Merge PR "[AUTO-CHERRYPICK] [AutoPR- Security] Patch python-click for CVE-2026-7246 [HIGH] - branch 3.0-dev" microsoft#17405

Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
Co-authored-by: akhila-guruju <v-guakhila@microsoft.com>
Co-authored-by: jslobodzian <joslobo@microsoft.com>

Author: 4 people

SPECS/python-click/CVE-2026-7246.patch

@@ -0,0 +1,328 @@
+From b96c2601af4e01341b4d2c0db494ebee4aef8f42 Mon Sep 17 00:00:00 2001
+From: Kevin Deldycke <kevin@deldycke.com>
+Date: Wed, 4 Mar 2026 14:51:58 +0400
+Subject: [PATCH] Document and fix command string sanitizing with `shlex.split`
+
+Removes last use of `shell=True` use for command invokation for defense-in-depth.
+Refs: #1026, #1477 and #2775
+
+Modified to apply to Azure Linux.
+Refactored code in `_pipepager` and `_tempfilepager` to accept a list of command parts instead of a string,
+and added `shlex.split` to `pager` and `Editor.edit_file` to split the command string into parts.
+Refactored tests as per the existing `Editor.edit_file` API usage.
+
+Upstream Patch reference: https://github.com/pallets/click/commit/b96c2601af4e01341b4d2c0db494ebee4aef8f42.patch
+---
+ src/click/_termui_impl.py | 102 +++++++++++++++++++++++++--------
+ tests/test_termui.py      | 115 ++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 193 insertions(+), 24 deletions(-)
+
+diff --git a/src/click/_termui_impl.py b/src/click/_termui_impl.py
+index f744657..3610619 100644
+--- a/src/click/_termui_impl.py
++++ b/src/click/_termui_impl.py
+@@ -358,7 +358,21 @@ class ProgressBar(t.Generic[V]):
+ 
+ 
+ def pager(generator: t.Iterable[str], color: t.Optional[bool] = None) -> None:
+-    """Decide what method to use for paging through text."""
++    """Decide what method to use for paging through text.
++
++    The ``PAGER`` environment variable is split into an ``argv`` list with
++    :func:`shlex.split` in its default POSIX mode so that quotes are
++    stripped from tokens and quoted Windows paths are preserved.
++
++    .. note::
++        ``posix=False`` `was considered but rejected
++        <https://github.com/pallets/click/pull/1477#issuecomment-620231711>`_
++        because it retains quote characters in tokens. The
++        :func:`shlex.quote` approach was also reverted in :pr:`1543`.
++
++    .. seealso::
++        :issue:`1026`, :pr:`1477` and :pr:`2775`.
++    """
+     stdout = _default_text_stdout()
+ 
+     # There are no standard streams attached to write to. For example,
+@@ -368,17 +382,18 @@ def pager(generator: t.Iterable[str], color: t.Optional[bool] = None) -> None:
+ 
+     if not isatty(sys.stdin) or not isatty(stdout):
+         return _nullpager(stdout, generator, color)
+-    pager_cmd = (os.environ.get("PAGER", None) or "").strip()
+-    if pager_cmd:
++    import shlex
++    pager_cmd_parts = shlex.split(os.environ.get("PAGER", ""))
++    if pager_cmd_parts:
+         if WIN:
+-            return _tempfilepager(generator, pager_cmd, color)
+-        return _pipepager(generator, pager_cmd, color)
++            return _tempfilepager(generator, pager_cmd_parts, color)
++        return _pipepager(generator, pager_cmd_parts, color)
+     if os.environ.get("TERM") in ("dumb", "emacs"):
+         return _nullpager(stdout, generator, color)
+     if WIN or sys.platform.startswith("os2"):
+-        return _tempfilepager(generator, "more <", color)
++        return _tempfilepager(generator, ["more"], color)
+     if hasattr(os, "system") and os.system("(less) 2>/dev/null") == 0:
+-        return _pipepager(generator, "less", color)
++        return _pipepager(generator, ["less"], color)
+ 
+     import tempfile
+ 
+@@ -392,26 +407,38 @@ def pager(generator: t.Iterable[str], color: t.Optional[bool] = None) -> None:
+         os.unlink(filename)
+ 
+ 
+-def _pipepager(generator: t.Iterable[str], cmd: str, color: t.Optional[bool]) -> None:
+-    """Page through text by feeding it to another program.  Invoking a
+-    pager through this might support colors.
++def _pipepager(generator: t.Iterable[str], cmd_parts: t.List[str], color: t.Optional[bool]) -> None:
++    """Page through text by feeding it to another program.
++
++    Invokes the pager via subprocess with an argv list. If piping to
++    ``less`` and the user hasn't decided on colors, ``LESS=-R`` is set
++    automatically.
+     """
+     import subprocess
++    import shutil
+ 
+     env = dict(os.environ)
+ 
+     # If we're piping to less we might support colors under the
+     # condition that
+-    cmd_detail = cmd.rsplit("/", 1)[-1].split()
+-    if color is None and cmd_detail[0] == "less":
+-        less_flags = f"{os.environ.get('LESS', '')}{' '.join(cmd_detail[1:])}"
+-        if not less_flags:
+-            env["LESS"] = "-R"
+-            color = True
+-        elif "r" in less_flags or "R" in less_flags:
+-            color = True
+-
+-    c = subprocess.Popen(cmd, shell=True, stdin=subprocess.PIPE, env=env)
++    if cmd_parts:
++        cmd_name = os.path.basename(cmd_parts[0])
++        if color is None and cmd_name == "less":
++            less_flags = f"{os.environ.get('LESS', '')}{' '.join(cmd_parts[1:])}"
++            if not less_flags:
++                env["LESS"] = "-R"
++                color = True
++            elif "r" in less_flags or "R" in less_flags:
++                color = True
++
++    # Resolve command to absolute path for Windows compatibility
++    if cmd_parts:
++        resolved = shutil.which(cmd_parts[0]) or cmd_parts[0]
++        args = [resolved] + cmd_parts[1:]
++    else:
++        args = cmd_parts
++
++    c = subprocess.Popen(args=args, stdin=subprocess.PIPE, env=env)
+     stdin = t.cast(t.BinaryIO, c.stdin)
+     encoding = get_best_encoding(stdin)
+     try:
+@@ -443,10 +470,21 @@ def _pipepager(generator: t.Iterable[str], cmd: str, color: t.Optional[bool]) ->
+ 
+ 
+ def _tempfilepager(
+-    generator: t.Iterable[str], cmd: str, color: t.Optional[bool]
++    generator: t.Iterable[str], cmd_parts: t.List[str], color: t.Optional[bool]
+ ) -> None:
+-    """Page through text by invoking a program on a temporary file."""
++    """Page through text by invoking a program on a temporary file.
++
++    Used as the primary pager strategy on Windows (where piping to
++    ``more`` adds spurious ``\r\n``), and as a fallback on other
++    platforms. The command is resolved to an absolute path with
++    :func:`shutil.which`.
++
++    Returns ``True`` if the command was found and executed, ``False``
++    otherwise so another pager can be attempted.
++    """
+     import tempfile
++    import subprocess
++    import shutil
+ 
+     fd, filename = tempfile.mkstemp()
+     # TODO: This never terminates if the passed generator never terminates.
+@@ -457,7 +495,14 @@ def _tempfilepager(
+     with open_stream(filename, "wb")[0] as f:
+         f.write(text.encode(encoding))
+     try:
+-        os.system(f'{cmd} "{filename}"')
++        resolved = shutil.which(cmd_parts[0]) if cmd_parts else None
++        if not resolved:
++            return
++        args = [resolved] + cmd_parts[1:] + [filename]
++        subprocess.Popen(args=args).wait()
++    except OSError:
++        # Command not found
++        pass
+     finally:
+         os.close(fd)
+         os.unlink(filename)
+@@ -501,6 +546,15 @@ class Editor:
+         return "vi"
+ 
+     def edit_file(self, filename: str) -> None:
++        """Open files in the user's editor.
++
++        The editor command is split into an ``argv`` list with
++        :func:`shlex.split` in POSIX mode; see :func:`pager` for rationale.
++
++        .. seealso::
++            :issue:`1026` and :pr:`1477`.
++        """
++        import shlex
+         import subprocess
+ 
+         editor = self.get_editor()
+@@ -511,7 +565,7 @@ class Editor:
+             environ.update(self.env)
+ 
+         try:
+-            c = subprocess.Popen(f'{editor} "{filename}"', env=environ, shell=True)
++            c = subprocess.Popen(args=shlex.split(editor) + [filename], env=environ)
+             exit_code = c.wait()
+             if exit_code != 0:
+                 raise ClickException(
+diff --git a/tests/test_termui.py b/tests/test_termui.py
+index 7cfa939..e6390d6 100644
+--- a/tests/test_termui.py
++++ b/tests/test_termui.py
+@@ -1,10 +1,12 @@
+ import platform
+ import time
++from unittest.mock import patch
+ 
+ import pytest
+ 
+ import click._termui_impl
+ from click._compat import WIN
++from click._termui_impl import Editor
+ 
+ 
+ class FakeClock:
+@@ -368,6 +370,119 @@ def test_fast_edit(runner):
+     result = click.edit("a\nb", editor="sed -i~ 's/$/Test/'")
+     assert result == "aTest\nbTest\n"
+ 
++@pytest.mark.parametrize(
++    ("editor_cmd", "filename", "expected_args"),
++    [
++        pytest.param(
++            "myeditor --wait --flag",
++            "file1.txt",
++            ["myeditor", "--wait", "--flag", "file1.txt"],
++            id="editor with args",
++        ),
++        pytest.param(
++            "vi",
++            'file"; rm -rf / ; echo "',
++            ["vi", 'file"; rm -rf / ; echo "'],
++            id="shell metacharacters in filename",
++        ),
++        # Issue #1026: editor path with spaces must be quoted.
++        pytest.param(
++            '"C:\\Program Files\\Sublime Text 3\\sublime_text.exe"',
++            "f.txt",
++            ["C:\\Program Files\\Sublime Text 3\\sublime_text.exe", "f.txt"],
++            id="quoted windows path with spaces (issue 1026)",
++        ),
++        # PR #1477: pager/editor command with flags, like ``less -FRSX``.
++        pytest.param(
++            "less -FRSX",
++            "f.txt",
++            ["less", "-FRSX", "f.txt"],
++            id="command with flags (pr 1477)",
++        ),
++        # Issue #1026: quoted command with ``--wait`` flag.
++        pytest.param(
++            '"my command" --option value arg',
++            "f.txt",
++            ["my command", "--option", "value", "arg", "f.txt"],
++            id="quoted command with args (issue 1026)",
++        ),
++        # PR #1477: unquoted unix path.
++        pytest.param(
++            "/usr/bin/vim",
++            "f.txt",
++            ["/usr/bin/vim", "f.txt"],
++            id="unix absolute path",
++        ),
++        # Issue #1026: macOS path with escaped space.
++        pytest.param(
++            "/Applications/Sublime\\ Text.app/Contents/SharedSupport/bin/subl",
++            "f.txt",
++            ["/Applications/Sublime Text.app/Contents/SharedSupport/bin/subl", "f.txt"],
++            id="escaped space in unix path (issue 1026)",
++        ),
++    ],
++)
++def test_editor_path_normalization(editor_cmd, filename, expected_args):
++    with patch("subprocess.Popen") as mock_popen:
++        mock_popen.return_value.wait.return_value = 0
++        Editor(editor=editor_cmd).edit_file(filename)
++
++        mock_popen.assert_called_once()
++        args = mock_popen.call_args[1].get("args") or mock_popen.call_args[0][0]
++        assert args == expected_args
++        assert mock_popen.call_args[1].get("shell") is None
++
++
++@pytest.mark.skipif(not WIN, reason="Windows-specific editor paths")
++@pytest.mark.parametrize(
++    ("editor_cmd", "expected_cmd"),
++    [
++        pytest.param(
++            "notepad",
++            ["notepad"],
++            id="plain notepad",
++        ),
++        pytest.param(
++            '"C:\\Program Files\\Sublime Text 3\\sublime_text.exe" --wait',
++            ["C:\\Program Files\\Sublime Text 3\\sublime_text.exe", "--wait"],
++            id="quoted path with flag",
++        ),
++    ],
++)
++def test_editor_windows_path_normalization(editor_cmd, expected_cmd):
++    """Windows-specific tests: verify ``Popen`` receives unquoted paths that
++    ``subprocess.list2cmdline`` can re-quote for ``CreateProcess``."""
++    with patch("subprocess.Popen") as mock_popen:
++        mock_popen.return_value.wait.return_value = 0
++        Editor(editor=editor_cmd).edit_file("f.txt")
++
++        args = mock_popen.call_args[1].get("args") or mock_popen.call_args[0][0]
++        assert args == expected_cmd + ["f.txt"]
++        assert mock_popen.call_args[1].get("shell") is None
++
++
++def test_editor_env_passed_through():
++    with patch("subprocess.Popen") as mock_popen:
++        mock_popen.return_value.wait.return_value = 0
++        Editor(editor="vi", env={"MY_VAR": "1"}).edit_file("f.txt")
++
++        env = mock_popen.call_args[1].get("env")
++        assert env is not None
++        assert env["MY_VAR"] == "1"
++
++
++def test_editor_failure_exception():
++    with patch("subprocess.Popen") as mock_popen:
++        mock_popen.return_value.wait.return_value = 1
++        with pytest.raises(click.ClickException, match="Editing failed"):
++            Editor(editor="vi").edit_file("f.txt")
++
++
++def test_editor_nonexistent_exception():
++    with patch("subprocess.Popen", side_effect=OSError("not found")):
++        with pytest.raises(click.ClickException, match="not found"):
++            Editor(editor="nonexistent").edit_file("f.txt")
++
+ 
+ @pytest.mark.parametrize(
+     ("prompt_required", "required", "args", "expect"),
+-- 
+2.43.0
+

SPECS/python-click/python-click.spec

@@ -8,12 +8,13 @@ comes with good defaults out of the box.
 Summary:        Simple wrapper around optparse for powerful command line utilities
 Name:           python-%{pypi_name}
 Version:        8.1.7
-Release:        2%{?dist}
+Release:        3%{?dist}
 License:        BSD-3-Clause
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
 URL:            https://github.com/mitsuhiko/click
 Source0:        https://github.com/mitsuhiko/click/archive/%{version}/%{name}-%{version}.tar.gz
+Patch0:         CVE-2026-7246.patch
 BuildArch:      noarch
 %if 0%{?with_check}
 BuildRequires:  python3-pip
@@ -50,6 +51,9 @@ pytest -v tests
 %{python3_sitelib}/%{pypi_name}-*.egg-info/
 
 %changelog
+* Mon May 18 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 8.1.7-3
+- Patch for CVE-2026-7246
+
 * Wed May 28 2025 Riken Maharjan <rmaharjan@microsoft.com> - 8.1.7-2
 - Fix Ptest by using ptest version above 7.4.0. Use system pytest.