Воркед

venv/Lib/site-packages/pip/_internal/operations/build/build_tracker.py

@@ -3,9 +3,8 @@ import hashlib
 import logging
 import os
 from types import TracebackType
-from typing import Dict, Generator, Optional, Set, Type, Union
+from typing import Dict, Generator, Optional, Type, Union
 
-from pip._internal.models.link import Link
 from pip._internal.req.req_install import InstallRequirement
 from pip._internal.utils.temp_dir import TempDirectory
 
@@ -51,10 +50,22 @@ def get_build_tracker() -> Generator["BuildTracker", None, None]:
             yield tracker
 
 
+class TrackerId(str):
+    """Uniquely identifying string provided to the build tracker."""
+
+
 class BuildTracker:
+    """Ensure that an sdist cannot request itself as a setup requirement.
+
+    When an sdist is prepared, it identifies its setup requirements in the
+    context of ``BuildTracker.track()``. If a requirement shows up recursively, this
+    raises an exception.
+
+    This stops fork bombs embedded in malicious packages."""
+
     def __init__(self, root: str) -> None:
         self._root = root
-        self._entries: Set[InstallRequirement] = set()
+        self._entries: Dict[TrackerId, InstallRequirement] = {}
         logger.debug("Created build tracker: %s", self._root)
 
     def __enter__(self) -> "BuildTracker":
@@ -69,16 +80,15 @@ class BuildTracker:
     ) -> None:
         self.cleanup()
 
-    def _entry_path(self, link: Link) -> str:
-        hashed = hashlib.sha224(link.url_without_fragment.encode()).hexdigest()
+    def _entry_path(self, key: TrackerId) -> str:
+        hashed = hashlib.sha224(key.encode()).hexdigest()
         return os.path.join(self._root, hashed)
 
-    def add(self, req: InstallRequirement) -> None:
+    def add(self, req: InstallRequirement, key: TrackerId) -> None:
         """Add an InstallRequirement to build tracking."""
 
-        assert req.link
         # Get the file to write information about this requirement.
-        entry_path = self._entry_path(req.link)
+        entry_path = self._entry_path(key)
 
         # Try reading from the file. If it exists and can be read from, a build
         # is already in progress, so a LookupError is raised.
@@ -88,37 +98,41 @@ class BuildTracker:
         except FileNotFoundError:
             pass
         else:
-            message = "{} is already being built: {}".format(req.link, contents)
+            message = f"{req.link} is already being built: {contents}"
             raise LookupError(message)
 
         # If we're here, req should really not be building already.
-        assert req not in self._entries
+        assert key not in self._entries
 
         # Start tracking this requirement.
         with open(entry_path, "w", encoding="utf-8") as fp:
             fp.write(str(req))
-        self._entries.add(req)
+        self._entries[key] = req
 
         logger.debug("Added %s to build tracker %r", req, self._root)
 
-    def remove(self, req: InstallRequirement) -> None:
+    def remove(self, req: InstallRequirement, key: TrackerId) -> None:
         """Remove an InstallRequirement from build tracking."""
 
-        assert req.link
-        # Delete the created file and the corresponding entries.
-        os.unlink(self._entry_path(req.link))
-        self._entries.remove(req)
+        # Delete the created file and the corresponding entry.
+        os.unlink(self._entry_path(key))
+        del self._entries[key]
 
         logger.debug("Removed %s from build tracker %r", req, self._root)
 
     def cleanup(self) -> None:
-        for req in set(self._entries):
-            self.remove(req)
+        for key, req in list(self._entries.items()):
+            self.remove(req, key)
 
         logger.debug("Removed build tracker: %r", self._root)
 
     @contextlib.contextmanager
-    def track(self, req: InstallRequirement) -> Generator[None, None, None]:
-        self.add(req)
+    def track(self, req: InstallRequirement, key: str) -> Generator[None, None, None]:
+        """Ensure that `key` cannot install itself as a setup requirement.
+
+        :raises LookupError: If `key` was already provided in a parent invocation of
+                             the context introduced by this method."""
+        tracker_id = TrackerId(key)
+        self.add(req, tracker_id)
         yield
-        self.remove(req)
+        self.remove(req, tracker_id)

venv/Lib/site-packages/pip/_internal/operations/build/metadata.py

@@ -3,7 +3,7 @@
 
 import os
 
-from pip._vendor.pep517.wrappers import Pep517HookCaller
+from pip._vendor.pyproject_hooks import BuildBackendHookCaller
 
 from pip._internal.build_env import BuildEnvironment
 from pip._internal.exceptions import (
@@ -15,7 +15,7 @@ from pip._internal.utils.temp_dir import TempDirectory
 
 
 def generate_metadata(
-    build_env: BuildEnvironment, backend: Pep517HookCaller, details: str
+    build_env: BuildEnvironment, backend: BuildBackendHookCaller, details: str
 ) -> str:
     """Generate metadata using mechanisms described in PEP 517.
 
@@ -26,7 +26,7 @@ def generate_metadata(
     metadata_dir = metadata_tmpdir.path
 
     with build_env:
-        # Note that Pep517HookCaller implements a fallback for
+        # Note that BuildBackendHookCaller implements a fallback for
         # prepare_metadata_for_build_wheel, so we don't have to
         # consider the possibility that this hook doesn't exist.
         runner = runner_with_spinner_message("Preparing metadata (pyproject.toml)")

venv/Lib/site-packages/pip/_internal/operations/build/metadata_editable.py

@@ -3,7 +3,7 @@
 
 import os
 
-from pip._vendor.pep517.wrappers import Pep517HookCaller
+from pip._vendor.pyproject_hooks import BuildBackendHookCaller
 
 from pip._internal.build_env import BuildEnvironment
 from pip._internal.exceptions import (
@@ -15,7 +15,7 @@ from pip._internal.utils.temp_dir import TempDirectory
 
 
 def generate_editable_metadata(
-    build_env: BuildEnvironment, backend: Pep517HookCaller, details: str
+    build_env: BuildEnvironment, backend: BuildBackendHookCaller, details: str
 ) -> str:
     """Generate metadata using mechanisms described in PEP 660.
 
@@ -26,7 +26,7 @@ def generate_editable_metadata(
     metadata_dir = metadata_tmpdir.path
 
     with build_env:
-        # Note that Pep517HookCaller implements a fallback for
+        # Note that BuildBackendHookCaller implements a fallback for
         # prepare_metadata_for_build_wheel/editable, so we don't have to
         # consider the possibility that this hook doesn't exist.
         runner = runner_with_spinner_message(
@@ -38,4 +38,5 @@ def generate_editable_metadata(
             except InstallationSubprocessError as error:
                 raise MetadataGenerationFailed(package_details=details) from error
 
+    assert distinfo_dir is not None
     return os.path.join(metadata_dir, distinfo_dir)

venv/Lib/site-packages/pip/_internal/operations/build/metadata_legacy.py

@@ -27,7 +27,7 @@ def _find_egg_info(directory: str) -> str:
 
     if len(filenames) > 1:
         raise InstallationError(
-            "More than one .egg-info directory found in {}".format(directory)
+            f"More than one .egg-info directory found in {directory}"
         )
 
     return os.path.join(directory, filenames[0])

venv/Lib/site-packages/pip/_internal/operations/build/wheel.py

@@ -2,7 +2,7 @@ import logging
 import os
 from typing import Optional
 
-from pip._vendor.pep517.wrappers import Pep517HookCaller
+from pip._vendor.pyproject_hooks import BuildBackendHookCaller
 
 from pip._internal.utils.subprocess import runner_with_spinner_message
 
@@ -11,7 +11,7 @@ logger = logging.getLogger(__name__)
 
 def build_wheel_pep517(
     name: str,
-    backend: Pep517HookCaller,
+    backend: BuildBackendHookCaller,
     metadata_directory: str,
     tempd: str,
 ) -> Optional[str]:

venv/Lib/site-packages/pip/_internal/operations/build/wheel_editable.py

@@ -2,7 +2,7 @@ import logging
 import os
 from typing import Optional
 
-from pip._vendor.pep517.wrappers import HookMissing, Pep517HookCaller
+from pip._vendor.pyproject_hooks import BuildBackendHookCaller, HookMissing
 
 from pip._internal.utils.subprocess import runner_with_spinner_message
 
@@ -11,7 +11,7 @@ logger = logging.getLogger(__name__)
 
 def build_wheel_editable(
     name: str,
-    backend: Pep517HookCaller,
+    backend: BuildBackendHookCaller,
     metadata_directory: str,
     tempd: str,
 ) -> Optional[str]:

venv/Lib/site-packages/pip/_internal/operations/build/wheel_legacy.py

@@ -40,16 +40,16 @@ def get_legacy_build_wheel_path(
     # Sort for determinism.
     names = sorted(names)
     if not names:
-        msg = ("Legacy build of wheel for {!r} created no files.\n").format(name)
+        msg = f"Legacy build of wheel for {name!r} created no files.\n"
         msg += format_command_result(command_args, command_output)
         logger.warning(msg)
         return None
 
     if len(names) > 1:
         msg = (
-            "Legacy build of wheel for {!r} created more than one file.\n"
-            "Filenames (choosing first): {}\n"
-        ).format(name, names)
+            f"Legacy build of wheel for {name!r} created more than one file.\n"
+            f"Filenames (choosing first): {names}\n"
+        )
         msg += format_command_result(command_args, command_output)
         logger.warning(msg)