Merged
Fix CVE-2026-59923 in python-mistune #36
G7egHNAdd on Aug 18
Fix CVE-2026-59923 in python-mistune #36
Merged
Total: 2 files changed+51-1
| @@ -0,0 +1,46 @@ | |||
| 1 | +diff --git a/mistune/renderers.py b/mistune/renderers.py | ||
| 2 | +index 18d3565..a667805 100644 | ||
| 3 | +--- a/mistune/renderers.py | ||
| 4 | ++++ b/mistune/renderers.py | ||
| 5 | +@@ -1,3 +1,5 @@ | ||
| 6 | ++from urllib.parse import unquote | ||
| 7 | ++ | ||
| 8 | + from .util import escape, escape_html | ||
| 9 | + | ||
| 10 | + | ||
| 11 | +@@ -122,9 +124,16 @@ class HTMLRenderer(BaseRenderer): | ||
| 12 | + allowed = set(self._allow_harmful_protocols) | ||
| 13 | + schemes = self.HARMFUL_PROTOCOLS - allowed | ||
| 14 | + | ||
| 15 | ++ decoded_url = url | ||
| 16 | ++ for _ in range(3): | ||
| 17 | ++ value = unquote(decoded_url) | ||
| 18 | ++ if value == decoded_url: | ||
| 19 | ++ break | ||
| 20 | ++ decoded_url = value | ||
| 21 | ++ | ||
| 22 | + if schemes: | ||
| 23 | + for s in schemes: | ||
| 24 | +- if url.lower().startswith(s): | ||
| 25 | ++ if decoded_url.lower().startswith(s): | ||
| 26 | + url = '#harmful-link' | ||
| 27 | + break | ||
| 28 | + return url | ||
| 29 | +diff --git a/tests/test_misc.py b/tests/test_misc.py | ||
| 30 | +index 8dd15cd..e50c95c 100644 | ||
| 31 | +--- a/tests/test_misc.py | ||
| 32 | ++++ b/tests/test_misc.py | ||
| 33 | +@@ -46,6 +46,13 @@ class TestMiscCases(TestCase): | ||
| 34 | + expected = '<p><a href="#harmful-link">h</a></p>' | ||
| 35 | + self.assertEqual(result.strip(), expected) | ||
| 36 | + | ||
| 37 | ++ def test_percent_encoded_harmful_links(self): | ||
| 38 | ++ for text in ( | ||
| 39 | ++ '[h](javascript%3Aalert(1))', | ||
| 40 | ++ '[h](javascript%253Aalert(1))', | ||
| 41 | ++ ''): | ||
| 42 | ++ self.assertIn('#harmful-link', mistune.html(text), text) | ||
| 43 | ++ | ||
| 44 | + def test_allow_harmful_protocols(self): | ||
| 45 | + renderer = mistune.HTMLRenderer(allow_harmful_protocols=True) | ||
| 46 | + md = mistune.Markdown(renderer) | ||
| @@ -1,11 +1,12 @@ | |||
| 1 | Name: python-mistune | 1 | Name: python-mistune |
| 2 | Version: 2.0.4 | 2 | Version: 2.0.4 |
| 3 | -Release: 2 | 3 | +Release: 3 |
| 4 | Summary: A Python Markdown Parser | 4 | Summary: A Python Markdown Parser |
| 5 | License: BSD-3-Clause | 5 | License: BSD-3-Clause |
| 6 | URL: https://github.com/lepture/mistune | 6 | URL: https://github.com/lepture/mistune |
| 7 | Source0: %url/archive/v%{version}/mistune-%{version}.tar.gz | 7 | Source0: %url/archive/v%{version}/mistune-%{version}.tar.gz |
| 8 | Source1: %url/archive/v%{version}/mistune-0.8.4.tar.gz | 8 | Source1: %url/archive/v%{version}/mistune-0.8.4.tar.gz |
| 9 | +Patch0: CVE-2026-59923.patch | ||
| 9 | 10 | ||
| 10 | BuildArch: noarch | 11 | BuildArch: noarch |
| 11 | 12 | ||
| @@ -76,6 +77,9 @@ rm -rf ./mistune_v1/tests | |||
| 76 | %{python3_sitelib}/mistune_v1-*.dist-info | 77 | %{python3_sitelib}/mistune_v1-*.dist-info |
| 77 | 78 | ||
| 78 | %changelog | 79 | %changelog |
| 80 | +* Tue Aug 18 2026 G7egHN <3120705253@qq.com> - 2.0.4-3 | ||
| 81 | +- Fix CVE-2026-59923 | ||
| 82 | + | ||
| 79 | * Fri Nov 10 2023 Dongxing Wang <dxwangk@isoftstone.com> - 2.0.4-2 | 83 | * Fri Nov 10 2023 Dongxing Wang <dxwangk@isoftstone.com> - 2.0.4-2 |
| 80 | - Add v1 package release | 84 | - Add v1 package release |
| 81 | 85 | ||