add sec patch wrt Bug #498934, rm old

(Portage version: 2.2.8-r1/cvs/Linux x86_64, signed Manifest commit with key 0xB8072B0D)

5 files changed, 90 insertions, 60 deletions

diff --git a/dev-python/pyxdg/ChangeLog b/dev-python/pyxdg/ChangeLog
index 4af003b8d9ab..265b64103bb0 100644
--- a/dev-python/pyxdg/ChangeLog
+++ b/dev-python/pyxdg/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for dev-python/pyxdg
-# Copyright 1999-2013 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/dev-python/pyxdg/ChangeLog,v 1.118 2013/10/12 18:47:08 hwoarang Exp $
+# Copyright 1999-2014 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/dev-python/pyxdg/ChangeLog,v 1.119 2014/03/26 07:45:51 idella4 Exp $
+
+*pyxdg-0.25-r1 (26 Mar 2014)
+
+  26 Mar 2014; Ian Delaney <idella4@gentoo.org>
+  +files/sec-patch-CVE-2014-1624.patch, +pyxdg-0.25-r1.ebuild,
+  -pyxdg-0.23.ebuild, -pyxdg-0.24.ebuild:
+  add sec patch wrt Bug #498934, rm old
 
   12 Oct 2013; Markos Chandras <hwoarang@gentoo.org> pyxdg-0.25.ebuild:
   Add ~mips
diff --git a/dev-python/pyxdg/files/sec-patch-CVE-2014-1624.patch b/dev-python/pyxdg/files/sec-patch-CVE-2014-1624.patch
new file mode 100644
index 000000000000..d94c0a42bddb
--- /dev/null
+++ b/dev-python/pyxdg/files/sec-patch-CVE-2014-1624.patch
@@ -0,0 +1,54 @@
+Improve security of get_runtime_dir(strict=False) 
+https://github.com/takluyver/pyxdg/commit/bd999c1c3fe7ee5f30ede2cf704cf03e400347b4
+diff --git a/xdg/BaseDirectory.py b/xdg/BaseDirectory.py
+index cececa3..a7c31b1 100644
+--- a/xdg/BaseDirectory.py
++++ b/xdg/BaseDirectory.py
+@@ -25,7 +25,7 @@
+ Note: see the rox.Options module for a higher-level API for managing options.
+ """
+ 
+-import os
++import os, stat
+ 
+ _home = os.path.expanduser('~')
+ xdg_data_home = os.environ.get('XDG_DATA_HOME') or \
+@@ -131,15 +131,30 @@ def get_runtime_dir(strict=True):
+         
+         import getpass
+         fallback = '/tmp/pyxdg-runtime-dir-fallback-' + getpass.getuser()
++        create = False
++
+         try:
+-            os.mkdir(fallback, 0o700)
++            # This must be a real directory, not a symlink, so attackers can't
++            # point it elsewhere. So we use lstat to check it.
++            st = os.lstat(fallback)
+         except OSError as e:
+             import errno
+-            if e.errno == errno.EEXIST:
+-                # Already exists - set 700 permissions again.
+-                import stat
+-                os.chmod(fallback, stat.S_IRUSR|stat.S_IWUSR|stat.S_IXUSR)
+-            else: # pragma: no cover
++            if e.errno == errno.ENOENT:
++                create = True
++            else:
+                 raise
+-        
++        else:
++            # The fallback must be a directory
++            if not stat.S_ISDIR(st.st_mode):
++                os.unlink(fallback)
++                create = True
++            # Must be owned by the user and not accessible by anyone else
++            elif (st.st_uid != os.getuid()) \
++              or (st.st_mode & (stat.S_IRWXG | stat.S_IRWXO)):
++                os.rmdir(fallback)
++                create = True
++
++        if create:
++            os.mkdir(fallback, 0o700)
++
+         return fallback
+
diff --git a/dev-python/pyxdg/pyxdg-0.23.ebuild b/dev-python/pyxdg/pyxdg-0.23.ebuild
deleted file mode 100644
index bd6a9e585c34..000000000000
--- a/dev-python/pyxdg/pyxdg-0.23.ebuild
+++ /dev/null
@@ -1,33 +0,0 @@
-# Copyright 1999-2012 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/dev-python/pyxdg/pyxdg-0.23.ebuild,v 1.8 2012/10/07 09:35:39 nixnut Exp $
-
-EAPI=4
-
-PYTHON_DEPEND="*:2.6"
-SUPPORT_PYTHON_ABIS=1
-RESTRICT_PYTHON_ABIS="2.5"
-
-inherit distutils
-
-DESCRIPTION="A Python module to deal with freedesktop.org specifications"
-HOMEPAGE="http://freedesktop.org/wiki/Software/pyxdg http://cgit.freedesktop.org/xdg/pyxdg/"
-SRC_URI="http://people.freedesktop.org/~takluyver/${P}.tar.gz"
-
-LICENSE="LGPL-2"
-SLOT="0"
-KEYWORDS="alpha amd64 arm hppa ia64 ppc ppc64 sparc x86 ~x86-fbsd"
-IUSE="examples"
-
-PYTHON_MODNAME=xdg
-
-DOCS="AUTHORS ChangeLog README TODO"
-
-src_install() {
-	distutils_src_install
-
-	if use examples; then
-		docinto examples
-		dodoc test/*.py
-	fi
-}
diff --git a/dev-python/pyxdg/pyxdg-0.24.ebuild b/dev-python/pyxdg/pyxdg-0.24.ebuild
deleted file mode 100644
index c32fe1cca199..000000000000
--- a/dev-python/pyxdg/pyxdg-0.24.ebuild
+++ /dev/null
@@ -1,25 +0,0 @@
-# Copyright 1999-2012 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/dev-python/pyxdg/pyxdg-0.24.ebuild,v 1.1 2012/11/12 04:29:51 radhermit Exp $
-
-EAPI=4
-
-PYTHON_DEPEND="*:2.6"
-SUPPORT_PYTHON_ABIS=1
-RESTRICT_PYTHON_ABIS="2.5"
-DISTUTILS_SRC_TEST="nosetests"
-
-inherit distutils
-
-DESCRIPTION="A Python module to deal with freedesktop.org specifications"
-HOMEPAGE="http://freedesktop.org/wiki/Software/pyxdg http://cgit.freedesktop.org/xdg/pyxdg/"
-SRC_URI="http://people.freedesktop.org/~takluyver/${P}.tar.gz"
-
-LICENSE="LGPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86 ~x86-fbsd"
-IUSE=""
-
-PYTHON_MODNAME=xdg
-
-DOCS="AUTHORS ChangeLog README TODO"
diff --git a/dev-python/pyxdg/pyxdg-0.25-r1.ebuild b/dev-python/pyxdg/pyxdg-0.25-r1.ebuild
new file mode 100644
index 000000000000..776108144007
--- /dev/null
+++ b/dev-python/pyxdg/pyxdg-0.25-r1.ebuild
@@ -0,0 +1,27 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-python/pyxdg/pyxdg-0.25-r1.ebuild,v 1.1 2014/03/26 07:45:51 idella4 Exp $
+
+EAPI=5
+
+# py3.3 removed due to nosetests
+PYTHON_COMPAT=( python{2_6,2_7,3_2,3_3} pypy2_0 )
+inherit distutils-r1
+
+DESCRIPTION="A Python module to deal with freedesktop.org specifications"
+HOMEPAGE="http://freedesktop.org/wiki/Software/pyxdg http://cgit.freedesktop.org/xdg/pyxdg/"
+SRC_URI="http://people.freedesktop.org/~takluyver/${P}.tar.gz"
+
+LICENSE="LGPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86 ~x86-fbsd"
+IUSE="test"
+
+DEPEND="test? ( dev-python/nose[${PYTHON_USEDEP}]
+	x11-themes/hicolor-icon-theme )"
+
+DOCS=( AUTHORS ChangeLog README TODO )
+PATCHES=( "${FILESDIR}"/sec-patch-CVE-2014-1624.patch )
+python_test() {
+	nosetests || die
+}