Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package python-sqlparse for openSUSE:Factory
checked in at 2026-11-01 22:22:28
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/python-sqlparse (Old)
and /work/SRC/openSUSE:Factory/.python-sqlparse.new.1255 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-sqlparse"
Sun Nov 1 22:22:28 2026 rev:25 rq:1393786 version:0.6.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/python-sqlparse/python-sqlparse.changes
2026-08-19 17:55:11.634259074 +0200
+++
/work/SRC/openSUSE:Factory/.python-sqlparse.new.1255/python-sqlparse.changes
2026-11-01 22:22:59.354929966 +0100
@@ -1,0 +2,7 @@
+Fri Oct 30 05:53:51 UTC 2026 - Steve Kowalik <[email protected]>
+
+- CVE-2026-112307: Prevents arbitrary PHP code injection by escaping
+ dollar-signs. (bsc#1286096)
+ * Add patch CVE-2026-112307-php-output-filter-injection.patch
+
+-------------------------------------------------------------------
New:
----
CVE-2026-112307-php-output-filter-injection.patch
----------(New B)----------
New: dollar-signs. (bsc#1286096)
* Add patch CVE-2026-112307-php-output-filter-injection.patch
----------(New E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ python-sqlparse.spec ++++++
--- /var/tmp/diff_new_pack.eid6JZ/_old 2026-11-01 22:23:01.513019378 +0100
+++ /var/tmp/diff_new_pack.eid6JZ/_new 2026-11-01 22:23:01.518019586 +0100
@@ -29,6 +29,8 @@
License: BSD-3-Clause
URL: https://github.com/andialbrecht/sqlparse
Source:
https://files.pythonhosted.org/packages/source/s/sqlparse/sqlparse-%{version}.tar.gz
+# PATCH-FIX-UPSTREAM bsc#1286096 Based on gh#andialbrecht/sqlparse#930
+Patch0: CVE-2026-112307-php-output-filter-injection.patch
BuildRequires: %{python_module base >= 3.8}
BuildRequires: %{python_module hatchling}
BuildRequires: %{python_module pip}
@@ -51,7 +53,7 @@
parsing, splitting and formatting SQL statements.
%prep
-%setup -q -n sqlparse-%{version}
+%autosetup -p1 -n sqlparse-%{version}
sed -i -e '1{\,^#!%{_bindir}/env python,d}' sqlparse/__main__.py
sqlparse/cli.py
chmod -x sqlparse/cli.py
++++++ CVE-2026-112307-php-output-filter-injection.patch ++++++
>From b9bf8ab9fac48d831a58584b41b2f7741e1db285 Mon Sep 17 00:00:00 2001
From: Huanyi Xie <[email protected]>
Date: Sat, 10 Oct 2026 14:50:44 +0300
Subject: [PATCH] Preserve literal dollar signs in PHP output
---
CHANGELOG | 3 ++-
sqlparse/filters/output.py | 3 ++-
tests/test_format.py | 11 +++++++++++
3 files changed, 15 insertions(+), 2 deletions(-)
Index: sqlparse-0.6.0/sqlparse/filters/output.py
===================================================================
--- sqlparse-0.6.0.orig/sqlparse/filters/output.py
+++ sqlparse-0.6.0/sqlparse/filters/output.py
@@ -117,7 +117,8 @@ class OutputPHPFilter(OutputFilter):
# quote cannot break out of the generated string literal
# (GHSA-3496-9g83-7v6x).
else:
- token.value = token.value.replace('\\', '\\\\').replace('"',
'\\"')
+ token.value = (token.value.replace('\\', '\\\\')
+ .replace('"', '\\"').replace('$', '\\$'))
# Put the token
yield sql.Token(T.Text, token.value)
Index: sqlparse-0.6.0/tests/test_format.py
===================================================================
--- sqlparse-0.6.0.orig/tests/test_format.py
+++ sqlparse-0.6.0/tests/test_format.py
@@ -800,3 +800,14 @@ def test_strip_ws_removes_trailing_ws_in
strip_whitespace=True)
expected = '(where foo = bar) from'
assert formatted == expected
+
+
[email protected]('query, expected', [
+ ("SELECT '$name'", r'''$sql = "SELECT '\$name'";'''),
+ ('SELECT $body$text$body$', r'''$sql = "SELECT \$body\$text\$body\$";'''),
+ ('SELECT "$table"', r'''$sql = "SELECT \"\$table\"";'''),
+ ('SELECT 1 /* $name */', r'''$sql = "SELECT 1 /* \$name */";'''),
+ ("SELECT '\\$name'", r'''$sql = "SELECT '\\\$name'";'''),
+])
+def test_php_output_preserves_literal_dollar_signs(query, expected):
+ assert sqlparse.format(query, output_format='php') == expected
