From 0a3f21a0414afba61fd633889297ebde27ab86ea Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 30 Mar 2022 04:36:08 +0200
Subject: [PATCH] python3Packages.twisted: fix CVE-2022-21712

Twisted versions before 22.1 would leak cookie and authorization headers
when following cross-origin redirects in
`twisted.web.client.RedirectAgent` and
`twisted.web.client.BrowserLikeRedirectAgent`.

Fixes: #CVE-2022-21712
---
 pkgs/development/python-modules/twisted/default.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index b09ccebde198..ffd7cb92f21b 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -1,6 +1,7 @@
 { lib, stdenv
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , python
 , zope_interface
 , incremental
@@ -25,6 +26,15 @@ buildPythonPackage rec {
     sha256 = "01lh225d7lfnmfx4f4kxwl3963gjc9yg8jfkn1w769v34ia55mic";
   };
 
+  patches = [
+    (fetchpatch {
+      # https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx
+      name = "CVE-2022-21712.patch";
+      url = "https://github.com/twisted/twisted/commit/af8fe78542a6f2bf2235ccee8158d9c88d31e8e2.patch";
+      sha256 = "sha256-4destHY7smyXEvk4Z022wItHvTmaTFibrp9ztd4ZaX4=";
+    })
+  ];
+
   propagatedBuildInputs = [ zope_interface incremental automat constantly hyperlink pyhamcrest attrs setuptools typing-extensions ];
 
   passthru.extras.tls = [ pyopenssl service-identity idna ];