diffoscope 284__tar.gz → 285__tar.gz

{diffoscope-284/diffoscope.egg-info → diffoscope-285}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: diffoscope
-Version: 284
+Version: 285
 Summary: in-depth comparison of files, archives, and directories
 Home-page: https://diffoscope.org/
 Author: Diffoscope developers

{diffoscope-284 → diffoscope-285}/diffoscope/__init__.py

@@ -17,4 +17,4 @@
 # You should have received a copy of the GNU General Public License
 # along with diffoscope.  If not, see <https://www.gnu.org/licenses/>.
 
-VERSION = "284"
+VERSION = "285"

{diffoscope-284 → diffoscope-285}/diffoscope/comparators/symlink.py

@@ -2,7 +2,7 @@
 # diffoscope: in-depth comparison of files, archives, and directories
 #
 # Copyright © 2015 Jérémy Bobbio <lunar@debian.org>
-# Copyright © 2015-2022 Chris Lamb <lamby@debian.org>
+# Copyright © 2015-2022, 2025 Chris Lamb <lamby@debian.org>
 #
 # diffoscope is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -18,15 +18,12 @@
 # along with diffoscope.  If not, see <https://www.gnu.org/licenses/>.
 
 import os
-import logging
 
 from diffoscope.tempfiles import get_named_temporary_file
 from diffoscope.difference import Difference
 
 from .utils.file import File
 
-logger = logging.getLogger(__name__)
-
 
 class Symlink(File):
     DESCRIPTION = "symlinks"

{diffoscope-284 → diffoscope-285}/diffoscope/comparators/xar.py

@@ -2,7 +2,7 @@
 # diffoscope: in-depth comparison of files, archives, and directories
 #
 # Copyright © 2024 Seth Michael Larson <seth@python.org>
-# Copyright © 2024 Chris Lamb <lamby@debian.org>
+# Copyright © 2024-2025 Chris Lamb <lamby@debian.org>
 #
 # diffoscope is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -18,7 +18,6 @@
 # along with diffoscope.  If not, see <https://www.gnu.org/licenses/>.
 import hashlib
 import re
-import logging
 import struct
 import xml.etree.ElementTree as ET
 import zlib
@@ -28,8 +27,6 @@ from .utils.file import File
 from .utils.archive import Archive
 from diffoscope.difference import Difference
 
-logger = logging.getLogger(__name__)
-
 
 class XarContainer(Archive):
     def get_member_names(self):

{diffoscope-284 → diffoscope-285}/diffoscope/comparators/xml.py

@@ -2,7 +2,7 @@
 # diffoscope: in-depth comparison of files, archives, and directories
 #
 # Copyright © 2017 Juliana Rodrigues <juliana.orod@gmail.com>
-# Copyright © 2017-2022 Chris Lamb <lamby@debian.org>
+# Copyright © 2017-2022, 2025 Chris Lamb <lamby@debian.org>
 #
 # diffoscope is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -18,6 +18,8 @@
 # along with diffoscope.  If not, see <https://www.gnu.org/licenses/>.
 
 import re
+import pyexpat
+import logging
 
 from xml.parsers.expat import ExpatError
 
@@ -36,6 +38,36 @@ except ImportError:
     from xml.dom import minidom
 
 
+def is_vulnerable_xml_parser():
+    # We assume defusedxml is safe
+    if defusedxml:
+        return False
+
+    """
+    As described in Pythons module documentation versions of expat <= 2.4.1
+    (released on 2021-05-23) are vulnerable to exponential/quadratic entity
+    expansion while versions <= 2.6.0 (released on 2024-02-06) are vulnerable to
+    large tokens. Since expat is usually provided by the system and not
+    directly bundled with Python, even recent Python installations can still be
+    vulnerable due to old expat versions.
+
+        <https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/397>
+    """
+
+    pyexpat_version = tuple(
+        int(x) for x in pyexpat.EXPAT_VERSION.split("_", 1)[1].split(".")
+    )
+
+    return pyexpat_version < (2, 6, 0)
+
+
+logger = logging.getLogger(__name__)
+if is_vulnerable_xml_parser():
+    logger.warning(
+        "Vulnerable version of pyexpat detected; disabling comparison of XML documents. Install defusedxml or upgrade your pyexpat."
+    )
+
+
 def _format(node):
     """
     Removes *inplace* spaces from minidom.Document
@@ -103,6 +135,11 @@ class XMLFile(File):
         if not super().recognizes(file) and not file.name.endswith(".xml"):
             return False
 
+        # Check that we aren't about to open an untrusted file with an old, and
+        # potentially vulnerable, version of pyexpat.
+        if is_vulnerable_xml_parser():
+            return False
+
         with open(file.path) as f:
             try:
                 file.parsed = _parse(f)

{diffoscope-284 → diffoscope-285}/diffoscope/main.py

@@ -4,7 +4,7 @@
 # diffoscope: in-depth comparison of files, archives, and directories
 #
 # Copyright © 2014-2015 Jérémy Bobbio <lunar@debian.org>
-# Copyright © 2016-2023 Chris Lamb <lamby@debian.org>
+# Copyright © 2016-2023, 2025 Chris Lamb <lamby@debian.org>
 #
 # diffoscope is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -28,6 +28,8 @@ import textwrap
 import argparse
 import traceback
 
+from urllib.parse import urlparse
+
 from . import VERSION
 from .path import set_path
 from .tools import (
@@ -734,6 +736,14 @@ def sigterm_handler(signo, stack_frame):
     os._exit(2)
 
 
+def is_valid_url(val):
+    try:
+        result = urlparse(val)
+        return all([result.scheme, result.netloc])
+    except AttributeError:
+        return False
+
+
 def main(args=None):
     if args is None:
         args = sys.argv[1:]
@@ -759,6 +769,9 @@ def main(args=None):
             parser, post_parse = create_parser()
             parsed_args = parser.parse_args(args)
 
+        if parsed_args.css_url and not is_valid_url(parsed_args.css_url):
+            parser.error(f"{parsed_args.css_url!r} is not a valid CSS URL.")
+
         log_handler = ProgressManager().setup(parsed_args)
 
         with setup_logging(parsed_args.debug, log_handler) as _:

{diffoscope-284 → diffoscope-285/diffoscope.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: diffoscope
-Version: 284
+Version: 285
 Summary: in-depth comparison of files, archives, and directories
 Home-page: https://diffoscope.org/
 Author: Diffoscope developers

{diffoscope-284 → diffoscope-285}/tests/comparators/test_xml.py

@@ -2,7 +2,7 @@
 # diffoscope: in-depth comparison of files, archives, and directories
 #
 # Copyright (C) 2017 Juliana Rodrigues <juliana.orod@gmail.com>
-# Copyright © 2017, 2019-2020, 2022-2023 Chris Lamb <lamby@debian.org>
+# Copyright © 2017, 2019-2020, 2022-2023, 2025 Chris Lamb <lamby@debian.org>
 #
 # diffoscope is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -20,10 +20,14 @@
 import sys
 import pytest
 
-from diffoscope.comparators.xml import XMLFile
+from diffoscope.comparators.xml import XMLFile, is_vulnerable_xml_parser
 
 from ..utils.data import load_fixture, assert_diff
 
+skip_if_vulnerable_xml_parser = pytest.mark.skipif(
+    is_vulnerable_xml_parser(), reason="Vulnerable XML parser"
+)
+
 
 xml_a = load_fixture("test1.xml")
 xml_b = load_fixture("test2.xml")
@@ -32,14 +36,17 @@ xml_d = load_fixture("test4.xml")
 invalid_xml = load_fixture("test_invalid.xml")
 
 
+@skip_if_vulnerable_xml_parser
 def test_identification(xml_a):
     assert isinstance(xml_a, XMLFile)
 
 
+@skip_if_vulnerable_xml_parser
 def test_invalid(invalid_xml):
     assert not isinstance(invalid_xml, XMLFile)
 
 
+@skip_if_vulnerable_xml_parser
 def test_no_differences(xml_a):
     assert xml_a.compare(xml_a) is None
 
@@ -52,6 +59,7 @@ def differences(xml_a, xml_b):
 @pytest.mark.skipif(
     sys.version_info < (3, 8), reason="requires Python 3.8 or higher"
 )
+@skip_if_vulnerable_xml_parser
 def test_diff(differences):
     assert_diff(differences[0], "test_xml_expected_diff")
 
@@ -59,6 +67,7 @@ def test_diff(differences):
 @pytest.mark.skipif(
     sys.version_info < (3, 8), reason="requires Python 3.8 or higher"
 )
+@skip_if_vulnerable_xml_parser
 def test_ordering_differences(xml_c, xml_d):
     diff = xml_c.compare(xml_d)
     assert diff.details[0].comments == ["Ordering differences only"]

{diffoscope-284 → diffoscope-285}/tests/test_main.py

@@ -2,7 +2,7 @@
 # diffoscope: in-depth comparison of files, archives, and directories
 #
 # Copyright © 2015 Jérémy Bobbio <lunar@debian.org>
-# Copyright © 2016-2020, 2022 Chris Lamb <lamby@debian.org>
+# Copyright © 2016-2020, 2022, 2025 Chris Lamb <lamby@debian.org>
 #
 # diffoscope is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -191,3 +191,31 @@ def test_usage(capsys):
 
     assert out == ""
     assert "usage:" in err
+
+
+def test_valid_css(capsys):
+    ret, out, err = run(
+        capsys,
+        "--css",
+        "http://example.tld/file.css",
+        TEST_TAR1_PATH,
+        TEST_TAR1_PATH,
+    )
+
+    assert ret == 0
+    assert err == ""
+    assert out == ""
+
+
+def test_invalid_css(capsys):
+    ret, out, err = run(
+        capsys,
+        "--css",
+        '"><svg/onload=alert(43433)>',
+        TEST_TAR1_PATH,
+        TEST_TAR1_PATH,
+    )
+
+    assert ret == 2
+    assert "is not a valid CSS" in err
+    assert out == ""