GNU bug report logs - #33569
Missing sanitizing of '[]' in pypi-importer

Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.

Package: guix; Reported by: swedebugia <swedebugia@HIDDEN>; Keywords: patch; merged with #24450, #24557, #33047, #34266; dated Sun, 2 Dec 2018 00:27:02 UTC; Maintainer for guix is bug-guix@HIDDEN.
Added tag(s) patch. Request was from Maxim Cournoyer <maxim.cournoyer@HIDDEN> to control <at> debbugs.gnu.org. Full text available.
Forcibly Merged 24450 24557 33047 33569 34266. Request was from T460s laptop <maxim.cournoyer@HIDDEN> to control <at> debbugs.gnu.org. Full text available.

Message received at 33569 <at> debbugs.gnu.org:


Received: (at 33569) by debbugs.gnu.org; 29 Mar 2019 04:21:04 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Fri Mar 29 00:21:04 2019
Received: from localhost ([127.0.0.1]:34948 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1h9j0p-0005rX-NW
	for submit <at> debbugs.gnu.org; Fri, 29 Mar 2019 00:21:04 -0400
Received: from mail-io1-f42.google.com ([209.85.166.42]:43104)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <maxim.cournoyer@HIDDEN>)
 id 1h9j0n-0005qP-1Z; Fri, 29 Mar 2019 00:21:01 -0400
Received: by mail-io1-f42.google.com with SMTP id x3so672898iol.10;
 Thu, 28 Mar 2019 21:21:01 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
 h=from:to:cc:subject:references:date:in-reply-to:message-id
 :user-agent:mime-version:content-transfer-encoding;
 bh=/45T5Zrchgzc5rzndzC+fgq5GVCdzqYhDsakWW1Wc28=;
 b=MrdGrKUMLsoHOZdPGmuzbEPmNG7V31QvFjGOSreEkmevg8DJzb02VGmr4LGRjHWza5
 DfJfm7pUtv2x3g1BnZ4Q8uM4cINRZwJ+QCuEQxAIGdLb5MZLzPN636cuh78p+2pk8qH6
 A87Eqp4FOgVCk+A8gdXmHhoCfnl/b3zlmXcg3CIHEGgVEj+bKd5WIsMKwADuVek0w5DK
 X15m0GUOXDWXxO/XY0f9bmnfw5qEsndcRnQMCYScvcWzKAqitiK2/88bij2wyox1JQC/
 9rCk/r5bkC67zVOoRR6javwki6Ib5/N4JUug3VwrMWAiniEqqGbp/NOcGhnRcvtqdaQE
 xFSw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20161025;
 h=x-gm-message-state:from:to:cc:subject:references:date:in-reply-to
 :message-id:user-agent:mime-version:content-transfer-encoding;
 bh=/45T5Zrchgzc5rzndzC+fgq5GVCdzqYhDsakWW1Wc28=;
 b=cAWFNliUC7uLY1BuswlQYMdsaTaBmb7Gb4+L+SjjbBXGERVMwl5O3ekNnDdm4N1inN
 M5cqpCNZPmHFqaaj9dQ8H+YOCfOeOoEV5M7RLpm4ckn3zdRRwEk32Jy/D3OK1EkkGu98
 LEmRauScd63RpbCAdIR8V3bRjPN1i2n0U2moCJj42LjdoC2zb1ZDYEuhV7FSzqRVE5bY
 YPujT08prSRcnwSqUMl9yu8cVSfPsl77N0OXfIU2qULF9Ns+w4JdHJJ3HJUtFai9r1jz
 SEZcq9tHU8vBL71HSSOqS/xHTgN+i2FBNf8Tjz3LglK9xxb1AvNqBjcdmXmRwRlNPDB7
 FbKA==
X-Gm-Message-State: APjAAAVH5aeMkOL4+ONWBVrGIeJ21c2fEv+sFGXQCqSX0EfgK274pwdG
 QXRsRZ0AjT+Ps4/hnWczNsESKHlqH4s=
X-Google-Smtp-Source: APXvYqxAhhNaho89QTiivGtM6wMd9ALgdcJjS5y8YSJ1t4gV4OtB3/ewJB/bFeKTDeAFLNzocwHxsg==
X-Received: by 2002:a6b:7804:: with SMTP id j4mr12887382iom.171.1553833254992; 
 Thu, 28 Mar 2019 21:20:54 -0700 (PDT)
Received: from kwak ([2607:f2c0:94b4:fa00::235])
 by smtp.gmail.com with ESMTPSA id t68sm531752ita.4.2019.03.28.21.20.53
 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256);
 Thu, 28 Mar 2019 21:20:54 -0700 (PDT)
From: Maxim Cournoyer <maxim.cournoyer@HIDDEN>
To: swedebugia <swedebugia@HIDDEN>
Subject: Re: bug#33569: Missing sanitizing of '[]' in pypi-importer
References: <a9fc3247-e04c-5d63-8e90-8ecc761e6bed@HIDDEN>
Date: Fri, 29 Mar 2019 00:20:53 -0400
In-Reply-To: <a9fc3247-e04c-5d63-8e90-8ecc761e6bed@HIDDEN> (swedebugia's
 message of "Sun, 2 Dec 2018 01:32:02 +0100")
Message-ID: <87r2aq2twa.fsf@HIDDEN>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 33569
Cc: 33569 <at> debbugs.gnu.org, 24450 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

swedebugia <swedebugia@HIDDEN> writes:

> E.g.
> sdb@komputilo ~/guix-tree$ ~/guix-tree/pre-inst-env guix import pypi
> snakemake
> ...
>   (propagated-inputs
>     `(("python-[reports]"
>        ,#{python-\x5b;reports\x5d;}#)
>       ("python-appdirs" ,python-appdirs)
> ...

This one now gives (local branch):

--8<---------------cut here---------------start------------->8---
./pre-inst-env guix import pypi snakemake

Starting download of /tmp/guix-file.4XvWMX
From https://files.pythonhosted.org/packages/4a/aa/aab1515d220be06fbdccf3c8=
9335d9585b08ac6be74b8e3c9e8c3c32798e/snakemake-5.4.4.tar.gz...
 =E2=80=A6.4.4.tar.gz  169KiB                 723KiB/s 00:00 [#############=
#####] 100.0%
(package
  (name "python-snakemake")
  (version "5.4.4")
  (source
    (origin
      (method url-fetch)
      (uri (pypi-uri "snakemake" version))
      (sha256
        (base32
          "0prpr5qajqwr8sh4gzggpj8l4np2rcm9nfdzvcp30d5yw7h26wqm"))))
  (build-system python-build-system)
  (propagated-inputs
    `(("python-appdirs" ,python-appdirs)
      ("python-configargparse" ,python-configargparse)
      ("python-datrie" ,python-datrie)
      ("python-docutils" ,python-docutils)
      ("python-gitpython" ,python-gitpython)
      ("python-jsonschema" ,python-jsonschema)
      ("python-pyyaml" ,python-pyyaml)
      ("python-ratelimiter" ,python-ratelimiter)
      ("python-requests" ,python-requests)
      ("python-wrapt" ,python-wrapt)))
  (home-page "http://snakemake.bitbucket.io")
  (synopsis
    "Snakemake is a workflow management system that aims to reduce the comp=
lexity of creating workflows by providing a fast and comfortable execution =
environment, together with a clean and modern specification language in pyt=
hon style. Snakemake workflows are essentially Python scripts extended by d=
eclarative code to define rules. Rules describe how to create output files =
from input files.")
  (description
    "Snakemake is a workflow management system that aims to reduce the comp=
lexity of creating workflows by providing a fast and comfortable execution =
environment, together with a clean and modern specification language in pyt=
hon style. Snakemake workflows are essentially Python scripts extended by d=
eclarative code to define rules. Rules describe how to create output files =
from input files.")
  (license license:expat))
--8<---------------cut here---------------end--------------->8---




Information forwarded to bug-guix@HIDDEN:
bug#33569; Package guix. Full text available.
Forcibly Merged 24450 33047 33569 34266. Request was from Maxim Cournoyer <maxim.cournoyer@HIDDEN> to control <at> debbugs.gnu.org. Full text available.
Merged 24450 33047 33569 34266. Request was from T460s laptop <maxim.cournoyer@HIDDEN> to control <at> debbugs.gnu.org. Full text available.
Forcibly Merged 33047 33569 34266. Request was from Maxim Cournoyer <maxim.cournoyer@HIDDEN> to control <at> debbugs.gnu.org. Full text available.
Forcibly Merged 33569 34266. Request was from Maxim Cournoyer <maxim.cournoyer@HIDDEN> to control <at> debbugs.gnu.org. Full text available.

Message received at submit <at> debbugs.gnu.org:


Received: (at submit) by debbugs.gnu.org; 2 Dec 2018 00:26:14 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Dec 01 19:26:14 2018
Received: from localhost ([127.0.0.1]:57392 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1gTFaQ-0004Hm-Bp
	for submit <at> debbugs.gnu.org; Sat, 01 Dec 2018 19:26:14 -0500
Received: from eggs.gnu.org ([208.118.235.92]:44721)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <swedebugia@HIDDEN>) id 1gTFaO-0004Ha-2z
 for submit <at> debbugs.gnu.org; Sat, 01 Dec 2018 19:26:12 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <swedebugia@HIDDEN>) id 1gTFaI-0001hJ-4o
 for submit <at> debbugs.gnu.org; Sat, 01 Dec 2018 19:26:06 -0500
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=disabled
 version=3.3.2
Received: from lists.gnu.org ([2001:4830:134:3::11]:58426)
 by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
 (Exim 4.71) (envelope-from <swedebugia@HIDDEN>)
 id 1gTFaI-0001hE-2E
 for submit <at> debbugs.gnu.org; Sat, 01 Dec 2018 19:26:06 -0500
Received: from eggs.gnu.org ([2001:4830:134:3::10]:54317)
 by lists.gnu.org with esmtp (Exim 4.71)
 (envelope-from <swedebugia@HIDDEN>) id 1gTFaH-0000rL-Ct
 for bug-guix@HIDDEN; Sat, 01 Dec 2018 19:26:05 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <swedebugia@HIDDEN>) id 1gTFaE-0001gU-AH
 for bug-guix@HIDDEN; Sat, 01 Dec 2018 19:26:05 -0500
Received: from mx1.riseup.net ([198.252.153.129]:56885)
 by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32)
 (Exim 4.71) (envelope-from <swedebugia@HIDDEN>)
 id 1gTFaE-0001g1-3y
 for bug-guix@HIDDEN; Sat, 01 Dec 2018 19:26:02 -0500
Received: from cotinga.riseup.net (cotinga-pn.riseup.net [10.0.1.164])
 (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits))
 (Client CN "*.riseup.net",
 Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK))
 by mx1.riseup.net (Postfix) with ESMTPS id 0D5651A0190
 for <bug-guix@HIDDEN>; Sat,  1 Dec 2018 16:26:00 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=riseup.net; s=squak;
 t=1543710360; bh=7iJ3NpsJaVYdqgc+YqwlzVuRdoTgzJr18bLCYixr5Wg=;
 h=To:From:Subject:Date:From;
 b=cRAOhr31HulGLBBaKRIVokhfQw0T+nqAulTmLBr1ovy1XY4is2qBnCi1Y7uRa+LVi
 a4IfliiY/lwJTqyQoTsB8NagbX5H6qq6ELlWzEv6s8HX53EmU8M968+9FzWhLrSok7
 hkFfvjIHVtAfiL76buLiCxubjAyfLLrgRe5Kynl8=
X-Riseup-User-ID: C3A042CEF8C04950A13130C708788939DCEDB2AB1559C020BC56D56BE836D321
Received: from [127.0.0.1] (localhost [127.0.0.1])
 by cotinga.riseup.net with ESMTPSA id 7499E8EAA7
 for <bug-guix@HIDDEN>; Sat,  1 Dec 2018 16:25:59 -0800 (PST)
To: Report new Guix bug <bug-guix@HIDDEN>
From: swedebugia <swedebugia@HIDDEN>
Subject: Missing sanitizing of '[]' in pypi-importer
Message-ID: <a9fc3247-e04c-5d63-8e90-8ecc761e6bed@HIDDEN>
Date: Sun, 2 Dec 2018 01:32:02 +0100
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]
 [fuzzy]
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x
X-Received-From: 2001:4830:134:3::11
X-Spam-Score: -4.1 (----)
X-Debbugs-Envelope-To: submit
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -5.1 (-----)

E.g.
sdb@komputilo ~/guix-tree$ ~/guix-tree/pre-inst-env guix import pypi 
snakemake
...
   (propagated-inputs
     `(("python-[reports]"
        ,#{python-\x5b;reports\x5d;}#)
       ("python-appdirs" ,python-appdirs)
...

-- 
Cheers Swedebugia




Acknowledgement sent to swedebugia <swedebugia@HIDDEN>:
New bug report received and forwarded. Copy sent to bug-guix@HIDDEN. Full text available.
Report forwarded to bug-guix@HIDDEN:
bug#33569; Package guix. Full text available.
Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.
Last modified: Sun, 31 Mar 2019 14:45:01 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.