!52 [sync] PR-50: Fix CVE-2024-49767

From: @openeuler-sync-bot 
Reviewed-by: @lyn1001 
Signed-off-by: @lyn1001

CVE-2024-49767--apply-max_form_memory_size-another-level-up.patch

@@ -0,0 +1,80 @@
+From 8760275afb72bd10b57d92cb4d52abf759b2f3a7 Mon Sep 17 00:00:00 2001
+From: David Lord <davidism@gmail.com>
+Date: Fri, 25 Oct 2024 06:46:50 -0700
+Subject: [PATCH] apply max_form_memory_size another level up in the parser
+---
+ src/werkzeug/formparser.py       | 11 +++++++++++
+ src/werkzeug/sansio/multipart.py |  2 ++
+ tests/test_formparser.py         | 11 +++++++++++
+ 3 files changed, 24 insertions(+)
+
+diff --git a/src/werkzeug/formparser.py b/src/werkzeug/formparser.py
+index 92f5b3d..4cd7d8d 100644
+--- a/src/werkzeug/formparser.py
++++ b/src/werkzeug/formparser.py
+@@ -445,6 +445,7 @@ class MultiPartParser:
+     def parse(
+         self, stream: t.IO[bytes], boundary: bytes, content_length: t.Optional[int]
+     ) -> t.Tuple[MultiDict, MultiDict]:
++        field_size: int | None = None
+         container: t.Union[t.IO[bytes], t.List[bytes]]
+         _write: t.Callable[[bytes], t.Any]
+ 
+@@ -471,13 +472,23 @@ class MultiPartParser:
+             while not isinstance(event, (Epilogue, NeedData)):
+                 if isinstance(event, Field):
+                     current_part = event
++                    field_size = 0
+                     container = []
+                     _write = container.append
+                 elif isinstance(event, File):
+                     current_part = event
++                    field_size = None
+                     container = self.start_file_streaming(event, content_length)
+                     _write = container.write
+                 elif isinstance(event, Data):
++                    if self.max_form_memory_size is not None and field_size is not None:
++                        # Ensure that accumulated data events do not exceed limit.
++                        # Also checked within single event in MultipartDecoder.
++                        field_size += len(event.data)
++
++                        if field_size > self.max_form_memory_size:
++                            raise RequestEntityTooLarge()
++
+                     _write(event.data)
+                     if not event.more_data:
+                         if isinstance(current_part, Field):
+diff --git a/src/werkzeug/sansio/multipart.py b/src/werkzeug/sansio/multipart.py
+index 31a24d0..a20fa87 100644
+--- a/src/werkzeug/sansio/multipart.py
++++ b/src/werkzeug/sansio/multipart.py
+@@ -137,6 +137,8 @@ class MultipartDecoder:
+             self.max_form_memory_size is not None
+             and len(self.buffer) + len(data) > self.max_form_memory_size
+         ):
++            # Ensure that data within single event does not exceed limit.
++            # Also checked across accumulated events in MultiPartParser.
+             raise RequestEntityTooLarge()
+         else:
+             self.buffer.extend(data)
+diff --git a/tests/test_formparser.py b/tests/test_formparser.py
+index e32657d..245983c 100644
+--- a/tests/test_formparser.py
++++ b/tests/test_formparser.py
+@@ -459,3 +459,14 @@ class TestMultiPartParser:
+         )
+         assert request.files["rfc2231"].filename == "a b c d e f.txt"
+         assert request.files["rfc2231"].read() == b"file contents"
++
++def test_multipart_max_form_memory_size() -> None:
++    """max_form_memory_size is tracked across multiple data events."""
++    data = b"--bound\r\nContent-Disposition: form-field; name=a\r\n\r\n"
++    data += b"a" * 15 + b"\r\n--bound--"
++    # The buffer size is less than the max size, so multiple data events will be
++    # returned. The field size is greater than the max.
++    parser = formparser.MultiPartParser(max_form_memory_size=10, buffer_size=5)
++
++    with pytest.raises(RequestEntityTooLarge):
++        parser.parse(io.BytesIO(data), b"bound", None)
+-- 
+2.33.0

python-werkzeug.spec

@@ -1,7 +1,7 @@
 %global _empty_manifest_terminate_build 0
 Name:		python-werkzeug
 Version:	2.0.3
-Release:	4
+Release:	5
 Summary:	The comprehensive WSGI web application library.
 License:	BSD-3-Clause
 URL:		https://palletsprojects.com/p/werkzeug/
@@ -11,6 +11,7 @@ Patch0001:      backport-fix-typo-and-grammar-mistake.patch
 Patch0002:      backport-fix-flake8-bugbear-finding.patch
 Patch0003:      CVE-2023-23934.patch
 Patch0004:      CVE-2023-25577.patch
+Patch0005:      CVE-2024-49767--apply-max_form_memory_size-another-level-up.patch
 
 BuildArch:	noarch
 BuildRequires:  python3-werkzeug
@@ -180,6 +181,9 @@ export PYTHONPATH=$PYTHONPATH:$depath
 %{_docdir}/*
 
 %changelog
+* Tue Nov 12 2024 liningjie <liningjie@xfusion.com> - 2.0.3-5
+- Fix CVE-2024-49767
+
 * Mon Aug 14 2023 yaoxin <yao_xin001@hoperun.com> - 2.0.3-4
 - Fix CVE-2023-23934 and CVE-2023-25577