Attachment #217207 for bug #247597

Lines 2-9 Link Here

(-)www/py-cherrypy/Makefile (-23 / +18 lines)
2	# $FreeBSD$	2	# $FreeBSD$
3		3
4	PORTNAME= cherrypy	4	PORTNAME= cherrypy
5	PORTVERSION= 5.4.0	5	PORTVERSION= 17.4.2
6	PORTREVISION= 4
7	CATEGORIES= www python	6	CATEGORIES= www python
8	MASTER_SITES= CHEESESHOP	7	MASTER_SITES= CHEESESHOP
9	PKGNAMEPREFIX= ${PYTHON_PKGNAMEPREFIX}	8	PKGNAMEPREFIX= ${PYTHON_PKGNAMEPREFIX}
Lines 14-39 COMMENT= Pythonic, object-oriented web development framework Link Here
14		13
15	LICENSE= BSD3CLAUSE	14	LICENSE= BSD3CLAUSE
16		15
17	EXAMPLES_RUN_DEPENDS= ${PYTHON_PKGNAMEPREFIX}cheetah>=2.4.4:devel/py-cheetah@${PY_FLAVOR} \	16	BUILD_DEPENDS= ${PYTHON_PKGNAMEPREFIX}pip>0:devel/py-pip@${PY_FLAVOR} \
18	${PYTHON_PKGNAMEPREFIX}sqlobject>=1.5.1:databases/py-sqlobject@${PY_FLAVOR}	17	${PYTHON_PKGNAMEPREFIX}setuptools_scm>0:devel/py-setuptools_scm@${PY_FLAVOR}
		18
		19	EXAMPLES_RUN_DEPENDS= ${PYTHON_PKGNAMEPREFIX}sqlobject>=1.5.1:databases/py-sqlobject@${PY_FLAVOR}
19	EXAMPLESDIR= ${PREFIX}/share/examples/${PKGNAMEPREFIX}${PORTNAME}	20	EXAMPLESDIR= ${PREFIX}/share/examples/${PKGNAMEPREFIX}${PORTNAME}
20		21
		22	RUN_DEPENDS= ${PYTHON_PKGNAMEPREFIX}six>=1.11.0:devel/py-six@${PY_FLAVOR} \
		23	${PYTHON_PKGNAMEPREFIX}cheroot>=6.2.4:www/py-cheroot@${PY_FLAVOR} \
		24	${PYTHON_PKGNAMEPREFIX}portend>=2.1.1:net/py-portend@${PY_FLAVOR} \
		25	${PYTHON_PKGNAMEPREFIX}zclockfile>0:devel/py-zclockfile@${PY_FLAVOR}
		26
21	OPTIONS_DEFINE= EXAMPLES	27	OPTIONS_DEFINE= EXAMPLES
22		28
23	PORTEXAMPLES= *	29	PORTEXAMPLES= *
24		30
25	USES= python shebangfix	31	USES= python
26	USE_PYTHON= distutils autoplist concurrent	32	USE_PYTHON= distutils autoplist concurrent
27	SHEBANG_FILES= cherrypy/cherryd
28		33
29	.include <bsd.port.options.mk>	34	.include <bsd.port.options.mk>
30		35
31	# handle tutorial separately, and remove cherrypy.process from data_files
32	# otherwise it confuses build_py.get_outputs() and breaks PYDISTUTILS_AUTOPLIST
33	post-patch:
34	@${REINPLACE_CMD} -e '99,106d' -e '78s/"cherrypy.tutorial",//1' \
35	-e '88d' -i.bak ${WRKSRC}/${PYSETUP}
36
37	.if ${PORT_OPTIONS:MEXAMPLES}	36	.if ${PORT_OPTIONS:MEXAMPLES}
38	post-install:	37	post-install:
39	@${MKDIR} ${STAGEDIR}${EXAMPLESDIR}	38	@${MKDIR} ${STAGEDIR}${EXAMPLESDIR}
Lines 46-65 post-install: Link Here
46		45
47	.include <bsd.port.pre.mk>	46	.include <bsd.port.pre.mk>
48		47
49	.if ${PYTHON_REL} >= 3000 # devel/py-cheetah doesn't yet build with Python 3	48	.if ${PYTHON_REL} < 3800
50	.undef EXAMPLES_RUN_DEPENDS	49	RUN_DEPENDS+= ${PYTHON_PKGNAMEPREFIX}contextlib2>0:devel/py-contextlib2@${PY_FLAVOR}
51	.endif	50	.endif
52		51
53	# The package cherrypy.wsgiserver includes both Python 2 and Python 3 modules,	52	.if ${PYTHON_REL} < 3000
54	# so it breaks PYDISTUTILS_AUTOPLIST.	53	RUN_DEPENDS+= ${PYTHON_PKGNAMEPREFIX}more-itertools5>0:devel/py-more-itertools5@${PY_FLAVOR}
55	# Instead of defining a cherrypy_build_py.get_outputs() method in setup.py	54	EXAMPLES_RUN_DEPENDS+= ${PYTHON_PKGNAMEPREFIX}cheetah>=2.4.4:devel/py-cheetah@${PY_FLAVOR}
56	# we simply remove unwanted modules (see cherrypy_build_py() in setup.py)
57	post-extract:
58	.if ${PYTHON_REL} >= 3000
59	@(cd ${WRKSRC}/cherrypy && ${RM} _cpcompat_subprocess.py && \
60	cd wsgiserver && ${RM} ssl_pyopenssl.py wsgiserver2.py)
61	.else	55	.else
62	@${RM} ${WRKSRC}/cherrypy/wsgiserver/wsgiserver3.py	56	RUN_DEPENDS+= ${PYTHON_PKGNAMEPREFIX}more-itertools>0:devel/py-more-itertools@${PY_FLAVOR}
		57	EXAMPLES_RUN_DEPENDS+= ${PYTHON_PKGNAMEPREFIX}cheetah3>0:devel/py-cheetah3@${PY_FLAVOR}
63	.endif	58	.endif
64		59
65	.include <bsd.port.post.mk>	60	.include <bsd.port.post.mk>

Lines 1-3 Link Here

(-)www/py-cherrypy/distinfo (-3 / +3 lines)
1	TIMESTAMP = 1464940005	1	TIMESTAMP = 1597378048
2	SHA256 (CherryPy-5.4.0.tar.gz) = bc8702099f6071ddd8b6404c110e22bb93e6a007fd9455e27f056be59a2ca801	2	SHA256 (CherryPy-17.4.2.tar.gz) = ef1619ad161f526745d4f0e4e517753d9d985814f1280e330661333d2ba05cdf
3	SIZE (CherryPy-5.4.0.tar.gz) = 435759	3	SIZE (CherryPy-17.4.2.tar.gz) = 684366




https://github.com/cherrypy/cherrypy/commit/c65dc279d1d8

--- cherrypy/_cpcompat.py.orig	2016-05-11 00:35:35 UTC
+++ cherrypy/_cpcompat.py
@@ -357,3 +357,19 @@ class SetDaemonProperty:
 
     if sys.version_info < (2, 6):
         daemon = property(__get_daemon, __set_daemon)
+
+# html module come in 3.2 version
+try:
+    from html import escape
+except ImportError:
+    from cgi import escape
+
+# html module needed the argument quote=False because in cgi the default
+# is False. With quote=True the results differ.
+
+def escape_html(s, escape_quote=False):
+    """Replace special characters "&", "<" and ">" to HTML-safe sequences.
+
+    When escape_quote=True, escape (') and (") chars.
+    """
+    return escape(s, quote=escape_quote)
--- cherrypy/_cperror.py.orig	2016-05-11 00:35:35 UTC
+++ cherrypy/_cperror.py
@@ -115,9 +115,9 @@ Note that you have to explicitly set
 and not simply return an error message as a result.
 """
 
-from cgi import escape as _escape
 from sys import exc_info as _exc_info
 from traceback import format_exception as _format_exception
+from cherrypy._cpcompat import escape_html
 from cherrypy._cpcompat import basestring, bytestr, iteritems, ntob
 from cherrypy._cpcompat import tonative, urljoin as _urljoin
 from cherrypy.lib import httputil as _httputil
@@ -489,7 +489,7 @@ def get_error_page(status, **kwargs):
         if v is None:
             kwargs[k] = ""
         else:
-            kwargs[k] = _escape(kwargs[k])
+            kwargs[k] = escape_html(kwargs[k])
 
     # Use a custom template or callable for the error page?
     pages = cherrypy.serving.request.error_page
--- cherrypy/test/test_compat.py.orig	2016-05-11 00:35:35 UTC
+++ cherrypy/test/test_compat.py
@@ -17,3 +17,11 @@ class StringTester(unittest.TestCase):
         if compat.py3k:
             raise nose.SkipTest("Only useful on Python 2")
         self.assertRaises(Exception, compat.ntob, unicode('fight'))
+
+
+class EscapeTester(unittest.TestCase):
+    """Class to test escape_html function from _cpcompat."""
+
+    def test_escape_quote(self):
+        """test_escape_quote - Verify the output for &<>"' chars."""
+        self.assertEqual("""xx&amp;&lt;&gt;"aa'""", compat.escape_html("""xx&<>"aa'"""))

Return to bug 247597

Lines 1-60 Link Here

(-)www/py-cherrypy/files/patch-python38 (-60 lines)
1	https://github.com/cherrypy/cherrypy/commit/c65dc279d1d8
2
3	--- cherrypy/_cpcompat.py.orig 2016-05-11 00:35:35 UTC
4	+++ cherrypy/_cpcompat.py
5	@@ -357,3 +357,19 @@ class SetDaemonProperty:
6
7	if sys.version_info < (2, 6):
8	daemon = property(__get_daemon, __set_daemon)
9	+
10	+# html module come in 3.2 version
11	+try:
12	+ from html import escape
13	+except ImportError:
14	+ from cgi import escape
15	+
16	+# html module needed the argument quote=False because in cgi the default
17	+# is False. With quote=True the results differ.
18	+
19	+def escape_html(s, escape_quote=False):
20	+ """Replace special characters "&", "<" and ">" to HTML-safe sequences.
21	+
22	+ When escape_quote=True, escape (') and (") chars.
23	+ """
24	+ return escape(s, quote=escape_quote)
25	--- cherrypy/_cperror.py.orig 2016-05-11 00:35:35 UTC
26	+++ cherrypy/_cperror.py
27	@@ -115,9 +115,9 @@ Note that you have to explicitly set
28	and not simply return an error message as a result.
29	"""
30
31	-from cgi import escape as _escape
32	from sys import exc_info as _exc_info
33	from traceback import format_exception as _format_exception
34	+from cherrypy._cpcompat import escape_html
35	from cherrypy._cpcompat import basestring, bytestr, iteritems, ntob
36	from cherrypy._cpcompat import tonative, urljoin as _urljoin
37	from cherrypy.lib import httputil as _httputil
38	@@ -489,7 +489,7 @@ def get_error_page(status, **kwargs):
39	if v is None:
40	kwargs[k] = ""
41	else:
42	- kwargs[k] = _escape(kwargs[k])
43	+ kwargs[k] = escape_html(kwargs[k])
44
45	# Use a custom template or callable for the error page?
46	pages = cherrypy.serving.request.error_page
47	--- cherrypy/test/test_compat.py.orig 2016-05-11 00:35:35 UTC
48	+++ cherrypy/test/test_compat.py
49	@@ -17,3 +17,11 @@ class StringTester(unittest.TestCase):
50	if compat.py3k:
51	raise nose.SkipTest("Only useful on Python 2")
52	self.assertRaises(Exception, compat.ntob, unicode('fight'))
53	+
54	+
55	+class EscapeTester(unittest.TestCase):
56	+ """Class to test escape_html function from _cpcompat."""
57	+
58	+ def test_escape_quote(self):
59	+ """test_escape_quote - Verify the output for &<>"' chars."""
60	+ self.assertEqual("""xx&<>"aa'""", compat.escape_html("""xx&<>"aa'"""))