Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python311 for openSUSE:Factory checked in at 2026-08-15 22:40:30 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python311 (Old) and /work/SRC/openSUSE:Factory/.python311.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python311" Sat Aug 15 22:40:30 2026 rev:72 rq:1371242 version:3.11.15 Changes: -------- --- /work/SRC/openSUSE:Factory/python311/python311.changes 2026-08-01 18:29:08.111373229 +0200 +++ /work/SRC/openSUSE:Factory/.python311.new.1258/python311.changes 2026-08-15 22:40:52.574114585 +0200 @@ -1,0 +2,7 @@ +Sat Aug 8 15:14:27 UTC 2026 - Matej Cepl <[email protected]> + +- noCVE: CVE-2026-6019 fix does not handle non-ascii chars correctly + (bsc#1263083) (internal SUSE bug so far, no CVE yet) + bsc1263083-http-cookies-atob-utf8.patch + +------------------------------------------------------------------- New: ---- bsc1263083-http-cookies-atob-utf8.patch ----------(New B)---------- New: (bsc#1263083) (internal SUSE bug so far, no CVE yet) bsc1263083-http-cookies-atob-utf8.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python311.spec ++++++ --- /var/tmp/diff_new_pack.9Ghgeq/_old 2026-08-15 22:40:54.281174673 +0200 +++ /var/tmp/diff_new_pack.9Ghgeq/_new 2026-08-15 22:40:54.283174744 +0200 @@ -261,6 +261,9 @@ # PATCH-FIX-UPSTREAM CVE-2026-3276-On2-unicodedata-normalize.patch bsc#1267581 [email protected] # gh-149079: Fix O(n^2) canonical ordering in unicodedata.normalize() Patch57: CVE-2026-3276-On2-unicodedata-normalize.patch +# PATCH-FIX-UPSTREAM bsc1263083-http-cookies-atob-utf8.patch bsc#1263083 [email protected] +# Use decodeURIComponent() for UTF-8 support in js_output() +Patch58: bsc1263083-http-cookies-atob-utf8.patch ### END OF PATCHES BuildRequires: autoconf-archive BuildRequires: automake ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.9Ghgeq/_old 2026-08-15 22:40:54.521183122 +0200 +++ /var/tmp/diff_new_pack.9Ghgeq/_new 2026-08-15 22:40:54.524183227 +0200 @@ -1,6 +1,6 @@ -mtime: 1785538846 -commit: 55a7750074e8b147aaffe21874f11ba6af3db22616889b342286615d2ac93a7a +mtime: 1786312480 +commit: 26d43f9c46fae0a0be12add2d4bcff4da26a2d67d184177bb91bfca3b4ea31ae url: https://src.opensuse.org/python-interpreters/python311 -revision: 55a7750074e8b147aaffe21874f11ba6af3db22616889b342286615d2ac93a7a +revision: 26d43f9c46fae0a0be12add2d4bcff4da26a2d67d184177bb91bfca3b4ea31ae projectscmsync: https://src.opensuse.org/python-interpreters/_ObsPrj ++++++ bsc1263083-http-cookies-atob-utf8.patch ++++++ >From 1d0cf3110288191db3bf07228456a24ddf6d344f Mon Sep 17 00:00:00 2001 From: Seth Larson <[email protected]> Date: Thu, 14 May 2026 16:10:39 -0500 Subject: [PATCH 1/2] [3.13] gh-149144: Use decodeURIComponent() for UTF-8 support in js_output() (GH-149157) (cherry picked from commit 461b1d96313de02992d284c1782be9aff24586c9) --- Lib/http/cookies.py | 6 +++--- Lib/test/test_http_cookies.py | 27 ++++++++++++++------------- 2 files changed, 17 insertions(+), 16 deletions(-) Index: Python-3.11.15/Lib/http/cookies.py =================================================================== --- Python-3.11.15.orig/Lib/http/cookies.py 2026-08-08 22:20:13.129398461 +0200 +++ Python-3.11.15/Lib/http/cookies.py 2026-08-08 22:20:17.089716398 +0200 @@ -389,18 +389,18 @@ return '<%s: %s>' % (self.__class__.__name__, self.OutputString()) def js_output(self, attrs=None): - import base64 + import urllib.parse # Print javascript output_string = self.OutputString(attrs) if _has_control_character(output_string): raise CookieError("Control characters are not allowed in cookies") # Base64-encode value to avoid template # injection in cookie values. - output_encoded = base64.b64encode(output_string.encode('utf-8')).decode("ascii") + output_encoded = urllib.parse.quote(output_string, safe='', encoding='utf-8') return """ <script type="text/javascript"> <!-- begin hiding - document.cookie = atob(\"%s\"); + document.cookie = decodeURIComponent(\"%s\"); // end hiding --> </script> """ % (output_encoded,) Index: Python-3.11.15/Lib/test/test_http_cookies.py =================================================================== --- Python-3.11.15.orig/Lib/test/test_http_cookies.py 2026-08-08 22:20:13.131379374 +0200 +++ Python-3.11.15/Lib/test/test_http_cookies.py 2026-08-08 22:20:17.090353950 +0200 @@ -1,5 +1,5 @@ # Simple test suite for http/cookies.py -import base64 +import urllib.parse import copy import unittest import doctest @@ -106,19 +106,19 @@ self.assertEqual(C.output(['path']), 'Set-Cookie: Customer="WILE_E_COYOTE"; Path=/acme') - cookie_encoded = base64.b64encode(b'Customer="WILE_E_COYOTE"; Path=/acme; Version=1').decode('ascii') + cookie_encoded = urllib.parse.quote('Customer="WILE_E_COYOTE"; Path=/acme; Version=1', safe='', encoding='utf-8') self.assertEqual(C.js_output(), fr""" <script type="text/javascript"> <!-- begin hiding - document.cookie = atob("{cookie_encoded}"); + document.cookie = decodeURIComponent("{cookie_encoded}"); // end hiding --> </script> """) - cookie_encoded = base64.b64encode(b'Customer="WILE_E_COYOTE"; Path=/acme').decode('ascii') + cookie_encoded = urllib.parse.quote('Customer="WILE_E_COYOTE"; Path=/acme', safe='', encoding='utf-8') self.assertEqual(C.js_output(['path']), fr""" <script type="text/javascript"> <!-- begin hiding - document.cookie = atob("{cookie_encoded}"); + document.cookie = decodeURIComponent("{cookie_encoded}"); // end hiding --> </script> """) @@ -215,19 +215,19 @@ self.assertEqual(C.output(['path']), 'Set-Cookie: Customer="WILE_E_COYOTE"; Path=/acme') - expected_encoded_cookie = base64.b64encode(b'Customer=\"WILE_E_COYOTE\"; Path=/acme; Version=1').decode('ascii') + expected_encoded_cookie = urllib.parse.quote('Customer=\"WILE_E_COYOTE\"; Path=/acme; Version=1', safe='', encoding='utf-8') self.assertEqual(C.js_output(), fr""" <script type="text/javascript"> <!-- begin hiding - document.cookie = atob("{expected_encoded_cookie}"); + document.cookie = decodeURIComponent("{expected_encoded_cookie}"); // end hiding --> </script> """) - expected_encoded_cookie = base64.b64encode(b'Customer=\"WILE_E_COYOTE\"; Path=/acme').decode('ascii') + expected_encoded_cookie = urllib.parse.quote('Customer=\"WILE_E_COYOTE\"; Path=/acme', safe='', encoding='utf-8') self.assertEqual(C.js_output(['path']), fr""" <script type="text/javascript"> <!-- begin hiding - document.cookie = atob("{expected_encoded_cookie}"); + document.cookie = decodeURIComponent("{expected_encoded_cookie}"); // end hiding --> </script> """) @@ -318,13 +318,14 @@ self.assertEqual( M.output(), "Set-Cookie: %s=%s; Path=/foo" % (i, "%s_coded_val" % i)) - expected_encoded_cookie = base64.b64encode( - ("%s=%s; Path=/foo" % (i, "%s_coded_val" % i)).encode("ascii") - ).decode('ascii') + expected_encoded_cookie = urllib.parse.quote( + "%s=%s; Path=/foo" % (i, "%s_coded_val" % i), + safe='', encoding='utf-8', + ) expected_js_output = """ <script type="text/javascript"> <!-- begin hiding - document.cookie = atob("%s"); + document.cookie = decodeURIComponent("%s"); // end hiding --> </script> """ % (expected_encoded_cookie,) ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-08-09 23:54:40.000000000 +0200 @@ -0,0 +1,7 @@ +_build.* +*.obscpio +*.osc +.osc +.pbuild +python311*-build/ +*.rej
