From 2b739debfe4694326fbe790e55ae071530f8243c Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Sat, 1 Aug 2026 08:06:01 +0200
Subject: [PATCH] python3Packages.jupyterlab-git: fix CVE-2026-54527 and
 CVE-2026-54528

Backport the upstream fixes to 0.52.0. The master fix updates to
0.54.0, whose multi-package workspace is not present on release-26.05.

https://redirect.github.com/NixOS/nixpkgs/pull/547220
https://redirect.github.com/jupyterlab/jupyterlab-git/commit/c6d37b88f36aa59aee317930b95e427fb9d6b09b
https://redirect.github.com/jupyterlab/jupyterlab-git/commit/460035275b5963dc96e364e60ba6a73717fbd033

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
---
 .../jupyterlab-git/CVE-2026-54528.patch       | 46 +++++++++++++++++++
 .../python-modules/jupyterlab-git/default.nix | 21 +++++++++
 2 files changed, 67 insertions(+)
 create mode 100644 pkgs/development/python-modules/jupyterlab-git/CVE-2026-54528.patch

diff --git a/pkgs/development/python-modules/jupyterlab-git/CVE-2026-54528.patch b/pkgs/development/python-modules/jupyterlab-git/CVE-2026-54528.patch
new file mode 100644
index 000000000000..7b676aff5c9a
--- /dev/null
+++ b/pkgs/development/python-modules/jupyterlab-git/CVE-2026-54528.patch
@@ -0,0 +1,46 @@
+diff --git a/jupyterlab_git/handlers.py b/jupyterlab_git/handlers.py
+index d463bf9..1470435 100644
+--- a/jupyterlab_git/handlers.py
++++ b/jupyterlab_git/handlers.py
+@@ -63,7 +63,7 @@ class GitHandler(APIHandler):
+         if path is not None:
+             excluded_paths = self.git.excluded_paths
+             for excluded_path in excluded_paths:
+-                if fnmatch.fnmatchcase(path, excluded_path):
++                if fnmatch.fnmatchcase(path.casefold(), excluded_path.casefold()):
+                     raise tornado.web.HTTPError(404)
+
+     @functools.lru_cache()
+diff --git a/jupyterlab_git/tests/test_handlers.py b/jupyterlab_git/tests/test_handlers.py
+index 0c8c9ca..a4fd435 100644
+--- a/jupyterlab_git/tests/test_handlers.py
++++ b/jupyterlab_git/tests/test_handlers.py
+@@ -143,21 +143,18 @@ async def test_git_show_prefix_nested_directory(mock_execute, jp_fetch, jp_root_
+     )
+
+
+-async def test_git_show_prefix_for_excluded_path(
+-    jp_fetch, jp_server_config, jp_root_dir
+-):
+-    local_path = jp_root_dir / "ignored-path"
+-
+-    try:
+-        response = await jp_fetch(
++@pytest.mark.parametrize("path", ["ignored-path/subdir", "Ignored-Path/subdir"])
++async def test_git_show_prefix_for_excluded_path(path, jp_fetch, jp_server_config):
++    with pytest.raises(HTTPClientError) as error:
++        await jp_fetch(
+             NAMESPACE,
+-            local_path.name + "/subdir",
++            path,
+             "show_prefix",
+             body="{}",
+             method="POST",
+         )
+-    except HTTPClientError as e:
+-        assert e.code == 404
++
++    assert_http_error(error, 404)
+
+
+ @patch("jupyterlab_git.git.execute")
diff --git a/pkgs/development/python-modules/jupyterlab-git/default.nix b/pkgs/development/python-modules/jupyterlab-git/default.nix
index fcc2cae5d8c0..da6738197dd6 100644
--- a/pkgs/development/python-modules/jupyterlab-git/default.nix
+++ b/pkgs/development/python-modules/jupyterlab-git/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch2,
   git,
   gitMinimal,
   nodejs,
@@ -35,6 +36,18 @@ buildPythonPackage rec {
     hash = "sha256-BMzn+134hSYUFrDF+4+Bs81hzSURP9VNX4D9x2UuPMQ=";
   };
 
+  # Remove both patches when updating to 0.54.0 or later.
+  patches = [
+    (fetchpatch2 {
+      name = "CVE-2026-54527.patch";
+      url = "https://github.com/jupyterlab/jupyterlab-git/commit/c6d37b88f36aa59aee317930b95e427fb9d6b09b.patch?full_index=1";
+      hash = "sha256-eWE8TVetOyMWAlgjuNL03yxGoPMke+rGiU2H3qSBzM0=";
+    })
+    # Adapted from upstream commit 460035275b5963dc96e364e60ba6a73717fbd033
+    # to the pre-workspace 0.52.0 source layout.
+    ./CVE-2026-54528.patch
+  ];
+
   nativeBuildInputs = [
     nodejs
     yarn-berry_3.yarnBerryConfigHook
@@ -81,6 +94,14 @@ buildPythonPackage rec {
     "test_Git_get_nbdiff_dict"
   ];
 
+  preCheck = ''
+    jlpm test --runInBand \
+      src/__tests__/test-components/NotebookDiff.spec.tsx \
+      src/__tests__/test-components/PlainTextDiff.spec.tsx
+    pytest jupyterlab_git/tests/test_handlers.py \
+      -k test_git_show_prefix_for_excluded_path
+  '';
+
   pythonImportsCheck = [ "jupyterlab_git" ];
 
   __darwinAllowLocalNetworking = true;