1From 9e9f617a83f6593b476669030b0347d48e831c3f Mon Sep 17 00:00:00 2001
2From: Narpat Mali <narpat.mali@windriver.com>
3Date: Mon, 9 Jan 2023 14:45:05 +0000
4Subject: [PATCH] Limit the amount of whitespace to search/backtrack. Fixes
5 #3659.
6
7CVE: CVE-2022-40897
8
9Upstream-Status: Backport [https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be]
10
11Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
12---
13 setuptools/package_index.py | 2 +-
14 1 file changed, 1 insertion(+), 1 deletion(-)
15
16diff --git a/setuptools/package_index.py b/setuptools/package_index.py
17index 270e7f3..e93fcc6 100644
18--- a/setuptools/package_index.py
19+++ b/setuptools/package_index.py
20@@ -197,7 +197,7 @@ def unique_values(func):
21     return wrapper
22
23
24-REL = re.compile(r"""<([^>]*\srel\s*=\s*['"]?([^'">]+)[^>]*)>""", re.I)
25+REL = re.compile(r"""<([^>]*\srel\s{0,10}=\s{0,10}['"]?([^'" >]+)[^>]*)>""", re.I)
26 # this line is here to fix emacs' cruddy broken syntax highlighting
27
28
29--
302.34.1
31
32