Merge pull request #188803 from risicle/ris-markdown2-2.4.3-xss

This commit is contained in:
Sandro 2022-09-06 00:39:36 +02:00 committed by GitHub
commit a8b8f97a25
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -1,21 +1,41 @@
{ lib, buildPythonPackage, fetchFromGitHub, python, pygments }:
{ lib
, buildPythonPackage
, fetchFromGitHub
, fetchpatch
, python
, pygments
}:
buildPythonPackage rec {
pname = "markdown2";
version = "2.4.1";
version = "2.4.3";
# PyPI does not contain tests, so using GitHub instead.
src = fetchFromGitHub {
owner = "trentm";
repo = "python-markdown2";
rev = version;
sha256 = "0y7kh9jj8ys00qkfmmyqj63y21g7wn7yr715kj0j1nabs6xbp0y7";
sha256 = "sha256-zNZ7/dDZbPIwcxSLvf8u5oaAgHLrZ6kk4vXNPUuZs/4=";
};
patches = [
(fetchpatch {
name = "SNYK-PYTHON-MARKDOWN2-2606985-xss.patch"; # no CVE (yet?)
url = "https://github.com/trentm/python-markdown2/commit/5898fcc1090ef7cd7783fa1422cc0e53cbca9d1b.patch";
sha256 = "sha256-M6kKxjHVC3O0BvDeEF4swzfpFsDO/LU9IHvfjK4hznA=";
})
];
checkInputs = [ pygments ];
checkPhase = ''
${python.interpreter} ./test/test.py
runHook preCheck
pushd test
${python.interpreter} ./test.py -- -knownfailure
popd # test
runHook postCheck
'';
meta = with lib; {