* Update requirements from branch 'master'  to 2aaf64dd91c63aa55f4cbe8c037a6f545e91b302  - Merge "Bump GitPython to 3.1.30"  - Bump GitPython to 3.1.30        3.1.30 includes 2 sets of fixes forCVE-2022-24439:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24439gitpython-developers/GitPython#1515        PRs:gitpython-developers/GitPython#1518gitpython-developers/GitPython#1521        Signed-off-by: Lon Hohberger <lhh@redhat.com>    Change-Id: I0def2d9801f0b20fcc9b613165a29dbced1fd2d7

3.1.30 includes 2 sets of fixes forCVE-2022-24439:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24439gitpython-developers/GitPython#1515PRs:gitpython-developers/GitPython#1518gitpython-developers/GitPython#1521Signed-off-by: Lon Hohberger <lhh@redhat.com>Change-Id: I0def2d9801f0b20fcc9b613165a29dbced1fd2d7

3.1.30- Make injections of command-invocations harder or impossible for clone and others.  Seegitpython-developers/GitPython#1518 for details.  Note that this might constitute a breaking change for some users, and if so please  let us know and we add an opt-out to this.- Prohibit insecure options and protocols by default, which is potentially a breaking change,  but a necessary fix forgitpython-developers/GitPython#1515.  Please take a look at the PR for more information and how to bypass these protections  in case they cause breakage:gitpython-developers/GitPython#1521.

All versions of package gitpython are vulnerable to Remote Code Execution(RCE) due to improper user input validation, which makes it possible toinject a maliciously crafted remote URL into the clone command. Exploitingthis vulnerability is possible because the library makes external calls togit without sufficient sanitization of input arguments.CVE:CVE-2022-24439Upstream-Status: BackportReference:gitpython-developers/GitPython#1529gitpython-developers/GitPython#1518gitpython-developers/GitPython#1521Signed-off-by: Narpat Mali <narpat.mali@windriver.com>

All versions of package gitpython are vulnerable to Remote Code Execution(RCE) due to improper user input validation, which makes it possible toinject a maliciously crafted remote URL into the clone command. Exploitingthis vulnerability is possible because the library makes external calls togit without sufficient sanitization of input arguments.CVE:CVE-2022-24439Upstream-Status: BackportReference:gitpython-developers/GitPython#1529gitpython-developers/GitPython#1518gitpython-developers/GitPython#1521(From OE-Core rev: 55f93e3786290dfa5ac72b5969bb2793f6a98bde)Signed-off-by: Narpat Mali <narpat.mali@windriver.com>Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

Source: pokyMR: 124663Type: IntegrationDisposition: Merged from pokyChangeID:0721360Description:All versions of package gitpython are vulnerable to Remote Code Execution(RCE) due to improper user input validation, which makes it possible toinject a maliciously crafted remote URL into the clone command. Exploitingthis vulnerability is possible because the library makes external calls togit without sufficient sanitization of input arguments.CVE:CVE-2022-24439Upstream-Status: BackportReference:gitpython-developers/GitPython#1529gitpython-developers/GitPython#1518gitpython-developers/GitPython#1521(From OE-Core rev: 55f93e3786290dfa5ac72b5969bb2793f6a98bde)Signed-off-by: Narpat Mali <narpat.mali@windriver.com>Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com>

This other GitCommandError on Windows is not related toIndexFile.from_tree whose 8 related failing tests were markedxfail in the preceding commit.Also, test_clone_command_injection should not be confused withtest_clone_from_command_injection, which passes on all platforms.The problem here appears to be that, on Windows, the path of thedirectory GitPython is intended to clone to (when the possiblesecurity vulnerability this test checks for is *absent*) is notvalid. Although this suggest the bug may only be in the test andthat the code under test may be working on Windows, but the testdoes not establish that, for which it would need to test with apayload clearly capable of creating a file unexpected_path pointsto when run on its own. I am unsure if that is the case, giventhat the "touch" command is used.This doesn't appear to be reported as a bug, but some generalcontext about the implementation can be examined ingitpython-developers#1518 where itwas introduced, andgitpython-developers#1531 where it was modified.

This other GitCommandError on Windows is not related toIndexFile.from_tree whose 8 related failing tests were marked xfailin the preceding commit.Also, test_clone_command_injection should not be confused withtest_clone_from_command_injection, which passes on all platforms.The problem here appears to be that, on Windows, the path of thedirectory GitPython is intended to clone to -- when the possiblesecurity vulnerability this test checks for is absent -- is notvalid. This suggests the bug may only be in the test and that thecode under test may be working on Windows. But the test does notestablish that, for which it would need to test with a payloadclearly capable of creating the file unexpected_path refers to whenrun on its own. (The "\" characters in the path seem to be treatedas escape characters rather than literally. Also, "touch" is not anative Windows command, and the "touch" command in Git for Windowsmaps disallowed occurrences of ":" in filenames to a separate codepoint in the Private Use Area of the Basic Multilingual Plane.)This doesn't currently seem to be reported as a bug, but somegeneral context about the implementation can be examined ingitpython-developers#1518where it was introduced, andgitpython-developers#1531 where it was modified.

This other GitCommandError on Windows is not related toIndexFile.from_tree whose 8 related failing tests were marked xfailin the preceding commit.Also, test_clone_command_injection should not be confused withtest_clone_from_command_injection, which passes on all platforms.The problem here appears to be that, on Windows, the path of thedirectory GitPython is intended to clone to -- when the possiblesecurity vulnerability this test checks for is absent -- is notvalid. This suggests the bug may only be in the test and that thecode under test may be working on Windows. But the test does notestablish that, for which it would need to test with a payloadclearly capable of creating the file unexpected_path refers to whenrun on its own.This doesn't currently seem to be reported as a bug, but somegeneral context about the implementation can be examined ingitpython-developers#1518where it was introduced, andgitpython-developers#1531 where it was modified.