From 35970a5aa087ce6aaec482b01181045f442ee7fe Mon Sep 17 00:00:00 2001
From: trace <trace@adastracomputing.com>
Date: Sat, 5 Sep 2026 14:24:06 +0000
Subject: [PATCH 1/2] trace-pr anchor


From e1ab53b6c9fffc98332d9ddbbc859859b39c5497 Mon Sep 17 00:00:00 2001
From: trace <trace@adastracomputing.com>
Date: Sat, 5 Sep 2026 14:24:06 +0000
Subject: [PATCH 2/2] python3Packages.sanic: 22.3.2 (fix CVE-2022-35920)

---
 .../python-modules/sanic/CVE-2022-35920.patch | 50 +++++++++++++++++++
 .../python-modules/sanic/default.nix          |  4 ++
 2 files changed, 54 insertions(+)
 create mode 100644 pkgs/development/python-modules/sanic/CVE-2022-35920.patch

diff --git a/pkgs/development/python-modules/sanic/CVE-2022-35920.patch b/pkgs/development/python-modules/sanic/CVE-2022-35920.patch
new file mode 100644
index 0000000000000..391307acd7539
--- /dev/null
+++ b/pkgs/development/python-modules/sanic/CVE-2022-35920.patch
@@ -0,0 +1,50 @@
+diff --git a/sanic/mixins/routes.py b/sanic/mixins/routes.py
+--- a/sanic/mixins/routes.py
++++ b/sanic/mixins/routes.py
+@@ -3,7 +3,7 @@ from contextlib import suppress
+ from functools import partial, wraps
+ from inspect import getsource, signature
+ from mimetypes import guess_type
+-from os import path
++from os import path, sep
+ from pathlib import PurePath
+ from re import sub
+ from textwrap import dedent
+@@ -775,23 +775,23 @@ class RouteMixin(metaclass=SanicMeta):
+         content_type=None,
+         __file_uri__=None,
+     ):
+-        # Using this to determine if the URL is trying to break out of the path
+-        # served.  os.path.realpath seems to be very slow
+-        if __file_uri__ and "../" in __file_uri__:
+-            raise InvalidUsage("Invalid URL")
+         # Merge served directory and requested file if provided
+-        # Strip all / that in the beginning of the URL to help prevent python
+-        # from herping a derp and treating the uri as an absolute path
+-        root_path = file_path = file_or_directory
++        root_path = file_path = path.abspath(unquote(file_or_directory))
++
+         if __file_uri__:
+-            file_path = path.join(
+-                file_or_directory, sub("^[/]*", "", __file_uri__)
+-            )
++            # Strip all / that in the beginning of the URL to help prevent
++            # python from herping a derp and treating the uri as an
++            # absolute path
++            unquoted_file_uri = unquote(__file_uri__).lstrip("/")
++
++            segments = unquoted_file_uri.split("/")
++            if ".." in segments or any(sep in segment for segment in segments):
++                raise InvalidUsage("Invalid URL")
++
++            file_path = path.join(file_or_directory, unquoted_file_uri)
++            file_path = path.abspath(file_path)
+
+-        # URL decode the path sent by the browser otherwise we won't be able to
+-        # match filenames which got encoded (filenames with spaces etc)
+-        file_path = path.abspath(unquote(file_path))
+-        if not file_path.startswith(path.abspath(unquote(root_path))):
++        if not file_path.startswith(root_path):
+             error_logger.exception(
+                 f"File not found: path={file_or_directory}, "
+                 f"relative_url={__file_uri__}"
diff --git a/pkgs/development/python-modules/sanic/default.nix b/pkgs/development/python-modules/sanic/default.nix
index 45dec87633575..6e699a84e458e 100644
--- a/pkgs/development/python-modules/sanic/default.nix
+++ b/pkgs/development/python-modules/sanic/default.nix
@@ -36,6 +36,10 @@ buildPythonPackage rec {
     hash = "sha256-4zdPp3X22dfZ5YlW3G5/OqeUxrt+NiFO9dk2XjEKXEg=";
   };
 
+  patches = [
+    ./CVE-2022-35920.patch
+  ];
+
   postPatch = ''
     # Loosen dependency requirements.
     substituteInPlace setup.py \