From 61d0affbefd8865a2a66412b61f7d61d6c2e3c9d Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Sun, 24 Jul 2022 16:26:35 +0100
Subject: [PATCH] python3Packages.lxml: add patch for CVE-2022-2309

---
 pkgs/development/python-modules/lxml/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/python-modules/lxml/default.nix b/pkgs/development/python-modules/lxml/default.nix
index 3ef230eb8e8d..f313d0708319 100644
--- a/pkgs/development/python-modules/lxml/default.nix
+++ b/pkgs/development/python-modules/lxml/default.nix
@@ -4,6 +4,7 @@
 , libxslt
 , zlib
 , xcodebuild
+, fetchpatch
 }:
 
 buildPythonPackage rec {
@@ -17,6 +18,14 @@ buildPythonPackage rec {
     sha256 = "sha256-ppyLn8B0YFQivRCOE8TjKGdDDQHbb7UdTUkevznoVC8=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2022-2309.patch";
+      url = "https://github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847149af0c6f.patch";
+      sha256 = "sha256-2NHESuG+a2hx+1369l0lSrlRENPgeLxqL18mzvufNh8=";
+    })
+  ];
+
   # setuptoolsBuildPhase needs dependencies to be passed through nativeBuildInputs
   nativeBuildInputs = [ libxml2.dev libxslt.dev cython ] ++ lib.optionals stdenv.isDarwin [ xcodebuild ];
   buildInputs = [ libxml2 libxslt zlib ];