pulpcore 3.119.0__tar.gz → 3.119.2__tar.gz

{pulpcore-3.119.0 → pulpcore-3.119.2}/CHANGES.md

@@ -8,6 +8,52 @@
 
 [//]: # (towncrier release notes start)
 
+## 3.119.2 (2026-09-29) {: #3.119.2 }
+
+### REST API {: #3.119.2-rest-api }
+
+#### Bugfixes {: #3.119.2-rest-api-bugfix }
+
+- Improved the performance of the latest publication lookup when serving content
+  from a repository-backed distribution.
+  [#1995](https://github.com/pulp/pulpcore/issues/1995)
+
+### Plugin API {: #3.119.2-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.119.2-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.119.2-pulp-cert-guard }
+
+No significant changes.
+
+---
+
+## 3.119.1 (2026-09-23) {: #3.119.1 }
+
+### REST API {: #3.119.1-rest-api }
+
+#### Bugfixes {: #3.119.1-rest-api-bugfix }
+
+- Fixed file downloader path sanitation. CVE-2026-90959
+
+### Plugin API {: #3.119.1-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.119.1-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.119.1-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.119.0 (2026-09-23) {: #3.119.0 }
 
 ### REST API {: #3.119.0-rest-api }

{pulpcore-3.119.0 → pulpcore-3.119.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulpcore
-Version: 3.119.0
+Version: 3.119.2
 Summary: Pulp Django Application and Related Modules
 Author-email: Pulp Team <pulp-list@redhat.com>
 License-Expression: GPL-2.0-or-later

{pulpcore-3.119.0 → pulpcore-3.119.2}/pulp_certguard/app/__init__.py

@@ -6,6 +6,6 @@ class PulpCertGuardPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_certguard.app"
     label = "certguard"
-    version = "3.119.0"
+    version = "3.119.2"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.119.0 → pulpcore-3.119.2}/pulp_file/app/__init__.py

@@ -8,6 +8,6 @@ class PulpFilePluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_file.app"
     label = "file"
-    version = "3.119.0"
+    version = "3.119.2"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.119.0 → pulpcore-3.119.2}/pulpcore/app/apps.py

@@ -238,7 +238,7 @@ class PulpAppConfig(PulpPluginAppConfig):
     label = "core"
 
     # The version of this app
-    version = "3.119.0"
+    version = "3.119.2"
 
     # The python package name providing this app
     python_package_name = "pulpcore"

{pulpcore-3.119.0 → pulpcore-3.119.2}/pulpcore/app/models/publication.py

@@ -792,9 +792,10 @@ class Distribution(MasterModel):
                 try:
                     publication = (
                         Publication.objects.filter(
-                            repository_version__in=repository.versions.all(), complete=True
+                            repository_version__repository=repository, complete=True
                         )
                         .select_related("repository_version")
+                        .defer("repository_version__content_ids")
                         .latest("repository_version", "pulp_created")
                         .cast()
                     )

{pulpcore-3.119.0 → pulpcore-3.119.2}/pulpcore/app/serializers/repository.py

@@ -136,24 +136,28 @@ class RemoteSerializer(ModelSerializer, RemoteNetworkConfigSerializer, HiddenFie
                 )
             )
 
-        if not url.lower().startswith("file://"):
-            return url
-
-        user_path = url[7:]
-        if not os.path.isabs(user_path):
-            raise serializers.ValidationError(
-                _("The path '{}' needs to be an absolute pathname.").format(user_path)
-            )
-
-        user_provided_realpath = os.path.realpath(user_path)
-
-        for allowed_path in settings.ALLOWED_IMPORT_PATHS:
-            if user_provided_realpath.startswith(allowed_path):
-                return url
+        if parsed_url.scheme == "file":
+            user_path = parsed_url.path
+            if not os.path.isabs(user_path):
+                raise serializers.ValidationError(
+                    _("The path '{}' needs to be an absolute pathname.").format(user_path)
+                )
+            if user_path.rstrip("/") != os.path.normpath(user_path):
+                raise serializers.ValidationError(_("The path '{}' is not normalized."))
+
+            user_provided_realpath = os.path.realpath(user_path)
+
+            if not any(
+                user_provided_realpath.startswith(allowed_path)
+                for allowed_path in settings.ALLOWED_IMPORT_PATHS
+            ):
+                raise serializers.ValidationError(
+                    _("The path '{}' does not start with any of the allowed import paths").format(
+                        user_path
+                    )
+                )
 
-        raise serializers.ValidationError(
-            _("The path '{}' does not start with any of the allowed import paths").format(user_path)
-        )
+        return url
 
     class Meta:
         abstract = True

{pulpcore-3.119.0 → pulpcore-3.119.2}/pulpcore/download/file.py

@@ -2,6 +2,7 @@ import os
 from urllib.parse import urlparse
 
 import aiofiles
+from rest_framework.serializers import ValidationError
 
 from .base import BaseDownloader, DownloadResult
 
@@ -35,6 +36,9 @@ class FileDownloader(BaseDownloader):
 
         RemoteSerializer().validate_url(url)
         p = urlparse(url)
+        if p.scheme != "file":
+            raise ValidationError("Not a valid file url.")
+
         self._path = os.path.abspath(os.path.join(p.netloc, p.path))
         super().__init__(url, *args, **kwargs)
 

{pulpcore-3.119.0 → pulpcore-3.119.2}/pulpcore/tests/unit/download/test_downloader_factory.py

@@ -1,9 +1,16 @@
 import pytest
 
+from pulpcore.app.util import get_domain
 from pulpcore.download.factory import DownloaderFactory
 from pulpcore.plugin.models import Remote
 
 
+@pytest.fixture(autouse=True)
+def mock_default_domain(db):
+    # Cache the domain in synchronous context before starting the tests.
+    get_domain()
+
+
 @pytest.mark.asyncio
 async def test_user_agent_header():
     remote = Remote(url="http://example.org/", name="foo")

pulpcore-3.119.2/pulpcore/tests/unit/download/test_downloader_file.py

@@ -0,0 +1,41 @@
+import pytest
+from rest_framework.serializers import ValidationError
+
+from pulpcore.download import FileDownloader
+
+
+@pytest.fixture
+def import_paths(settings):
+    settings.ALLOWED_IMPORT_PATHS = ["/static", "/var/www"]
+
+
+@pytest.mark.parametrize(
+    "url",
+    [
+        "file:///var/www",
+        "file:///var/www/",
+        "file:///var/www/a",
+        "file:///var/www/a/",
+    ],
+)
+def test_file_downloader_accepts_regular_file_urls(url, import_paths):
+    FileDownloader(url)
+
+
+@pytest.mark.parametrize(
+    "url",
+    [
+        "",
+        "...",
+        "/",
+        "file:///",
+        "file:.",
+        "file://var/www",
+        "file:///../../../../var/www",
+        "file:///var/www/../../../../etc/secrets",
+        "file:../../../../../../../etc/secrets",
+    ],
+)
+def test_file_downloader_rejects_path_traversal_attempts(url, import_paths):
+    with pytest.raises(ValidationError):
+        FileDownloader(url)

{pulpcore-3.119.0 → pulpcore-3.119.2}/pulpcore.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulpcore
-Version: 3.119.0
+Version: 3.119.2
 Summary: Pulp Django Application and Related Modules
 Author-email: Pulp Team <pulp-list@redhat.com>
 License-Expression: GPL-2.0-or-later

{pulpcore-3.119.0 → pulpcore-3.119.2}/pulpcore.egg-info/SOURCES.txt

@@ -481,6 +481,7 @@ pulpcore/tests/unit/content/test_heartbeat.py
 pulpcore/tests/unit/download/__init__.py
 pulpcore/tests/unit/download/test_downloader_base.py
 pulpcore/tests/unit/download/test_downloader_factory.py
+pulpcore/tests/unit/download/test_downloader_file.py
 pulpcore/tests/unit/metrics/__init__.py
 pulpcore/tests/unit/metrics/conftest.py
 pulpcore/tests/unit/metrics/test_aiohttp_instrumentation.py

{pulpcore-3.119.0 → pulpcore-3.119.2}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = 'setuptools.build_meta'
 
 [project]
 name = "pulpcore"
-version = "3.119.0"
+version = "3.119.2"
 description = "Pulp Django Application and Related Modules"
 readme = "README.md"
 authors = [
@@ -207,7 +207,7 @@ ignore = [
 [tool.bumpversion]
 # This section is managed by the plugin template. Do not edit manually.
 
-current_version = "3.119.0"
+current_version = "3.119.2"
 commit = false
 tag = false
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<alpha>0a)?(?P<patch>\\d+)(\\.(?P<release>[a-z]+))?"