libmpdec LIBMPDEC_LIB_DEPENDS= libmpdec.so:math/mpdecimal LTO_CONFIGURE_ON= --with-lto +LTOFULL_CONFIGURE_ON= --with-lto=full # Use CPPFLAGS over CFLAGS due to -I ordering, causing elementtree and pyexpat # to break in Python 2.7, or preprocessor complaints in Python >= 3.3 # Upstream Issue: https://bugs.python.org/issue6299 NLS_USES= gettext-runtime NLS_CPPFLAGS= -I${LOCALBASE}/include NLS_LIBS= -L${LOCALBASE}/lib -lintl NLS_CONFIGURE_ENV_OFF= ac_cv_lib_intl_textdomain=no ac_cv_header_libintl_h=no PYMALLOC_CONFIGURE_WITH= pymalloc .include "${.CURDIR}/Makefile.version" .include .if ${PORT_OPTIONS:MDEBUG} ABIFLAGS:= d${ABIFLAGS} .endif .if !empty(ABIFLAGS) PLIST_FILES+= bin/python${PYTHON_VER}${ABIFLAGS} \ bin/python${PYTHON_VER}${ABIFLAGS}-config \ libdata/pkgconfig/python-${PYTHON_VER}${ABIFLAGS}.pc \ libdata/pkgconfig/python-${PYTHON_VER}${ABIFLAGS}-embed.pc .endif .if ${ARCH} == sparc64 CFLAGS+= -DPYTHON_DEFAULT_RECURSION_LIMIT=900 .endif # See https://bugs.freebsd.org/115940 and https://bugs.freebsd.org/193650 .if !exists(/usr/bin/ypcat) || defined(WITHOUT_NIS) PLIST_SUB+= NO_NIS="@comment " DISABLED_EXTENSIONS+= nis .else PLIST_SUB+= NO_NIS="" .endif # Python 3.10 requires OpenSSL >= 1.1.1 (PEP 644), so with # libressl, some modules are not built .if ${SSL_DEFAULT:Mlibressl*} PLIST_SUB+= SUPPORTED_OPENSSL="@comment " .else PLIST_SUB+= SUPPORTED_OPENSSL="" .endif post-patch: # disable the detection of includes and library from e2fsprogs-libuuid, # which introduces hidden dependency and breaks build @${REINPLACE_CMD} -e 's|uuid/uuid.h|ignore_&|' ${WRKSRC}/configure # disable detection of multiarch as it breaks with clang >= 13, which adds a # major.minor version number in -print-multiarch output, confusing Python @${REINPLACE_CMD} -e 's|^\( *MULTIARCH=\).*--print-multiarch.*|\1|' ${WRKSRC}/configure # Apply DISABLED_EXTENSIONS @${ECHO_CMD} '*disabled*' > ${WRKSRC}/Modules/Setup.local . for _module in ${DISABLED_EXTENSIONS} @${ECHO_CMD} ${_module} >> ${WRKSRC}/Modules/Setup.local . endfor post-install: .if ! ${PORT_OPTIONS:MDEBUG} ${RM} ${STAGEDIR}${PREFIX}/lib/libpython3.so # Upstream Issue: https://bugs.python.org/issue17975 .endif ${LN} -sf libpython${PYTHON_VER}${ABIFLAGS}.so.1.0 ${STAGEDIR}${PREFIX}/lib/libpython${PYTHON_VER}${ABIFLAGS}.so.1 # This code block exists for the qemu-user enabled cross build environment. # When using this environment in poudriere, CC is not set to the default # of /usr/bin/cc and a cross-compile toolchain is used. We need to hand # edit this so that the run time configuration for python matches what the # FreeBSD base system provides. sbruno 02Aug2017 .if ${CC} == /nxb-bin/usr/bin/cc @${REINPLACE_CMD} -e 's=/nxb-bin==g' \ ${STAGEDIR}${PREFIX}/lib/python${PYTHON_VER}/_sysconfigdata_${ABIFLAGS}_freebsd_.py @cd ${WRKSRC} && ${SETENV} LD_LIBRARY_PATH=${WRKSRC} \ ./python -E -m compileall -d ${PREFIX}/lib/python${PYTHON_VER} \ ${STAGEDIR}${PREFIX}/lib/python${PYTHON_VER}/_sysconfigdata_${ABIFLAGS}_freebsd_.py @cd ${WRKSRC} && ${SETENV} LD_LIBRARY_PATH=${WRKSRC} \ ./python -E -O -m compileall -d ${PREFIX}/lib/python${PYTHON_VER} \ ${STAGEDIR}${PREFIX}/lib/python${PYTHON_VER}/_sysconfigdata_${ABIFLAGS}_freebsd_.py @${REINPLACE_CMD} -e 's=/nxb-bin==g' \ ${STAGEDIR}${PREFIX}/lib/python${PYTHON_VER}/config-${PYTHON_VER}${ABIFLAGS}/Makefile .endif for i in ${STAGEDIR}${PREFIX}/lib/python${PYTHON_VER}/lib-dynload/*.so; do \ ${STRIP_CMD} $$i; done # Strip shared extensions ${INSTALL_DATA} ${WRKSRC}/Tools/gdb/libpython.py \ ${STAGEDIR}${PREFIX}/lib/libpython${PYTHON_VER}${ABIFLAGS}.so.1.0-gdb.py _sigstorebundle=${DISTFILES}.sigstore ${_sigstorebundle}: ${FETCH_CMD} ${MASTER_SITES}/${_sigstorebundle} sigstore-verify: ${_sigstorebundle} checksum sigstore verify identity \ --bundle ${DISTFILES}.sigstore \ --cert-identity hugo@python.org \ --cert-oidc-issuer https://github.com/login/oauth \ ${DISTDIR}/${DIST_SUBDIR}/${DISTFILES} pre-test: @${ECHO_CMD} "=== NOTE: the py314-* gdbm, sqlite3, tkinter modules must be rebuilt before the test ===" +.if ${PORT_OPTIONS:MDEBUG} + @${ECHO_CMD} "=== NOTE: The test_ssl test is known to fail with DEBUG option enabled ===" +.endif sleep 5 post-clean: ${RM} ${_sigstorebundle} .include diff --git a/lang/python314/Makefile.version b/lang/python314/Makefile.version index bd8623e62931..c8ccfa3963b0 100644 --- a/lang/python314/Makefile.version +++ b/lang/python314/Makefile.version @@ -1,7 +1,7 @@ # Mk/Uses/python.mk includes this file, don't remove it! # Do not forget to # 1. Update python documentation (lang/python-doc-*) # Run "make -C lang/python-doc-html makesum" # 2. Remove PORTREVISION in Makefile -PYTHON_DISTVERSION= 3.14.3 +PYTHON_DISTVERSION= 3.14.4 diff --git a/lang/python314/distinfo b/lang/python314/distinfo index a8bc1fff91f4..7c5dead58955 100644 --- a/lang/python314/distinfo +++ b/lang/python314/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1770247285 -SHA256 (python/Python-3.14.3.tar.xz) = a97d5549e9ad81fe17159ed02c68774ad5d266c72f8d9a0b5a9c371fe85d902b -SIZE (python/Python-3.14.3.tar.xz) = 23778568 +TIMESTAMP = 1775640582 +SHA256 (python/Python-3.14.4.tar.xz) = d923c51303e38e249136fc1bdf3568d56ecb03214efdef48516176d3d7faaef8 +SIZE (python/Python-3.14.4.tar.xz) = 23855332 diff --git a/lang/python314/files/patch-gh-146211-reject-CR_LF-in-HTTP-tunnel-request-headers b/lang/python314/files/patch-gh-146211-reject-CR_LF-in-HTTP-tunnel-request-headers new file mode 100644 index 000000000000..989f22a0529b --- /dev/null +++ b/lang/python314/files/patch-gh-146211-reject-CR_LF-in-HTTP-tunnel-request-headers @@ -0,0 +1,108 @@ +From afdd351544e8112d4070a31f2218f99256697472 Mon Sep 17 00:00:00 2001 +From: Seth Larson +Date: Fri, 10 Apr 2026 10:21:42 -0500 +Subject: [PATCH] gh-146211: Reject CR/LF in HTTP tunnel request headers + (GH-146212) (cherry picked from commit + 05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69) + +Co-authored-by: Seth Larson +Co-authored-by: Illia Volochii +--- + Lib/http/client.py | 11 ++++- + Lib/test/test_httplib.py | 45 +++++++++++++++++++ + ...-03-20-09-29-42.gh-issue-146211.PQVbs7.rst | 2 + + 3 files changed, 57 insertions(+), 1 deletion(-) + create mode 100644 Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst + +diff --git a/Lib/http/client.py b/Lib/http/client.py +index 77f8d26291dfc2..6fb7d254ea9c27 100644 +--- ./Lib/http/client.py ++++ b/Lib/http/client.py +@@ -972,13 +972,22 @@ def _wrap_ipv6(self, ip): + return ip + + def _tunnel(self): ++ if _contains_disallowed_url_pchar_re.search(self._tunnel_host): ++ raise ValueError('Tunnel host can\'t contain control characters %r' ++ % (self._tunnel_host,)) + connect = b"CONNECT %s:%d %s\r\n" % ( + self._wrap_ipv6(self._tunnel_host.encode("idna")), + self._tunnel_port, + self._http_vsn_str.encode("ascii")) + headers = [connect] + for header, value in self._tunnel_headers.items(): +- headers.append(f"{header}: {value}\r\n".encode("latin-1")) ++ header_bytes = header.encode("latin-1") ++ value_bytes = value.encode("latin-1") ++ if not _is_legal_header_name(header_bytes): ++ raise ValueError('Invalid header name %r' % (header_bytes,)) ++ if _is_illegal_header_value(value_bytes): ++ raise ValueError('Invalid header value %r' % (value_bytes,)) ++ headers.append(b"%s: %s\r\n" % (header_bytes, value_bytes)) + headers.append(b"\r\n") + # Making a single send() call instead of one per line encourages + # the host OS to use a more optimal packet size instead of +diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py +index bcb828edec7c39..6f3eac6b98a4de 100644 +--- ./Lib/test/test_httplib.py ++++ b/Lib/test/test_httplib.py +@@ -369,6 +369,51 @@ def test_invalid_headers(self): + with self.assertRaisesRegex(ValueError, 'Invalid header'): + conn.putheader(name, value) + ++ def test_invalid_tunnel_headers(self): ++ cases = ( ++ ('Invalid\r\nName', 'ValidValue'), ++ ('Invalid\rName', 'ValidValue'), ++ ('Invalid\nName', 'ValidValue'), ++ ('\r\nInvalidName', 'ValidValue'), ++ ('\rInvalidName', 'ValidValue'), ++ ('\nInvalidName', 'ValidValue'), ++ (' InvalidName', 'ValidValue'), ++ ('\tInvalidName', 'ValidValue'), ++ ('Invalid:Name', 'ValidValue'), ++ (':InvalidName', 'ValidValue'), ++ ('ValidName', 'Invalid\r\nValue'), ++ ('ValidName', 'Invalid\rValue'), ++ ('ValidName', 'Invalid\nValue'), ++ ('ValidName', 'InvalidValue\r\n'), ++ ('ValidName', 'InvalidValue\r'), ++ ('ValidName', 'InvalidValue\n'), ++ ) ++ for name, value in cases: ++ with self.subTest((name, value)): ++ conn = client.HTTPConnection('example.com') ++ conn.set_tunnel('tunnel', headers={ ++ name: value ++ }) ++ conn.sock = FakeSocket('') ++ with self.assertRaisesRegex(ValueError, 'Invalid header'): ++ conn._tunnel() # Called in .connect() ++ ++ def test_invalid_tunnel_host(self): ++ cases = ( ++ 'invalid\r.host', ++ '\ninvalid.host', ++ 'invalid.host\r\n', ++ 'invalid.host\x00', ++ 'invalid host', ++ ) ++ for tunnel_host in cases: ++ with self.subTest(tunnel_host): ++ conn = client.HTTPConnection('example.com') ++ conn.set_tunnel(tunnel_host) ++ conn.sock = FakeSocket('') ++ with self.assertRaisesRegex(ValueError, 'Tunnel host can\'t contain control characters'): ++ conn._tunnel() # Called in .connect() ++ + def test_headers_debuglevel(self): + body = ( + b'HTTP/1.1 200 OK\r\n' +diff --git a/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst b/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst +new file mode 100644 +index 00000000000000..4993633b8ebebb +--- /dev/null ++++ ./Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst +@@ -0,0 +1,2 @@ ++Reject CR/LF characters in tunnel request headers for the ++HTTPConnection.set_tunnel() method. diff --git a/lang/python314/files/patch-gh-146333-Fix-quadratic-regex-backtracking-in-configparser b/lang/python314/files/patch-gh-146333-Fix-quadratic-regex-backtracking-in-configparser new file mode 100644 index 000000000000..7dffa8ff1cfe --- /dev/null +++ b/lang/python314/files/patch-gh-146333-Fix-quadratic-regex-backtracking-in-configparser @@ -0,0 +1,83 @@ +From ab8704a8e05e2f926c10f994e4085e8726048fa4 Mon Sep 17 00:00:00 2001 +From: Joshua Swanson <22283299+joshuaswanson@users.noreply.github.com> +Date: Tue, 7 Apr 2026 16:10:34 +0200 +Subject: [PATCH] gh-146333: Fix quadratic regex backtracking in configparser + option parsing (GH-146399) + +Use negative lookahead in option regex to prevent backtracking, and to avoid changing logic outside the regexes (since people could use the regex directly). +(cherry picked from commit 7e0a0be4097f9d29d66fe23f5af86f18a34ed7dd) + +Co-authored-by: Joshua Swanson <22283299+joshuaswanson@users.noreply.github.com> +--- + Lib/configparser.py | 8 ++++++-- + Lib/test/test_configparser.py | 20 +++++++++++++++++++ + ...3-25-00-51-03.gh-issue-146333.LqdL__bn.rst | 3 +++ + 3 files changed, 29 insertions(+), 2 deletions(-) + create mode 100644 Misc/NEWS.d/next/Security/2026-03-25-00-51-03.gh-issue-146333.LqdL__bn.rst + +diff --git a/Lib/configparser.py b/Lib/configparser.py +index d435a5c2fe0da2..e76647d339e913 100644 +--- ./Lib/configparser.py ++++ b/Lib/configparser.py +@@ -613,7 +613,9 @@ class RawConfigParser(MutableMapping): + \] # ] + """ + _OPT_TMPL = r""" +- (?P