Define a buildrequire_extras %bcond for bootstrapping

Fix for CVE-2022-2309

Resolves: rhbz#2107571, rhbz#2110131

.cvsignore

@@ -1,2 +0,0 @@
-lxml-2.2.4.tar.gz
-lxml-2.2.4.tar.gz.asc

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -0,0 +1,60 @@
+lxml-2.2.7.tar.gz
+lxml-2.2.7.tar.gz.asc
+/lxml-2.2.8.tar.gz
+/lxml-2.2.8.tar.gz.asc
+/lxml-2.3.tar.gz
+/lxml-2.3.tar.gz.asc
+/lxml-2.3.1.tar.gz
+/lxml-2.3.1.tar.gz.asc
+/lxml-2.3.2.tar.gz
+/lxml-2.3.2.tar.gz.asc
+/lxml-2.3.3.tar.gz
+/lxml-2.3.3.tar.gz.asc
+/lxml-2.3.5.tar.gz
+/lxml-2.3.5.tar.gz.asc
+/lxml-3.0.tar.gz
+/lxml-3.0.tar.gz.asc
+/lxml-3.0.tgz
+/lxml-3.0.tgz.asc
+/lxml-3.0.1.tgz
+/lxml-3.0.1.tgz.asc
+/lxml-3.1.0.tgz
+/lxml-3.1.0.tgz.asc
+/lxml-3.2.0.tgz
+/lxml-3.2.0.tgz.asc
+/lxml-3.2.1.tgz
+/lxml-3.2.1.tgz.asc
+/lxml-3.2.3.tgz
+/lxml-3.2.3.tgz.asc
+/lxml-3.2.4.tgz
+/lxml-3.2.4.tgz.asc
+/lxml-3.3.0.tgz
+/lxml-3.3.0.tgz.asc
+/lxml-3.3.2.tgz
+/lxml-3.3.2.tgz.asc
+/lxml-3.3.3.tgz
+/lxml-3.3.3.tgz.asc
+/lxml-3.3.5.tgz
+/lxml-3.3.5.tgz.asc
+/lxml-3.3.6.tgz
+/lxml-3.3.6.tgz.asc
+/lxml-3.4.4.tgz
+/lxml-3.4.4.tgz.asc
+/lxml-3.6.4.tar.gz
+/lxml-3.7.0.tar.gz
+/lxml-3.7.1.tgz
+/lxml-3.7.2.tgz
+/lxml-3.8.0.tgz
+/lxml-4.0.0.tgz
+/lxml-4.1.1.tgz
+/lxml-4.2.1.tgz
+/lxml-4.2.3.tgz
+/lxml-4.2.4.tgz
+/lxml-4.2.5.tgz
+/lxml-4.4.0.tgz
+/lxml-4.4.1.tgz
+/lxml-4.5.1.tgz
+/lxml-4.6.2.tar.gz
+/lxml-4.6.3.tar.gz
+/lxml-4.7.1.tar.gz
+/lxml-4.9.1.tar.gz

Makefile

@@ -1,21 +0,0 @@
-# Makefile for source rpm: python-lxml
-# $Id$
-NAME := python-lxml
-SPECFILE = $(firstword $(wildcard *.spec))
-
-define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
-endef
-
-MAKEFILE_COMMON := $(shell $(find-makefile-common))
-
-ifeq ($(MAKEFILE_COMMON),)
-# attept a checkout
-define checkout-makefile-common
-test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
-endef
-
-MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
-endif
-
-include $(MAKEFILE_COMMON)

ci.fmf

@@ -0,0 +1 @@
+resultsdb-testcase: separate

fix-namespace-count.patch

@@ -0,0 +1,53 @@
+From c742576c105f40fc8b754fcae56fee4aa35840a3 Mon Sep 17 00:00:00 2001
+From: Stefan Behnel <stefan_ml@behnel.de>
+Date: Tue, 19 Jul 2022 08:25:20 +0200
+Subject: [PATCH] Work around libxml2 bug in affected versions that failed to
+ reset the namespace count in the parser context.
+
+See https://gitlab.gnome.org/GNOME/libxml2/-/issues/378
+---
+ src/lxml/includes/xmlparser.pxd | 1 +
+ src/lxml/parser.pxi             | 3 +++
+ src/lxml/tests/test_etree.py    | 3 +--
+ 3 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/src/lxml/includes/xmlparser.pxd b/src/lxml/includes/xmlparser.pxd
+index a196e34bd..45acfc846 100644
+--- a/src/lxml/includes/xmlparser.pxd
++++ b/src/lxml/includes/xmlparser.pxd
+@@ -144,6 +144,7 @@ cdef extern from "libxml/parser.h":
+         void* userData
+         int* spaceTab
+         int spaceMax
++        int nsNr
+         bint html
+         bint progressive
+         int inSubset
+diff --git a/src/lxml/parser.pxi b/src/lxml/parser.pxi
+index f5baf29b9..f0c8c6b64 100644
+--- a/src/lxml/parser.pxi
++++ b/src/lxml/parser.pxi
+@@ -569,6 +569,9 @@ cdef class _ParserContext(_ResolverContext):
+                 self._c_ctxt.disableSAX = 0 # work around bug in libxml2
+             else:
+                 xmlparser.xmlClearParserCtxt(self._c_ctxt)
++                # work around bug in libxml2 [2.9.10 .. 2.9.14]:
++                # https://gitlab.gnome.org/GNOME/libxml2/-/issues/378
++                self._c_ctxt.nsNr = 0
+ 
+     cdef int prepare(self, bint set_document_loader=True) except -1:
+         cdef int result
+diff --git a/src/lxml/tests/test_etree.py b/src/lxml/tests/test_etree.py
+index 8bf82c084..0339796d6 100644
+--- a/src/lxml/tests/test_etree.py
++++ b/src/lxml/tests/test_etree.py
+@@ -1491,8 +1491,7 @@ def test_walk_after_parse_failure(self):
+             # This would be the expected result, because there was no namespace
+             pass
+         else:
+-            # This is a bug in libxml2
+-            assert not ns, repr(ns)
++            assert False, "Found unexpected namespace '%s'" % ns
+ 
+     def test_itertext_comment_pi(self):
+         # https://bugs.launchpad.net/lxml/+bug/1844674

gating.yaml

@@ -0,0 +1,8 @@
+--- !Policy
+product_versions:
+  - fedora-*
+decision_contexts:
+  - bodhi_update_push_testing
+  - bodhi_update_push_stable
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/smoke.functional}

plans/etree-fromstring.py

@@ -0,0 +1,7 @@
+import lxml.etree as et
+s = '<foo><bar baz="xyzzy">a<![CDATA[b]]>c</bar></foo>'
+x = et.fromstring(s)
+t = x.find('bar').text
+print(t)
+if t != 'abc':
+    raise Exception()

plans/smoke.fmf

@@ -0,0 +1,12 @@
+summary: Basic smoke test
+discover:
+  how: shell
+  tests:
+    - name: /smoke/import-python-module
+      test: |
+        python3 -c 'import importlib as il; print(il.import_module("lxml"))'
+    - name: /smoke/etree-fromstring
+      test: |
+        python3 plans/etree-fromstring.py
+execute:
+  how: tmt

sources

@@ -1,2 +1 @@
-077841e74ee728e7746b65d8483274be  lxml-2.2.4.tar.gz
-146a5316476dac830fcbe7164d635df7  lxml-2.2.4.tar.gz.asc
+SHA512 (lxml-4.9.1.tar.gz) = d7ec55c7db2c63a716ca5f4d833706d90fc76c944885e010fcdb96786bcfe796994e438450cf4e8e6e75d702e21fb16971f28f854d7a1f76c34e4ae315414d84