Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python312 for openSUSE:Factory checked in at 2026-08-15 22:40:34 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python312 (Old) and /work/SRC/openSUSE:Factory/.python312.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python312" Sat Aug 15 22:40:34 2026 rev:52 rq:1371253 version:3.12.13 Changes: -------- --- /work/SRC/openSUSE:Factory/python312/python312.changes 2026-08-01 18:28:54.534910693 +0200 +++ /work/SRC/openSUSE:Factory/.python312.new.1258/python312.changes 2026-08-15 22:41:01.662434495 +0200 @@ -1,0 +2,7 @@ +Sat Aug 8 15:14:27 UTC 2026 - Matej Cepl <[email protected]> + +- noCVE: CVE-2026-6019 fix does not handle non-ascii chars correctly + (bsc#1263083) (internal SUSE bug so far, no CVE yet) + bsc1263083-http-cookies-atob-utf8.patch + +------------------------------------------------------------------- New: ---- bsc1263083-http-cookies-atob-utf8.patch ----------(New B)---------- New: (bsc#1263083) (internal SUSE bug so far, no CVE yet) bsc1263083-http-cookies-atob-utf8.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python312.spec ++++++ --- /var/tmp/diff_new_pack.9HUbyl/_old 2026-08-15 22:41:05.256561009 +0200 +++ /var/tmp/diff_new_pack.9HUbyl/_new 2026-08-15 22:41:05.260561150 +0200 @@ -265,6 +265,9 @@ # PATCH-FIX-UPSTREAM CVE-2026-3276-On2-unicodedata-normalize.patch bsc#1267581 [email protected] # gh-149079: Fix O(n^2) canonical ordering in unicodedata.normalize() Patch79: CVE-2026-3276-On2-unicodedata-normalize.patch +# PATCH-FIX-UPSTREAM bsc1263083-http-cookies-atob-utf8.patch bsc#1263083 [email protected] +# Use decodeURIComponent() for UTF-8 support in js_output() +Patch80: bsc1263083-http-cookies-atob-utf8.patch ### END OF PATCHES BuildRequires: autoconf-archive BuildRequires: automake ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.9HUbyl/_old 2026-08-15 22:41:05.803580264 +0200 +++ /var/tmp/diff_new_pack.9HUbyl/_new 2026-08-15 22:41:05.815580686 +0200 @@ -1,6 +1,6 @@ -mtime: 1785506276 -commit: dc5782910c671851c0c6988f459e9ac9e73a1c74881059612ce050729d67cda3 +mtime: 1786312529 +commit: dbfdd41cea966f9f8c52f560faa4bfbf69985b8f6a72bff8984c10913233b5cf url: https://src.opensuse.org/python-interpreters/python312 -revision: dc5782910c671851c0c6988f459e9ac9e73a1c74881059612ce050729d67cda3 +revision: dbfdd41cea966f9f8c52f560faa4bfbf69985b8f6a72bff8984c10913233b5cf projectscmsync: https://src.opensuse.org/python-interpreters/_ObsPrj ++++++ bsc1263083-http-cookies-atob-utf8.patch ++++++ >From 1d0cf3110288191db3bf07228456a24ddf6d344f Mon Sep 17 00:00:00 2001 From: Seth Larson <[email protected]> Date: Thu, 14 May 2026 16:10:39 -0500 Subject: [PATCH 1/2] [3.13] gh-149144: Use decodeURIComponent() for UTF-8 support in js_output() (GH-149157) (cherry picked from commit 461b1d96313de02992d284c1782be9aff24586c9) --- Lib/http/cookies.py | 6 +++--- Lib/test/test_http_cookies.py | 27 ++++++++++++++------------- 2 files changed, 17 insertions(+), 16 deletions(-) Index: Python-3.12.13/Lib/http/cookies.py =================================================================== --- Python-3.12.13.orig/Lib/http/cookies.py 2026-08-08 22:17:38.717876965 +0200 +++ Python-3.12.13/Lib/http/cookies.py 2026-08-08 22:17:42.129593311 +0200 @@ -389,18 +389,18 @@ return '<%s: %s>' % (self.__class__.__name__, self.OutputString()) def js_output(self, attrs=None): - import base64 + import urllib.parse # Print javascript output_string = self.OutputString(attrs) if _has_control_character(output_string): raise CookieError("Control characters are not allowed in cookies") # Base64-encode value to avoid template # injection in cookie values. - output_encoded = base64.b64encode(output_string.encode('utf-8')).decode("ascii") + output_encoded = urllib.parse.quote(output_string, safe='', encoding='utf-8') return """ <script type="text/javascript"> <!-- begin hiding - document.cookie = atob(\"%s\"); + document.cookie = decodeURIComponent(\"%s\"); // end hiding --> </script> """ % (output_encoded,) Index: Python-3.12.13/Lib/test/test_http_cookies.py =================================================================== --- Python-3.12.13.orig/Lib/test/test_http_cookies.py 2026-08-08 22:17:38.718292458 +0200 +++ Python-3.12.13/Lib/test/test_http_cookies.py 2026-08-08 22:17:42.129751609 +0200 @@ -1,10 +1,10 @@ # Simple test suite for http/cookies.py -import base64 import copy import unittest import doctest from http import cookies import pickle +import urllib.parse from test import support @@ -152,19 +152,19 @@ self.assertEqual(C.output(['path']), 'Set-Cookie: Customer="WILE_E_COYOTE"; Path=/acme') - cookie_encoded = base64.b64encode(b'Customer="WILE_E_COYOTE"; Path=/acme; Version=1').decode('ascii') + cookie_encoded = urllib.parse.quote('Customer="WILE_E_COYOTE"; Path=/acme; Version=1', safe='', encoding='utf-8') self.assertEqual(C.js_output(), fr""" <script type="text/javascript"> <!-- begin hiding - document.cookie = atob("{cookie_encoded}"); + document.cookie = decodeURIComponent("{cookie_encoded}"); // end hiding --> </script> """) - cookie_encoded = base64.b64encode(b'Customer="WILE_E_COYOTE"; Path=/acme').decode('ascii') + cookie_encoded = urllib.parse.quote('Customer="WILE_E_COYOTE"; Path=/acme', safe='', encoding='utf-8') self.assertEqual(C.js_output(['path']), fr""" <script type="text/javascript"> <!-- begin hiding - document.cookie = atob("{cookie_encoded}"); + document.cookie = decodeURIComponent("{cookie_encoded}"); // end hiding --> </script> """) @@ -261,19 +261,19 @@ self.assertEqual(C.output(['path']), 'Set-Cookie: Customer="WILE_E_COYOTE"; Path=/acme') - expected_encoded_cookie = base64.b64encode(b'Customer=\"WILE_E_COYOTE\"; Path=/acme; Version=1').decode('ascii') + expected_encoded_cookie = urllib.parse.quote('Customer=\"WILE_E_COYOTE\"; Path=/acme; Version=1', safe='', encoding='utf-8') self.assertEqual(C.js_output(), fr""" <script type="text/javascript"> <!-- begin hiding - document.cookie = atob("{expected_encoded_cookie}"); + document.cookie = decodeURIComponent("{expected_encoded_cookie}"); // end hiding --> </script> """) - expected_encoded_cookie = base64.b64encode(b'Customer=\"WILE_E_COYOTE\"; Path=/acme').decode('ascii') + expected_encoded_cookie = urllib.parse.quote('Customer=\"WILE_E_COYOTE\"; Path=/acme', safe='', encoding='utf-8') self.assertEqual(C.js_output(['path']), fr""" <script type="text/javascript"> <!-- begin hiding - document.cookie = atob("{expected_encoded_cookie}"); + document.cookie = decodeURIComponent("{expected_encoded_cookie}"); // end hiding --> </script> """) @@ -364,13 +364,14 @@ self.assertEqual( M.output(), "Set-Cookie: %s=%s; Path=/foo" % (i, "%s_coded_val" % i)) - expected_encoded_cookie = base64.b64encode( - ("%s=%s; Path=/foo" % (i, "%s_coded_val" % i)).encode("ascii") - ).decode('ascii') + expected_encoded_cookie = urllib.parse.quote( + "%s=%s; Path=/foo" % (i, "%s_coded_val" % i), + safe='', encoding='utf-8', + ) expected_js_output = """ <script type="text/javascript"> <!-- begin hiding - document.cookie = atob("%s"); + document.cookie = decodeURIComponent("%s"); // end hiding --> </script> """ % (expected_encoded_cookie,) ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-08-09 23:55:29.000000000 +0200 @@ -0,0 +1,6 @@ +_build.* +*.obscpio +*.osc +.osc +.pbuild +python312-3.12.*-build
