File CVE-2024-36039.patch of Package python-PyMySQL

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2024-36039.patch of Package python-PyMySQL

From 521e40050cb386a499f68f483fefd144c493053c Mon Sep 17 00:00:00 2001
From: Inada Naoki <songofacandy@gmail.com>
Date: Sat, 18 May 2024 11:33:30 +0900
Subject: [PATCH] forbid dict parameter

---
 pymysql/converters.py            | 6 +-----
 pymysql/tests/test_connection.py | 7 +++++--
 2 files changed, 6 insertions(+), 7 deletions(-)

Index: PyMySQL-1.1.0/pymysql/converters.py
===================================================================
--- PyMySQL-1.1.0.orig/pymysql/converters.py
+++ PyMySQL-1.1.0/pymysql/converters.py
@@ -27,11 +27,7 @@ def escape_item(val, charset, mapping=No
 
 
 def escape_dict(val, charset, mapping=None):
-    n = {}
-    for k, v in val.items():
-        quoted = escape_item(v, charset, mapping)
-        n[k] = quoted
-    return n
+    raise TypeError("dict can not be used as parameter")
 
 
 def escape_sequence(val, charset, mapping=None):
Index: PyMySQL-1.1.0/pymysql/tests/test_connection.py
===================================================================
--- PyMySQL-1.1.0.orig/pymysql/tests/test_connection.py
+++ PyMySQL-1.1.0/pymysql/tests/test_connection.py
@@ -781,12 +781,15 @@ class TestEscape(base.PyMySQLTestCase):
 
         self.assertRaises(TypeError, con.escape, 42, {})
 
-    def test_escape_dict_value(self):
+    def test_escape_dict_raise_typeerror(self):
+        """con.escape(dict) should raise TypeError"""
         con = self.connect()
 
         mapping = con.encoders.copy()
         mapping[Foo] = escape_foo
-        self.assertEqual(con.escape({"foo": Foo()}, mapping), {"foo": "bar"})
+        #self.assertEqual(con.escape({"foo": Foo()}, mapping), {"foo": "bar"})
+        with self.assertRaises(TypeError):
+            con.escape({"foo": Foo()})
 
     def test_escape_list_item(self):
         con = self.connect()

Places

File CVE-2024-36039.patch of Package python-PyMySQL

Places