pulpcore 3.49.69__tar.gz → 3.49.71__tar.gz

{pulpcore-3.49.69 → pulpcore-3.49.71}/CHANGES.md

@@ -8,6 +8,48 @@
 
 [//]: # (towncrier release notes start)
 
+## 3.49.71 (2026-09-24) {: #3.49.71 }
+
+### REST API {: #3.49.71-rest-api }
+
+#### Bugfixes {: #3.49.71-rest-api-bugfix }
+
+- Fixed file downloader path sanitation. CVE-2026-90959
+
+### Plugin API {: #3.49.71-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.49.71-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.49.71-pulp-cert-guard }
+
+No significant changes.
+
+---
+
+## 3.49.70 (2026-09-02) {: #3.49.70 }
+
+### REST API {: #3.49.70-rest-api }
+
+No significant changes.
+
+### Plugin API {: #3.49.70-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.49.70-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.49.70-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.49.69 (2026-09-01) {: #3.49.69 }
 
 ### REST API {: #3.49.69-rest-api }

{pulpcore-3.49.69 → pulpcore-3.49.71}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulpcore
-Version: 3.49.69
+Version: 3.49.71
 Summary: Pulp Django Application and Related Modules
 Home-page: https://pulpproject.org
 Author: Pulp Team
@@ -32,7 +32,7 @@ Requires-Dist: django-filter<=25.2,>=23.1
 Requires-Dist: django-guid<=3.4.0,>=3.3
 Requires-Dist: django-import-export<5.0,>=2.9
 Requires-Dist: django-lifecycle<=1.1.2,>=1.0
-Requires-Dist: djangorestframework<=3.15.2,>=3.14.0
+Requires-Dist: djangorestframework<3.18,>=3.14.0
 Requires-Dist: djangorestframework-queryfields<=1.1.0,>=1.0
 Requires-Dist: drf-access-policy<1.5.1,>=1.1.2
 Requires-Dist: drf-nested-routers<=0.93.5,>=0.93.4

{pulpcore-3.49.69 → pulpcore-3.49.71}/pulp_certguard/app/__init__.py

@@ -6,6 +6,6 @@ class PulpCertGuardPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_certguard.app"
     label = "certguard"
-    version = "3.49.69"
+    version = "3.49.71"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.49.69 → pulpcore-3.49.71}/pulp_file/app/__init__.py

@@ -8,6 +8,6 @@ class PulpFilePluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_file.app"
     label = "file"
-    version = "3.49.69"
+    version = "3.49.71"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.49.69 → pulpcore-3.49.71}/pulpcore/app/apps.py

@@ -242,7 +242,7 @@ class PulpAppConfig(PulpPluginAppConfig):
     label = "core"
 
     # The version of this app
-    version = "3.49.69"
+    version = "3.49.71"
 
     # The python package name providing this app
     python_package_name = "pulpcore"

{pulpcore-3.49.69 → pulpcore-3.49.71}/pulpcore/app/serializers/repository.py

@@ -282,24 +282,28 @@ class RemoteSerializer(ModelSerializer, HiddenFieldsMixin):
                 )
             )
 
-        if not url.lower().startswith("file://"):
-            return url
-
-        user_path = url[7:]
-        if not os.path.isabs(user_path):
-            raise serializers.ValidationError(
-                _("The path '{}' needs to be an absolute pathname.").format(user_path)
-            )
+        if parsed_url.scheme == "file":
+            user_path = parsed_url.path
+            if not os.path.isabs(user_path):
+                raise serializers.ValidationError(
+                    _("The path '{}' needs to be an absolute pathname.").format(user_path)
+                )
+            if user_path.rstrip("/") != os.path.normpath(user_path):
+                raise serializers.ValidationError(_("The path '{}' is not normalized."))
 
-        user_provided_realpath = os.path.realpath(user_path)
+            user_provided_realpath = os.path.realpath(user_path)
 
-        for allowed_path in settings.ALLOWED_IMPORT_PATHS:
-            if user_provided_realpath.startswith(allowed_path):
-                return url
+            if not any(
+                user_provided_realpath.startswith(allowed_path)
+                for allowed_path in settings.ALLOWED_IMPORT_PATHS
+            ):
+                raise serializers.ValidationError(
+                    _("The path '{}' does not start with any of the allowed import paths").format(
+                        user_path
+                    )
+                )
 
-        raise serializers.ValidationError(
-            _("The path '{}' does not start with any of the allowed import paths").format(user_path)
-        )
+        return url
 
     def validate_proxy_url(self, value):
         """

{pulpcore-3.49.69 → pulpcore-3.49.71}/pulpcore/download/file.py

@@ -2,6 +2,7 @@ import os
 from urllib.parse import urlparse
 
 import aiofiles
+from rest_framework.serializers import ValidationError
 
 from .base import BaseDownloader, DownloadResult
 
@@ -35,6 +36,9 @@ class FileDownloader(BaseDownloader):
 
         RemoteSerializer().validate_url(url)
         p = urlparse(url)
+        if p.scheme != "file":
+            raise ValidationError("Not a valid file url.")
+
         self._path = os.path.abspath(os.path.join(p.netloc, p.path))
         super().__init__(url, *args, **kwargs)
 

{pulpcore-3.49.69 → pulpcore-3.49.71}/pulpcore/tests/unit/download/test_downloader_factory.py

@@ -1,9 +1,16 @@
 import pytest
 
+from pulpcore.app.util import get_domain
 from pulpcore.download.factory import DownloaderFactory
 from pulpcore.plugin.models import Remote
 
 
+@pytest.fixture(autouse=True)
+def mock_default_domain(db):
+    # Cache the domain in synchronous context before starting the tests.
+    get_domain()
+
+
 @pytest.mark.asyncio
 async def test_user_agent_header():
     remote = Remote(url="http://example.org/", name="foo")

pulpcore-3.49.71/pulpcore/tests/unit/download/test_downloader_file.py

@@ -0,0 +1,41 @@
+import pytest
+from rest_framework.serializers import ValidationError
+
+from pulpcore.download import FileDownloader
+
+
+@pytest.fixture
+def import_paths(settings):
+    settings.ALLOWED_IMPORT_PATHS = ["/static", "/var/www"]
+
+
+@pytest.mark.parametrize(
+    "url",
+    [
+        "file:///tmp/www",
+        "file:///tmp/www/",
+        "file:///tmp/www/a",
+        "file:///tmp/www/a/",
+    ],
+)
+def test_file_downloader_accepts_regular_file_urls(url, import_paths):
+    FileDownloader(url)
+
+
+@pytest.mark.parametrize(
+    "url",
+    [
+        "",
+        "...",
+        "/",
+        "file:///",
+        "file:.",
+        "file://var/www",
+        "file:///../../../../var/www",
+        "file:///var/www/../../../../etc/secrets",
+        "file:../../../../../../../etc/secrets",
+    ],
+)
+def test_file_downloader_rejects_path_traversal_attempts(url, import_paths):
+    with pytest.raises(ValidationError):
+        FileDownloader(url)

{pulpcore-3.49.69 → pulpcore-3.49.71}/pulpcore.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulpcore
-Version: 3.49.69
+Version: 3.49.71
 Summary: Pulp Django Application and Related Modules
 Home-page: https://pulpproject.org
 Author: Pulp Team
@@ -32,7 +32,7 @@ Requires-Dist: django-filter<=25.2,>=23.1
 Requires-Dist: django-guid<=3.4.0,>=3.3
 Requires-Dist: django-import-export<5.0,>=2.9
 Requires-Dist: django-lifecycle<=1.1.2,>=1.0
-Requires-Dist: djangorestframework<=3.15.2,>=3.14.0
+Requires-Dist: djangorestframework<3.18,>=3.14.0
 Requires-Dist: djangorestframework-queryfields<=1.1.0,>=1.0
 Requires-Dist: drf-access-policy<1.5.1,>=1.1.2
 Requires-Dist: drf-nested-routers<=0.93.5,>=0.93.4

{pulpcore-3.49.69 → pulpcore-3.49.71}/pulpcore.egg-info/SOURCES.txt

@@ -489,6 +489,7 @@ pulpcore/tests/unit/content/test_heartbeat.py
 pulpcore/tests/unit/download/__init__.py
 pulpcore/tests/unit/download/test_downloader_base.py
 pulpcore/tests/unit/download/test_downloader_factory.py
+pulpcore/tests/unit/download/test_downloader_file.py
 pulpcore/tests/unit/migration/__init__.py
 pulpcore/tests/unit/migration/test_0077_move_remote_url_credentials.py
 pulpcore/tests/unit/models/__init__.py

{pulpcore-3.49.69 → pulpcore-3.49.71}/pulpcore.egg-info/requires.txt

@@ -10,7 +10,7 @@ django-filter<=25.2,>=23.1
 django-guid<=3.4.0,>=3.3
 django-import-export<5.0,>=2.9
 django-lifecycle<=1.1.2,>=1.0
-djangorestframework<=3.15.2,>=3.14.0
+djangorestframework<3.18,>=3.14.0
 djangorestframework-queryfields<=1.1.0,>=1.0
 drf-access-policy<1.5.1,>=1.1.2
 drf-nested-routers<=0.93.5,>=0.93.4

{pulpcore-3.49.69 → pulpcore-3.49.71}/pyproject.toml

@@ -105,7 +105,7 @@ ignore = [
 [tool.bumpversion]
 # This section is managed by the plugin template. Do not edit manually.
 
-current_version = "3.49.69"
+current_version = "3.49.71"
 commit = false
 tag = false
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<alpha>0a)?(?P<patch>\\d+)(\\.(?P<release>[a-z]+))?"

{pulpcore-3.49.69 → pulpcore-3.49.71}/requirements.txt

@@ -11,7 +11,7 @@ django-filter>=23.1,<=25.2  # Uses CalVer, not released often https://github.com
 django-guid>=3.3,<=3.4.0
 django-import-export>=2.9,<5.0
 django-lifecycle>=1.0,<=1.1.2
-djangorestframework>=3.14.0,<=3.15.2
+djangorestframework>=3.14.0,<3.18  # API-stable z-Streams. https://www.django-rest-framework.org/community/release-notes/
 djangorestframework-queryfields>=1.0,<=1.1.0
 drf-access-policy>=1.1.2,<1.5.1
 drf-nested-routers>=0.93.4,<=0.93.5

{pulpcore-3.49.69 → pulpcore-3.49.71}/setup.py

@@ -8,7 +8,7 @@ with open("requirements.txt") as requirements:
 
 setup(
     name="pulpcore",
-    version="3.49.69",
+    version="3.49.71",
     description="Pulp Django Application and Related Modules",
     long_description=long_description,
     long_description_content_type="text/markdown",