From dde5e29f1ec9e7a84bfe4546216ae8ee34ec1689 Mon Sep 17 00:00:00 2001
From: wk333 <13474090681@163.com>
Date: Thu, 4 May 2023 11:13:25 +0800
Subject: [PATCH] Fix CVE-2023-30608

(cherry picked from commit a1ff603951091981b23c9ede5ac2f825598bd58a)
---
 CVE-2023-30608.patch | 49 ++++++++++++++++++++++++++++++++++++++++++++
 python-sqlparse.spec | 10 ++++++---
 2 files changed, 56 insertions(+), 3 deletions(-)
 create mode 100644 CVE-2023-30608.patch

diff --git a/CVE-2023-30608.patch b/CVE-2023-30608.patch
new file mode 100644
index 0000000..befaad4
--- /dev/null
+++ b/CVE-2023-30608.patch
@@ -0,0 +1,49 @@
+From c457abd5f097dd13fb21543381e7cfafe7d31cfb Mon Sep 17 00:00:00 2001
+From: Andi Albrecht <albrecht.andi@gmail.com>
+Date: Mon, 20 Mar 2023 08:33:46 +0100
+Subject: [PATCH] Remove unnecessary parts in regex for bad escaping.
+
+The regex tried to deal with situations where escaping in the
+SQL to be parsed was suspicious.
+
+From : https://github.com/andialbrecht/sqlparse/commit/c457abd5f097dd13fb21543381e7cfafe7d31cfb
+
+---
+ sqlparse/keywords.py | 4 ++--
+ tests/test_split.py  | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sqlparse/keywords.py b/sqlparse/keywords.py
+index 9c37e50..2017b6c 100644
+--- a/sqlparse/keywords.py
++++ b/sqlparse/keywords.py
+@@ -67,9 +67,9 @@ SQL_REGEX = {
+         (r'(?![_A-ZÀ-Ü])-?(\d+(\.\d*)|\.\d+)(?![_A-ZÀ-Ü])',
+          tokens.Number.Float),
+         (r'(?![_A-ZÀ-Ü])-?\d+(?![_A-ZÀ-Ü])', tokens.Number.Integer),
+-        (r"'(''|\\\\|\\'|[^'])*'", tokens.String.Single),
++        (r"'(''|\\'|[^'])*'", tokens.String.Single),
+         # not a real string literal in ANSI SQL:
+-        (r'"(""|\\\\|\\"|[^"])*"', tokens.String.Symbol),
++        (r'"(""|\\"|[^"])*"', tokens.String.Symbol),
+         (r'(""|".*?[^\\]")', tokens.String.Symbol),
+         # sqlite names can be escaped with [square brackets]. left bracket
+         # cannot be preceded by word character or a right bracket --
+diff --git a/tests/test_split.py b/tests/test_split.py
+index a93e3d4..bcc96cf 100644
+--- a/tests/test_split.py
++++ b/tests/test_split.py
+@@ -20,8 +20,8 @@ def test_split_semicolon():
+ 
+ 
+ def test_split_backslash():
+-    stmts = sqlparse.parse(r"select '\\'; select '\''; select '\\\'';")
+-    assert len(stmts) == 3
++    stmts = sqlparse.parse("select '\'; select '\'';")
++    assert len(stmts) == 2
+ 
+ 
+ @pytest.mark.parametrize('fn', ['function.sql',
+-- 
+2.33.0
+
diff --git a/python-sqlparse.spec b/python-sqlparse.spec
index 1ac2814..31a34bd 100644
--- a/python-sqlparse.spec
+++ b/python-sqlparse.spec
@@ -1,11 +1,12 @@
 %global _empty_manifest_terminate_build 0
 Name:		python-sqlparse
 Version:	0.3.1
-Release:	1
+Release:	2
 Summary:	Non-validating SQL parser
 License:	BSD
 URL:		https://github.com/andialbrecht/sqlparse
 Source0:	https://files.pythonhosted.org/packages/67/4b/253b6902c1526885af6d361ca8c6b1400292e649f0e9c95ee0d2e8ec8681/sqlparse-0.3.1.tar.gz
+Patch0: 	CVE-2023-30608.patch
 BuildArch:	noarch
 
 
@@ -33,7 +34,7 @@ It provides support for parsing, splitting and formatting SQL statements.
 
 
 %prep
-%autosetup -n sqlparse-0.3.1
+%autosetup -n sqlparse-0.3.1 -p1
 
 %build
 %py3_build
@@ -73,5 +74,8 @@ mv %{buildroot}/doclist.lst .
 %{_docdir}/*
 
 %changelog
-* Sun Jul 12 2020 Python_Bot <Python_Bot@openeuler.org>
+* Thu May 04 2023 wangkai <13474090681@163.com> - 0.3.1-2
+- Fix CVE-2023-30608
+
+* Sun Jul 12 2020 Python_Bot <Python_Bot@openeuler.org> - 0.3.1-1
 - Package Spec generated
-- 
Gitee