CVE-2022-35920: python3Packages.sanic, backport upstream fix (no version bump)

pkgs/development/python-modules/sanic/CVE-2022-35920.patch

@@ -0,0 +1,50 @@
+diff --git a/sanic/mixins/routes.py b/sanic/mixins/routes.py
+--- a/sanic/mixins/routes.py
++++ b/sanic/mixins/routes.py
+@@ -3,7 +3,7 @@ from contextlib import suppress
+ from functools import partial, wraps
+ from inspect import getsource, signature
+ from mimetypes import guess_type
+-from os import path
++from os import path, sep
+ from pathlib import PurePath
+ from re import sub
+ from textwrap import dedent
+@@ -775,23 +775,23 @@ class RouteMixin(metaclass=SanicMeta):
+         content_type=None,
+         __file_uri__=None,
+     ):
+-        # Using this to determine if the URL is trying to break out of the path
+-        # served.  os.path.realpath seems to be very slow
+-        if __file_uri__ and "../" in __file_uri__:
+-            raise InvalidUsage("Invalid URL")
+         # Merge served directory and requested file if provided
+-        # Strip all / that in the beginning of the URL to help prevent python
+-        # from herping a derp and treating the uri as an absolute path
+-        root_path = file_path = file_or_directory
++        root_path = file_path = path.abspath(unquote(file_or_directory))
++
+         if __file_uri__:
+-            file_path = path.join(
+-                file_or_directory, sub("^[/]*", "", __file_uri__)
+-            )
++            # Strip all / that in the beginning of the URL to help prevent
++            # python from herping a derp and treating the uri as an
++            # absolute path
++            unquoted_file_uri = unquote(__file_uri__).lstrip("/")
++
++            segments = unquoted_file_uri.split("/")
++            if ".." in segments or any(sep in segment for segment in segments):
++                raise InvalidUsage("Invalid URL")
++
++            file_path = path.join(file_or_directory, unquoted_file_uri)
++            file_path = path.abspath(file_path)
+
+-        # URL decode the path sent by the browser otherwise we won't be able to
+-        # match filenames which got encoded (filenames with spaces etc)
+-        file_path = path.abspath(unquote(file_path))
+-        if not file_path.startswith(path.abspath(unquote(root_path))):
++        if not file_path.startswith(root_path):
+             error_logger.exception(
+                 f"File not found: path={file_or_directory}, "
+                 f"relative_url={__file_uri__}"

pkgs/development/python-modules/sanic/default.nix

@@ -36,6 +36,10 @@ buildPythonPackage rec {
     hash = "sha256-4zdPp3X22dfZ5YlW3G5/OqeUxrt+NiFO9dk2XjEKXEg=";
   };
 
+  patches = [
+    ./CVE-2022-35920.patch
+  ];
+
   postPatch = ''
     # Loosen dependency requirements.
     substituteInPlace setup.py \