From 804f750bdbdf0b8ef19e7bb219368fa26718be8e Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Sun, 31 Jan 2021 23:50:08 +0000
Subject: [PATCH] pythonPackages.bottle: add patch for CVE-2020-28473

commit identification from
https://github.com/bottlepy/bottle/issues/1331
---
 pkgs/development/python-modules/bottle/default.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/bottle/default.nix b/pkgs/development/python-modules/bottle/default.nix
index 5fda85dc972b..0a1d93c2d1b4 100644
--- a/pkgs/development/python-modules/bottle/default.nix
+++ b/pkgs/development/python-modules/bottle/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi, setuptools }:
+{ stdenv, buildPythonPackage, fetchPypi, fetchpatch, setuptools }:
 
 buildPythonPackage rec {
   pname = "bottle";
@@ -9,6 +9,14 @@ buildPythonPackage rec {
     sha256 = "0819b74b145a7def225c0e83b16a4d5711fde751cd92bae467a69efce720f69e";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2020-28473.patch";
+      url = "https://github.com/bottlepy/bottle/commit/57a2f22e0c1d2b328c4f54bf75741d74f47f1a6b.patch";
+      sha256 = "0jgvpmsq5zswr077ql5h4kmglqh7z1hf0w5gr8x59am0sgjcz21v";
+    })
+  ];
+
   propagatedBuildInputs = [ setuptools ];
 
   meta = with stdenv.lib; {