diff -Nru jinja2-3.1.2/debian/changelog jinja2-3.1.2/debian/changelog --- jinja2-3.1.2/debian/changelog 2023-02-24 15:15:45.000000000 +0000 +++ jinja2-3.1.2/debian/changelog 2024-01-18 11:40:53.000000000 +0000 @@ -1,3 +1,12 @@ +jinja2 (3.1.2-1ubuntu1) noble; urgency=medium + + * SECURITY UPDATE: Cross-Site scripting + - debian/patches/CVE-2024-22195.patch: disallow keys with spaces + in jinja2/filters.py, tests/test_filters.py. + - CVE-2024-22195 + + -- Leonidas Da Silva Barbosa Thu, 18 Jan 2024 08:40:53 -0300 + jinja2 (3.1.2-1) unstable; urgency=medium [ Thomas Goirand ] diff -Nru jinja2-3.1.2/debian/control jinja2-3.1.2/debian/control --- jinja2-3.1.2/debian/control 2022-11-07 15:02:25.000000000 +0000 +++ jinja2-3.1.2/debian/control 2024-01-18 11:40:53.000000000 +0000 @@ -1,7 +1,8 @@ Source: jinja2 Section: python Priority: optional -Maintainer: Piotr Ożarowski +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: Piotr Ożarowski Uploaders: Debian Python Team , Build-Depends: diff -Nru jinja2-3.1.2/debian/patches/CVE-2024-22195.patch jinja2-3.1.2/debian/patches/CVE-2024-22195.patch --- jinja2-3.1.2/debian/patches/CVE-2024-22195.patch 1970-01-01 00:00:00.000000000 +0000 +++ jinja2-3.1.2/debian/patches/CVE-2024-22195.patch 2024-01-18 11:40:53.000000000 +0000 @@ -0,0 +1,92 @@ +From 7dd3680e6eea0d77fde024763657aa4d884ddb23 Mon Sep 17 00:00:00 2001 +From: Calum Hutton +Date: Thu, 26 Oct 2023 12:08:53 +0100 +Subject: [PATCH] xmlattr filter disallows keys with spaces + +--- + CHANGES.rst | 1 + + src/jinja2/filters.py | 28 +++++++++++++++++++++------- + tests/test_filters.py | 6 ++++++ + 3 files changed, 28 insertions(+), 7 deletions(-) + +#diff --git a/CHANGES.rst b/CHANGES.rst +#index 36db0843a..d6688e762 100644 +#--- a/CHANGES.rst +#+++ b/CHANGES.rst +#@@ -7,6 +7,7 @@ Unreleased +# +# - Fix compiler error when checking if required blocks in parent templates are +# empty. :pr:`1858` +#+- ``xmlattr`` filter does not allow keys with spaces. GHSA-h5c8-rqwp-cp95 +# +# +# Version 3.1.2 +diff --git a/src/jinja2/filters.py b/src/jinja2/filters.py +index ed07c4c0e..c7ecc9bb6 100644 +--- a/src/jinja2/filters.py ++++ b/src/jinja2/filters.py +@@ -248,13 +248,17 @@ def do_items(value: t.Union[t.Mapping[K, V], Undefined]) -> t.Iterator[t.Tuple[K + yield from value.items() + + ++_space_re = re.compile(r"\s", flags=re.ASCII) ++ ++ + @pass_eval_context + def do_xmlattr( + eval_ctx: "EvalContext", d: t.Mapping[str, t.Any], autospace: bool = True + ) -> str: + """Create an SGML/XML attribute string based on the items in a dict. +- All values that are neither `none` nor `undefined` are automatically +- escaped: ++ ++ If any key contains a space, this fails with a ``ValueError``. Values that ++ are neither ``none`` nor ``undefined`` are automatically escaped. + + .. sourcecode:: html+jinja + +@@ -273,12 +277,22 @@ def do_xmlattr( + + As you can see it automatically prepends a space in front of the item + if the filter returned something unless the second parameter is false. ++ ++ .. versionchanged:: 3.1.3 ++ Keys with spaces are not allowed. + """ +- rv = " ".join( +- f'{escape(key)}="{escape(value)}"' +- for key, value in d.items() +- if value is not None and not isinstance(value, Undefined) +- ) ++ items = [] ++ ++ for key, value in d.items(): ++ if value is None or isinstance(value, Undefined): ++ continue ++ ++ if _space_re.search(key) is not None: ++ raise ValueError(f"Spaces are not allowed in attributes: '{key}'") ++ ++ items.append(f'{escape(key)}="{escape(value)}"') ++ ++ rv = " ".join(items) + + if autospace and rv: + rv = " " + rv +diff --git a/tests/test_filters.py b/tests/test_filters.py +index 32897c546..f50ed13ab 100644 +--- a/tests/test_filters.py ++++ b/tests/test_filters.py +@@ -474,6 +474,12 @@ def test_xmlattr(self, env): + assert 'bar="23"' in out + assert 'blub:blub="<?>"' in out + ++ def test_xmlattr_key_with_spaces(self, env): ++ with pytest.raises(ValueError, match="Spaces are not allowed"): ++ env.from_string( ++ "{{ {'src=1 onerror=alert(1)': 'my_class'}|xmlattr }}" ++ ).render() ++ + def test_sort1(self, env): + tmpl = env.from_string("{{ [2, 3, 1]|sort }}|{{ [2, 3, 1]|sort(true) }}") + assert tmpl.render() == "[1, 2, 3]|[3, 2, 1]" diff -Nru jinja2-3.1.2/debian/patches/series jinja2-3.1.2/debian/patches/series --- jinja2-3.1.2/debian/patches/series 2023-02-24 15:09:22.000000000 +0000 +++ jinja2-3.1.2/debian/patches/series 2024-01-18 11:40:53.000000000 +0000 @@ -1,3 +1,4 @@ py3.9-fix-collections-import.patch 0002-docs-disable-sphinxcontrib.log_cabinet.patch 0003-fix-nose-leftovers.patch +CVE-2024-22195.patch