CVS commit: pkgsrc/www/py-django-import-export

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Sat Oct 24 09:40:06 UTC 2026

Modified Files:
        pkgsrc/www/py-django-import-export: Makefile distinfo

Log Message:
py-django-import-export: updated to 4.4.3

v4.4.3

* This release patches a denial-of-service vulnerability in :class:`~import_export.widgets.IntegerWidget`.

  ``IntegerWidget.clean()`` converted imported values using ``int(Decimal(value))`` with no bound on the
  value's magnitude.  A value written in exponent notation, such as ``1e1000000``, is cheap to parse as a
  ``Decimal`` but forces Python to expand every digit when converted to ``int``, a cost that grows
  superlinearly with the digit count.  A single such value could stall the importing process for several
  seconds while pinning a CPU core, and a file containing many such rows multiplied the cost.

  ``IntegerWidget`` is the default widget for all integer model fields, including the ``id`` column used by
  every resource that does not override ``import_id_fields``, so almost every import was affected.  The stall
  occurred during the initial dry run, before the confirmation step.  Python's
  ``sys.set_int_max_str_digits()`` limit did not protect this path, as it only guards conversions between
  ``int`` and ``str``, not ``Decimal.__int__``.

  This was an availability issue only.  The resulting integers exceed the range of any standard database
  integer column, so no data could be written or corrupted through this path.

  The fix rejects values whose magnitude exceeds ``sys.get_int_max_str_digits()`` digits (4300 by default)
  before the conversion is attempted.  Such values are now reported as row errors.  Values within the limit,
  including those in exponent notation such as ``1e5``, are unaffected, and no value a standard integer column
  could store is rejected.  All users are advised to upgrade.

  If you import integers larger than the default limit into a field that can store them, raise the limit with
  ``sys.set_int_max_str_digits()``; the widget honours the configured value.

  If you subclass :class:`~import_export.widgets.IntegerWidget` and override ``clean()``, you receive this fix
  automatically only if your override delegates to ``super().clean()``.  An override that reimplements the
  ``int(Decimal(...))`` conversion itself is not protected, and should apply the same magnitude check before
  converting.

  If you cannot upgrade, either of the following prevents the stall:

  - Set :ref:`IMPORT_EXPORT_IMPORT_PERMISSION_CODE` to restrict import access to trusted users.
  - Subclass :class:`~import_export.widgets.IntegerWidget`, override ``clean()`` to reject values whose
    magnitude exceeds a sensible bound before calling ``super().clean()``, and assign the subclass to the
    integer fields on your resources.  This suits deployments where all staff legitimately need import
    permission.


To generate a diff of this commit:
cvs rdiff -u -r1.49 -r1.50 pkgsrc/www/py-django-import-export/Makefile
cvs rdiff -u -r1.39 -r1.40 pkgsrc/www/py-django-import-export/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-django-import-export/Makefile
diff -u pkgsrc/www/py-django-import-export/Makefile:1.49 pkgsrc/www/py-django-import-export/Makefile:1.50
--- pkgsrc/www/py-django-import-export/Makefile:1.49    Fri Oct 16 19:44:25 2026
+++ pkgsrc/www/py-django-import-export/Makefile Sat Oct 24 09:40:06 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.49 2026/10/16 19:44:25 adam Exp $
+# $NetBSD: Makefile,v 1.50 2026/10/24 09:40:06 adam Exp $
 
-DISTNAME=      django_import_export-4.4.1
+DISTNAME=      django_import_export-4.4.3
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:S/_/-/g}
 CATEGORIES=    www python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=d/django-import-export/}

Index: pkgsrc/www/py-django-import-export/distinfo
diff -u pkgsrc/www/py-django-import-export/distinfo:1.39 pkgsrc/www/py-django-import-export/distinfo:1.40
--- pkgsrc/www/py-django-import-export/distinfo:1.39    Wed May 20 09:57:07 2026
+++ pkgsrc/www/py-django-import-export/distinfo Sat Oct 24 09:40:06 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.39 2026/05/20 09:57:07 adam Exp $
+$NetBSD: distinfo,v 1.40 2026/10/24 09:40:06 adam Exp $
 
-BLAKE2s (django_import_export-4.4.1.tar.gz) = 5a7474b82e4259e664361735a25bb932865cd8380ca0c95e950df4ced11adf74
-SHA512 (django_import_export-4.4.1.tar.gz) = 13ef89e9df799228969b63ca2dc17a5956b78774ee6760d25dc9f9dae6b09ca29c2e18d444620adda47fda20c584e21eec0ed3eb0d228df04c14844247502715
-Size (django_import_export-4.4.1.tar.gz) = 2238690 bytes
+BLAKE2s (django_import_export-4.4.3.tar.gz) = 40147e20b17e74bbad89243e8965e0758652a60c4f7f8ac3fe0ceee74f045723
+SHA512 (django_import_export-4.4.3.tar.gz) = 48c39beb089fb200af483a882f036d691112131fbadd6e7e8541e4d14ef91f771e4fe57a7c60960575bdd3b5a82f2b9f2570ac25c4029e614e69560ab07db1e1
+Size (django_import_export-4.4.3.tar.gz) = 2245841 bytes