Files
nixpkgs/pkgs/development/python-modules/jupyterlab-git/CVE-2026-54528.patch
Gerhard Schwanzer 2b739debfe python3Packages.jupyterlab-git: fix CVE-2026-54527 and CVE-2026-54528
Backport the upstream fixes to 0.52.0. The master fix updates to
0.54.0, whose multi-package workspace is not present on release-26.05.

https://redirect.github.com/NixOS/nixpkgs/pull/547220
c6d37b88f3
460035275b

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
2026-08-01 08:06:01 +02:00

47 lines
1.6 KiB
Diff

diff --git a/jupyterlab_git/handlers.py b/jupyterlab_git/handlers.py
index d463bf9..1470435 100644
--- a/jupyterlab_git/handlers.py
+++ b/jupyterlab_git/handlers.py
@@ -63,7 +63,7 @@ class GitHandler(APIHandler):
if path is not None:
excluded_paths = self.git.excluded_paths
for excluded_path in excluded_paths:
- if fnmatch.fnmatchcase(path, excluded_path):
+ if fnmatch.fnmatchcase(path.casefold(), excluded_path.casefold()):
raise tornado.web.HTTPError(404)
@functools.lru_cache()
diff --git a/jupyterlab_git/tests/test_handlers.py b/jupyterlab_git/tests/test_handlers.py
index 0c8c9ca..a4fd435 100644
--- a/jupyterlab_git/tests/test_handlers.py
+++ b/jupyterlab_git/tests/test_handlers.py
@@ -143,21 +143,18 @@ async def test_git_show_prefix_nested_directory(mock_execute, jp_fetch, jp_root_
)
-async def test_git_show_prefix_for_excluded_path(
- jp_fetch, jp_server_config, jp_root_dir
-):
- local_path = jp_root_dir / "ignored-path"
-
- try:
- response = await jp_fetch(
+@pytest.mark.parametrize("path", ["ignored-path/subdir", "Ignored-Path/subdir"])
+async def test_git_show_prefix_for_excluded_path(path, jp_fetch, jp_server_config):
+ with pytest.raises(HTTPClientError) as error:
+ await jp_fetch(
NAMESPACE,
- local_path.name + "/subdir",
+ path,
"show_prefix",
body="{}",
method="POST",
)
- except HTTPClientError as e:
- assert e.code == 404
+
+ assert_http_error(error, 404)
@patch("jupyterlab_git.git.execute")