From 85aef4bfeffeb4491b43ff9770e87877f0c734ac Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Sun, 6 Nov 2022 00:27:29 +0000
Subject: [PATCH] python3Packages.jupyter_core: add patch for CVE-2022-39286

---
 .../jupyter_core/4.9.2-CVE-2022-39286.patch   | 97 +++++++++++++++++++
 .../python-modules/jupyter_core/default.nix   |  1 +
 2 files changed, 98 insertions(+)
 create mode 100644 pkgs/development/python-modules/jupyter_core/4.9.2-CVE-2022-39286.patch

diff --git a/pkgs/development/python-modules/jupyter_core/4.9.2-CVE-2022-39286.patch b/pkgs/development/python-modules/jupyter_core/4.9.2-CVE-2022-39286.patch
new file mode 100644
index 000000000000..accf0ef8f827
--- /dev/null
+++ b/pkgs/development/python-modules/jupyter_core/4.9.2-CVE-2022-39286.patch
@@ -0,0 +1,97 @@
+combination of upstream 1118c8ce01800cb689d51f655f5ccef19516e283 and
+part of d6a8168b9f6b8a28bba5f7cca3d6a9c31da041b6 to allow the test
+alterations to apply
+
+diff --git a/jupyter_core/application.py b/jupyter_core/application.py
+index 77b5c33..e321410 100644
+--- a/jupyter_core/application.py
++++ b/jupyter_core/application.py
+@@ -78,8 +78,8 @@ class JupyterApp(Application):
+     def config_file_paths(self):
+         path = jupyter_config_path()
+         if self.config_dir not in path:
++            # Insert config dir as first item.
+             path.insert(0, self.config_dir)
+-        path.insert(0, os.getcwd())
+         return path
+     
+     data_dir = Unicode()
+diff --git a/jupyter_core/tests/test_application.py b/jupyter_core/tests/test_application.py
+index 0d87e4f..e24ec5d 100644
+--- a/jupyter_core/tests/test_application.py
++++ b/jupyter_core/tests/test_application.py
+@@ -65,43 +65,51 @@ def test_generate_config():
+ 
+ def test_load_config():
+     config_dir = mkdtemp()
+-    wd = mkdtemp()
+-    with open(pjoin(config_dir, 'dummy_app_config.py'), 'w', encoding='utf-8') as f:
+-        f.write('c.DummyApp.m = 1\n')
+-        f.write('c.DummyApp.n = 1')
+-    with patch.object(os, 'getcwd', lambda : wd):
+-        app = DummyApp(config_dir=config_dir)
+-        app.initialize([])
++    os.environ["JUPYTER_CONFIG_PATH"] = str(config_dir)
++    with open(pjoin(config_dir, "dummy_app_config.py"), "w", encoding="utf-8") as f:
++        f.write("c.DummyApp.m = 1\n")
++        f.write("c.DummyApp.n = 1")
++
++    app = DummyApp(config_dir=config_dir)
++    app.initialize([])
+ 
+     assert app.n == 1, "Loaded config from config dir"
+-    
+-    with open(pjoin(wd, 'dummy_app_config.py'), 'w', encoding='utf-8') as f:
+-        f.write('c.DummyApp.n = 2')
++    assert app.m == 1, "Loaded config from config dir"
++
++    shutil.rmtree(config_dir)
++    del os.environ["JUPYTER_CONFIG_PATH"]
+ 
+-    with patch.object(os, 'getcwd', lambda : wd):
++
++def test_load_config_no_cwd():
++    config_dir = mkdtemp()
++    wd = mkdtemp()
++    with open(pjoin(wd, "dummy_app_config.py"), "w", encoding="utf-8") as f:
++        f.write("c.DummyApp.m = 1\n")
++        f.write("c.DummyApp.n = 1")
++    with patch.object(os, "getcwd", lambda: wd):
+         app = DummyApp(config_dir=config_dir)
+         app.initialize([])
+ 
+-    assert app.m == 1, "Loaded config from config dir"
+-    assert app.n == 2, "Loaded config from CWD"
+-    
++    assert app.n == 0
++    assert app.m == 0
++
+     shutil.rmtree(config_dir)
+     shutil.rmtree(wd)
+ 
+ 
+ def test_load_bad_config():
+     config_dir = mkdtemp()
+-    wd = mkdtemp()
+-    with open(pjoin(config_dir, 'dummy_app_config.py'), 'w', encoding='utf-8') as f:
+-        f.write('c.DummyApp.m = "a\n') # Syntax error
+-    with patch.object(os, 'getcwd', lambda : wd):
+-        with pytest.raises(SyntaxError):
+-            app = DummyApp(config_dir=config_dir)
+-            app.raise_config_file_errors=True
+-            app.initialize([])
++    os.environ["JUPYTER_CONFIG_PATH"] = str(config_dir)
++    with open(pjoin(config_dir, "dummy_app_config.py"), "w", encoding="utf-8") as f:
++        f.write('c.DummyApp.m = "a\n')  # Syntax error
++
++    with pytest.raises(SyntaxError):
++        app = DummyApp(config_dir=config_dir)
++        app.raise_config_file_errors = True
++        app.initialize([])
+ 
+     shutil.rmtree(config_dir)
+-    shutil.rmtree(wd)
++    del os.environ["JUPYTER_CONFIG_PATH"]
+ 
+ 
+ def test_runtime_dir_changed():
diff --git a/pkgs/development/python-modules/jupyter_core/default.nix b/pkgs/development/python-modules/jupyter_core/default.nix
index b7838ff5915f..5c482622e167 100644
--- a/pkgs/development/python-modules/jupyter_core/default.nix
+++ b/pkgs/development/python-modules/jupyter_core/default.nix
@@ -32,6 +32,7 @@ buildPythonPackage rec {
       sha256 = "sha256-QeAfj7wLz4egVUPMAgrZ9Wn/Tv60LrIXLgHGVoH41wQ=";
     })
     ./tests_respect_pythonpath.patch
+    ./4.9.2-CVE-2022-39286.patch
   ];
 
   preCheck = ''