python3Packages.js2py: remove

unmaintained and insecure: https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape
samueltardieu · Oct 18, 2024 · 0f79dd4 · 0f79dd4
1 parent cff2da8
commit 0f79dd4
Show file tree

Hide file tree

Showing 8 changed files with 26 additions and 82 deletions.
diff --git a/pkgs/applications/networking/pyload-ng/default.nix b/pkgs/applications/networking/pyload-ng/default.nix
@@ -30,25 +30,23 @@ python3.pkgs.buildPythonApplication rec {
     sed -i -E 's/([A-z0-9]*)~=[^;]*(.*)/\1\2/' setup.cfg
   '';
 
-  dependencies =
-    with python3.pkgs;
-    [
-      bitmath
-      certifi
-      cheroot
-      cryptography
-      filetype
-      flask
-      flask-babel
-      flask-caching
-      flask-compress
-      flask-session
-      flask-themes2
-      pycurl
-      semver
-      setuptools
-    ]
-    ++ (if pythonOlder "3.12" then [ js2py ] else [ dukpy ]);
+  dependencies = with python3.pkgs; [
+    bitmath
+    certifi
+    cheroot
+    cryptography
+    dukpy
+    filetype
+    flask
+    flask-babel
+    flask-caching
+    flask-compress
+    flask-session
+    flask-themes2
+    pycurl
+    semver
+    setuptools
+  ];
 
   optional-dependencies = {
     plugins = with python3.pkgs; [

diff --git a/pkgs/development/python-modules/django-js-reverse/default.nix b/pkgs/development/python-modules/django-js-reverse/default.nix
@@ -7,7 +7,6 @@
   django,
   packaging,
   nodejs,
-  js2py,
   six,
 }:
 
@@ -25,9 +24,11 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ django ] ++ lib.optionals (pythonAtLeast "3.7") [ packaging ];
 
+  # Js2py is needed for tests but it's unmaintained and insecure
+  doCheck = false;
+
   nativeCheckInputs = [
     nodejs
-    js2py
     six
   ];
 

diff --git a/pkgs/development/python-modules/js2py/default.nix b/pkgs/development/python-modules/js2py/default.nix
diff --git a/pkgs/development/python-modules/jupysql/default.nix b/pkgs/development/python-modules/jupysql/default.nix
@@ -22,7 +22,6 @@
   grpcio,
   ipython,
   ipywidgets,
-  js2py,
   matplotlib,
   numpy,
   pandas,
@@ -69,7 +68,6 @@ buildPythonPackage rec {
     grpcio
     ipython
     ipywidgets
-    js2py
     matplotlib
     numpy
     pandas
@@ -101,6 +99,9 @@ buildPythonPackage rec {
     "src/tests/test_plot.py"
     "src/tests/test_magic.py"
     "src/tests/test_magic_plot.py"
+
+    # require js2py (which is unmaintained and insecure)
+    "src/tests/test_widget.py"
   ];
 
   preCheck = ''

diff --git a/pkgs/development/python-modules/lark/default.nix b/pkgs/development/python-modules/lark/default.nix
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     "lark.grammars"
   ];
 
-  # Js2py is needed for tests but it's marked as insecure
+  # Js2py is needed for tests but it's unmaintained and insecure
   doCheck = false;
 
   meta = with lib; {

diff --git a/pkgs/development/python-modules/pyjsparser/default.nix b/pkgs/development/python-modules/pyjsparser/default.nix
@@ -3,7 +3,6 @@
   fetchFromGitHub,
   buildPythonPackage,
   pytestCheckHook,
-  js2py,
 }:
 
 let
@@ -21,18 +20,11 @@ let
 
     nativeCheckInputs = [
       pytestCheckHook
-      js2py
     ];
 
-    # escape infinite recursion with js2py
+    # js2py is needed for tests but it's unmaintained and insecure
     doCheck = false;
 
-    passthru.tests = {
-      check = pyjsparser.overridePythonAttrs (_: {
-        doCheck = true;
-      });
-    };
-
     pythonImportsCheck = [ "pyjsparser" ];
 
     meta = with lib; {

diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
@@ -286,6 +286,7 @@ mapAliases ({
   jinja2_pluralize = jinja2-pluralize; # added 2023-11-01
   jinja2_time = jinja2-time; # added 2022-11-07
   JPype1 = jpype1; # added 2023-02-19
+  js2py = throw "js2py has been removed, as it is unmaintained and insecure"; # added 2024-10-17
   jsonpath_rw = jsonpath-rw; # added 2024-01-06
   jsonschema_3 = throw "jsonschema 3 is neither the latest version nor needed inside nixpkgs anymore"; # added 2023-06-28
   jupyter_client = jupyter-client; # added 2021-10-15

diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
@@ -6476,8 +6476,6 @@ self: super: with self; {
     inherit (pkgs) jq;
   };
 
-  js2py = callPackage ../development/python-modules/js2py { };
-
   jsbeautifier = callPackage ../development/python-modules/jsbeautifier { };
 
   jschema-to-python = callPackage ../development/python-modules/jschema-to-python { };