Bug 1868137

Use the following template to for the 'fedpkg update' request to submit an
update for this issue as it contains the top-level parent bug(s) as well as
this tracking bug.  This will ensure that all associated bugs get updated
when new packages are pushed to stable.

=====

# bugfix, security, enhancement, newpackage (required)
type=security

# low, medium, high, urgent (required)
severity=medium

# testing, stable
request=testing

# Bug numbers: 1234,9876
bugs=1868135,1868137

# Description of your update
notes=Security fix for [PUT CVEs HERE]

# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3

# Automatically close bugs when this marked as stable
close_bugs=True

# Suggest that users restart after update
suggest_reboot=False

======

Additionally, you may opt to use the bodhi web interface to submit updates:

https://bodhi.fedoraproject.org/updates/new

Pull Request: https://src.fedoraproject.org/rpms/python-pip-epel/pull-request/2



Using reproducer from: https://bugzilla.redhat.com/show_bug.cgi?id=1868016#c2


OLD:


$ rpm -qa python2-pip
python2-pip-8.1.2-12.el7.noarch

$ pip2 install http://0.0.0.0:8765/
Collecting http://0.0.0.0:8765/
/
127.0.0.1 - - [02/Sep/2020 11:09:31] "GET / HTTP/1.1" 200 -
Exception:
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/pip/basecommand.py", line 215, in main
    status = self.run(options, args)
  File "/usr/lib/python2.7/site-packages/pip/commands/install.py", line 307, in run
    requirement_set.prepare_files(finder)
  File "/usr/lib/python2.7/site-packages/pip/req/req_set.py", line 370, in prepare_files
    ignore_dependencies=self.ignore_dependencies))
  File "/usr/lib/python2.7/site-packages/pip/req/req_set.py", line 587, in _prepare_file
    session=self.session, hashes=hashes)
  File "/usr/lib/python2.7/site-packages/pip/download.py", line 810, in unpack_url
    hashes=hashes
  File "/usr/lib/python2.7/site-packages/pip/download.py", line 649, in unpack_http_url
    hashes)
  File "/usr/lib/python2.7/site-packages/pip/download.py", line 870, in _download_http_url
    with open(file_path, 'wb') as content_file:
IOError: [Errno 21] Is a directory: '/tmp/pip-Yy352C-unpack/../../../../../../../../../../tmp/'
You are using pip version 8.1.2, however version 20.2.2 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.


$ rpm -qa python34-pip
python34-pip-8.1.2-12.el7.noarch

$ pip3.4 install http://0.0.0.0:8765/
Collecting http://0.0.0.0:8765/
/
127.0.0.1 - - [02/Sep/2020 11:10:41] "GET / HTTP/1.1" 200 -
Exception:
Traceback (most recent call last):
  File "/usr/lib/python3.4/site-packages/pip/basecommand.py", line 215, in main
    status = self.run(options, args)
  File "/usr/lib/python3.4/site-packages/pip/commands/install.py", line 307, in run
    requirement_set.prepare_files(finder)
  File "/usr/lib/python3.4/site-packages/pip/req/req_set.py", line 370, in prepare_files
    ignore_dependencies=self.ignore_dependencies))
  File "/usr/lib/python3.4/site-packages/pip/req/req_set.py", line 587, in _prepare_file
    session=self.session, hashes=hashes)
  File "/usr/lib/python3.4/site-packages/pip/download.py", line 810, in unpack_url
    hashes=hashes
  File "/usr/lib/python3.4/site-packages/pip/download.py", line 649, in unpack_http_url
    hashes)
  File "/usr/lib/python3.4/site-packages/pip/download.py", line 870, in _download_http_url
    with open(file_path, 'wb') as content_file:
IsADirectoryError: [Errno 21] Is a directory: '/tmp/pip-u8ra9r3n-unpack/../../../../../../../../../../tmp/'
You are using pip version 8.1.2, however version 20.2.2 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.



NEW:

$ rpm -qa python2-pip
python2-pip-8.1.2-14.el7.noarch

$ pip2 install http://0.0.0.0:8765/
Collecting http://0.0.0.0:8765/
/
127.0.0.1 - - [02/Sep/2020 11:13:37] "GET / HTTP/1.1" 200 -
  Downloading http://0.0.0.0:8765/
  Cannot unpack file /tmp/pip-BFdOgn-unpack/0.0.0.0:8765 (downloaded from /tmp/pip-8UdO4R-build, content-type: ); cannot detect archive format
Cannot determine archive format of /tmp/pip-8UdO4R-build
You are using pip version 8.1.2, however version 20.2.2 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.


$ rpm -qa python34-pip
python34-pip-8.1.2-14.el7.noarch

$ pip3.4 install http://0.0.0.0:8765/
Collecting http://0.0.0.0:8765/
/
127.0.0.1 - - [02/Sep/2020 11:14:25] "GET / HTTP/1.1" 200 -
  Downloading http://0.0.0.0:8765/
  Cannot unpack file /tmp/pip-nk4fa1i8-unpack/0.0.0.0:8765 (downloaded from /tmp/pip-4uhk8st7-build, content-type: ); cannot detect archive format
Cannot determine archive format of /tmp/pip-4uhk8st7-build
You are using pip version 8.1.2, however version 20.2.2 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.
[root@ci-vm-10-0-139-142 ~]#



Test suite:

$ py.test -k unit/test_download.py -v

[..]
tests/unit/test_download.py::test_sanitize_content_filename[dir/file-file] PASSED
tests/unit/test_download.py::test_sanitize_content_filename[../file-file] PASSED
tests/unit/test_download.py::test_sanitize_content_filename[../../file-file] PASSED
tests/unit/test_download.py::test_sanitize_content_filename[../-] PASSED
tests/unit/test_download.py::test_sanitize_content_filename[../..-..] PASSED
tests/unit/test_download.py::test_sanitize_content_filename[/-] PASSED
tests/unit/test_download.py::test_sanitize_content_filename__platform_dependent[dir\file-file-dir\file] PASSED
tests/unit/test_download.py::test_sanitize_content_filename__platform_dependent[..\file-file-..\file] PASSED
tests/unit/test_download.py::test_sanitize_content_filename__platform_dependent[..\..\file-file-..\..\file] PASSED
tests/unit/test_download.py::test_sanitize_content_filename__platform_dependent[..\--..\] PASSED
tests/unit/test_download.py::test_sanitize_content_filename__platform_dependent[..\..-..-..\..] PASSED
tests/unit/test_download.py::test_sanitize_content_filename__platform_dependent[\--\] PASSED
tests/unit/test_download.py::test_parse_content_disposition[attachment;filename="../file"-df-file] PASSED
tests/unit/test_download.py::test_download_http_url__no_directory_traversal PASSED
[..]
============================================================= 626 tests deselected by '-kunit/test_download.py' ==============================================================
====================================================== 33 passed, 3 skipped, 626 deselected, 1 warnings in 1.13 seconds ======================================================



OLD fails & NEW succeeds & test suite succeeds => VERIFIED.

FEDORA-EPEL-2020-49c5f31e92 has been submitted as an update to Fedora EPEL 7. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-49c5f31e92

FEDORA-EPEL-2020-49c5f31e92 has been pushed to the Fedora EPEL 7 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-49c5f31e92

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

FEDORA-EPEL-2020-49c5f31e92 has been pushed to the Fedora EPEL 7 stable repository.
If problem still persists, please make note of it in this bug report.