pulpcore 3.85.30__tar.gz → 3.85.31__tar.gz

{pulpcore-3.85.30 → pulpcore-3.85.31}/CHANGES.md

@@ -8,6 +8,29 @@
 
 [//]: # (towncrier release notes start)
 
+## 3.85.31 (2026-09-23) {: #3.85.31 }
+
+### REST API {: #3.85.31-rest-api }
+
+#### Bugfixes {: #3.85.31-rest-api-bugfix }
+
+- Fixed file downloader path sanitation. CVE-2026-90959
+- Fixed post-migrate hooks to prevent failing on incomplete or rolled back migrations.
+
+### Plugin API {: #3.85.31-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.85.31-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.85.31-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.85.30 (2026-09-01) {: #3.85.30 }
 
 ### REST API {: #3.85.30-rest-api }

{pulpcore-3.85.30 → pulpcore-3.85.31}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulpcore
-Version: 3.85.30
+Version: 3.85.31
 Summary: Pulp Django Application and Related Modules
 Author-email: Pulp Team <pulp-list@redhat.com>
 Project-URL: Homepage, https://pulpproject.org
@@ -31,7 +31,7 @@ Requires-Dist: django-filter<=25.1,>=23.1
 Requires-Dist: django-guid<3.6,>=3.3.0
 Requires-Dist: django-import-export<5.0,>=2.9
 Requires-Dist: django-lifecycle<=1.2.4,>=1.0
-Requires-Dist: djangorestframework<=3.16.1,>=3.14.0
+Requires-Dist: djangorestframework<3.18,>=3.14.0
 Requires-Dist: djangorestframework-queryfields<=1.1.0,>=1.0
 Requires-Dist: drf-access-policy<1.5.1,>=1.1.2
 Requires-Dist: drf-nested-routers<=0.94.2,>=0.93.4

{pulpcore-3.85.30 → pulpcore-3.85.31}/pulp_certguard/app/__init__.py

@@ -6,6 +6,6 @@ class PulpCertGuardPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_certguard.app"
     label = "certguard"
-    version = "3.85.30"
+    version = "3.85.31"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.85.30 → pulpcore-3.85.31}/pulp_file/app/__init__.py

@@ -8,6 +8,6 @@ class PulpFilePluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_file.app"
     label = "file"
-    version = "3.85.30"
+    version = "3.85.31"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.85.30 → pulpcore-3.85.31}/pulpcore/app/apps.py

@@ -1,12 +1,13 @@
 import random
 from collections import defaultdict
+from contextlib import suppress
 from gettext import gettext as _
 from importlib import import_module
 
 from django import apps
 from django.conf import settings
 from django.core.exceptions import ImproperlyConfigured
-from django.db import connection, transaction
+from django.db import ProgrammingError, connection, transaction
 from django.db.models.signals import post_migrate, pre_migrate
 from django.utils.module_loading import module_has_submodule
 
@@ -237,7 +238,7 @@ class PulpAppConfig(PulpPluginAppConfig):
     label = "core"
 
     # The version of this app
-    version = "3.85.30"
+    version = "3.85.31"
 
     # The python package name providing this app
     python_package_name = "pulpcore"
@@ -332,27 +333,31 @@ def _populate_access_policies(sender, apps, verbosity, **kwargs):
 
 
 def _populate_system_id(sender, apps, verbosity, **kwargs):
-    SystemID = apps.get_model("core", "SystemID")
-    if not SystemID.objects.exists():
-        SystemID().save()
-
-
-def _ensure_default_domain(sender, **kwargs):
-    table_names = connection.introspection.table_names()
-    if "core_domain" in table_names:
-        from pulpcore.app.util import get_default_domain
-
-        default = get_default_domain()  # Cache the default domain
-        # Match the Pulp settings
-        if (
-            settings.HIDE_GUARDED_DISTRIBUTIONS != default.hide_guarded_distributions
-            or settings.REDIRECT_TO_OBJECT_STORAGE != default.redirect_to_object_storage
-            or settings.STORAGES["default"]["BACKEND"] != default.storage_class
-        ):
-            default.hide_guarded_distributions = settings.HIDE_GUARDED_DISTRIBUTIONS
-            default.redirect_to_object_storage = settings.REDIRECT_TO_OBJECT_STORAGE
-            default.storage_class = settings.STORAGES["default"]["BACKEND"]
-            default.save(skip_hooks=True)
+    with suppress(LookupError):
+        SystemID = apps.get_model("core", "SystemID")
+        if not SystemID.objects.exists():
+            SystemID().save()
+
+
+def _ensure_default_domain(sender, apps, **kwargs):
+    # This is a post migrate hook.
+    # But on rolling back the database may not match what this function expects.
+    with suppress(LookupError, ProgrammingError):
+        table_names = connection.introspection.table_names()
+        if "core_domain" in table_names:
+            from pulpcore.app.util import get_default_domain
+
+            default = get_default_domain()  # Cache the default domain
+            # Match the Pulp settings
+            if (
+                settings.HIDE_GUARDED_DISTRIBUTIONS != default.hide_guarded_distributions
+                or settings.REDIRECT_TO_OBJECT_STORAGE != default.redirect_to_object_storage
+                or settings.STORAGES["default"]["BACKEND"] != default.storage_class
+            ):
+                default.hide_guarded_distributions = settings.HIDE_GUARDED_DISTRIBUTIONS
+                default.redirect_to_object_storage = settings.REDIRECT_TO_OBJECT_STORAGE
+                default.storage_class = settings.STORAGES["default"]["BACKEND"]
+                default.save(skip_hooks=True)
 
 
 def _populate_roles(sender, apps, verbosity, **kwargs):

{pulpcore-3.85.30 → pulpcore-3.85.31}/pulpcore/app/models/repository.py

@@ -1065,7 +1065,7 @@ class RepositoryVersion(BaseModel):
         with transaction.atomic():
             if to_add:
                 self.content_ids += list(to_add)
-                self.save()
+                self.save(update_fields=["content_ids", "pulp_last_updated"])
 
             # Normalize representation if content has already been removed in this version and
             # is re-added: Undo removal by setting version_removed to None.
@@ -1127,7 +1127,7 @@ class RepositoryVersion(BaseModel):
 
             if to_remove:
                 self.content_ids = list(content_ids - to_remove)
-                self.save()
+                self.save(update_fields=["content_ids", "pulp_last_updated"])
 
     def set_content(self, content):
         """

{pulpcore-3.85.30 → pulpcore-3.85.31}/pulpcore/app/serializers/repository.py

@@ -285,24 +285,28 @@ class RemoteSerializer(ModelSerializer, HiddenFieldsMixin):
                 )
             )
 
-        if not url.lower().startswith("file://"):
-            return url
-
-        user_path = url[7:]
-        if not os.path.isabs(user_path):
-            raise serializers.ValidationError(
-                _("The path '{}' needs to be an absolute pathname.").format(user_path)
-            )
+        if parsed_url.scheme == "file":
+            user_path = parsed_url.path
+            if not os.path.isabs(user_path):
+                raise serializers.ValidationError(
+                    _("The path '{}' needs to be an absolute pathname.").format(user_path)
+                )
+            if user_path.rstrip("/") != os.path.normpath(user_path):
+                raise serializers.ValidationError(_("The path '{}' is not normalized."))
 
-        user_provided_realpath = os.path.realpath(user_path)
+            user_provided_realpath = os.path.realpath(user_path)
 
-        for allowed_path in settings.ALLOWED_IMPORT_PATHS:
-            if user_provided_realpath.startswith(allowed_path):
-                return url
+            if not any(
+                user_provided_realpath.startswith(allowed_path)
+                for allowed_path in settings.ALLOWED_IMPORT_PATHS
+            ):
+                raise serializers.ValidationError(
+                    _("The path '{}' does not start with any of the allowed import paths").format(
+                        user_path
+                    )
+                )
 
-        raise serializers.ValidationError(
-            _("The path '{}' does not start with any of the allowed import paths").format(user_path)
-        )
+        return url
 
     def validate_proxy_url(self, value):
         """

{pulpcore-3.85.30 → pulpcore-3.85.31}/pulpcore/download/file.py

@@ -2,6 +2,7 @@ import os
 from urllib.parse import urlparse
 
 import aiofiles
+from rest_framework.serializers import ValidationError
 
 from .base import BaseDownloader, DownloadResult
 
@@ -35,6 +36,9 @@ class FileDownloader(BaseDownloader):
 
         RemoteSerializer().validate_url(url)
         p = urlparse(url)
+        if p.scheme != "file":
+            raise ValidationError("Not a valid file url.")
+
         self._path = os.path.abspath(os.path.join(p.netloc, p.path))
         super().__init__(url, *args, **kwargs)
 

{pulpcore-3.85.30 → pulpcore-3.85.31}/pulpcore/tests/unit/download/test_downloader_factory.py

@@ -1,9 +1,16 @@
 import pytest
 
+from pulpcore.app.util import get_domain
 from pulpcore.download.factory import DownloaderFactory
 from pulpcore.plugin.models import Remote
 
 
+@pytest.fixture(autouse=True)
+def mock_default_domain(db):
+    # Cache the domain in synchronous context before starting the tests.
+    get_domain()
+
+
 @pytest.mark.asyncio
 async def test_user_agent_header():
     remote = Remote(url="http://example.org/", name="foo")

pulpcore-3.85.31/pulpcore/tests/unit/download/test_downloader_file.py

@@ -0,0 +1,41 @@
+import pytest
+from rest_framework.serializers import ValidationError
+
+from pulpcore.download import FileDownloader
+
+
+@pytest.fixture
+def import_paths(settings):
+    settings.ALLOWED_IMPORT_PATHS = ["/static", "/var/www"]
+
+
+@pytest.mark.parametrize(
+    "url",
+    [
+        "file:///var/www",
+        "file:///var/www/",
+        "file:///var/www/a",
+        "file:///var/www/a/",
+    ],
+)
+def test_file_downloader_accepts_regular_file_urls(url, import_paths):
+    FileDownloader(url)
+
+
+@pytest.mark.parametrize(
+    "url",
+    [
+        "",
+        "...",
+        "/",
+        "file:///",
+        "file:.",
+        "file://var/www",
+        "file:///../../../../var/www",
+        "file:///var/www/../../../../etc/secrets",
+        "file:../../../../../../../etc/secrets",
+    ],
+)
+def test_file_downloader_rejects_path_traversal_attempts(url, import_paths):
+    with pytest.raises(ValidationError):
+        FileDownloader(url)

{pulpcore-3.85.30 → pulpcore-3.85.31}/pulpcore.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulpcore
-Version: 3.85.30
+Version: 3.85.31
 Summary: Pulp Django Application and Related Modules
 Author-email: Pulp Team <pulp-list@redhat.com>
 Project-URL: Homepage, https://pulpproject.org
@@ -31,7 +31,7 @@ Requires-Dist: django-filter<=25.1,>=23.1
 Requires-Dist: django-guid<3.6,>=3.3.0
 Requires-Dist: django-import-export<5.0,>=2.9
 Requires-Dist: django-lifecycle<=1.2.4,>=1.0
-Requires-Dist: djangorestframework<=3.16.1,>=3.14.0
+Requires-Dist: djangorestframework<3.18,>=3.14.0
 Requires-Dist: djangorestframework-queryfields<=1.1.0,>=1.0
 Requires-Dist: drf-access-policy<1.5.1,>=1.1.2
 Requires-Dist: drf-nested-routers<=0.94.2,>=0.93.4

{pulpcore-3.85.30 → pulpcore-3.85.31}/pulpcore.egg-info/SOURCES.txt

@@ -432,6 +432,7 @@ pulpcore/tests/unit/content/test_heartbeat.py
 pulpcore/tests/unit/download/__init__.py
 pulpcore/tests/unit/download/test_downloader_base.py
 pulpcore/tests/unit/download/test_downloader_factory.py
+pulpcore/tests/unit/download/test_downloader_file.py
 pulpcore/tests/unit/metrics/__init__.py
 pulpcore/tests/unit/metrics/conftest.py
 pulpcore/tests/unit/metrics/test_aiohttp_instrumentation.py

{pulpcore-3.85.30 → pulpcore-3.85.31}/pulpcore.egg-info/requires.txt

@@ -10,7 +10,7 @@ django-filter<=25.1,>=23.1
 django-guid<3.6,>=3.3.0
 django-import-export<5.0,>=2.9
 django-lifecycle<=1.2.4,>=1.0
-djangorestframework<=3.16.1,>=3.14.0
+djangorestframework<3.18,>=3.14.0
 djangorestframework-queryfields<=1.1.0,>=1.0
 drf-access-policy<1.5.1,>=1.1.2
 drf-nested-routers<=0.94.2,>=0.93.4

{pulpcore-3.85.30 → pulpcore-3.85.31}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = 'setuptools.build_meta'
 
 [project]
 name = "pulpcore"
-version = "3.85.30"
+version = "3.85.31"
 description = "Pulp Django Application and Related Modules"
 readme = "README.md"
 authors = [
@@ -37,7 +37,7 @@ dependencies = [
   "django-guid>=3.3.0,<3.6",  # Looks like only bugfixes in z-Stream.
   "django-import-export>=2.9,<5.0",
   "django-lifecycle>=1.0,<=1.2.4",
-  "djangorestframework>=3.14.0,<=3.16.1",
+  "djangorestframework>=3.14.0,<3.18",  # API-stable z-Streams. https://www.django-rest-framework.org/community/release-notes/
   "djangorestframework-queryfields>=1.0,<=1.1.0",
   "drf-access-policy>=1.1.2,<1.5.1",
   "drf-nested-routers>=0.93.4,<=0.94.2",
@@ -206,7 +206,7 @@ ignore = [
 [tool.bumpversion]
 # This section is managed by the plugin template. Do not edit manually.
 
-current_version = "3.85.30"
+current_version = "3.85.31"
 commit = false
 tag = false
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<alpha>0a)?(?P<patch>\\d+)(\\.(?P<release>[a-z]+))?"