Voice et bot modif

venv/lib/python3.12/site-packages/pip/_vendor/cachecontrol/LICENSE.txt

@@ -1,13 +0,0 @@
-Copyright 2012-2021  Eric Larson
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.

venv/lib/python3.12/site-packages/pip/_vendor/cachecontrol/__init__.py

@@ -6,10 +6,9 @@
 
 Make it easy to import from cachecontrol without long namespaces.
 """
-
 __author__ = "Eric Larson"
 __email__ = "eric@ionrock.org"
-__version__ = "0.14.3"
+__version__ = "0.13.1"
 
 from pip._vendor.cachecontrol.adapter import CacheControlAdapter
 from pip._vendor.cachecontrol.controller import CacheController

venv/lib/python3.12/site-packages/pip/_vendor/cachecontrol/adapter.py

@@ -5,7 +5,6 @@ from __future__ import annotations
 
 import functools
 import types
-import weakref
 import zlib
 from typing import TYPE_CHECKING, Any, Collection, Mapping
 
@@ -78,7 +77,7 @@ class CacheControlAdapter(HTTPAdapter):
 
         return resp
 
-    def build_response(  # type: ignore[override]
+    def build_response(
         self,
         request: PreparedRequest,
         response: HTTPResponse,
@@ -126,31 +125,25 @@ class CacheControlAdapter(HTTPAdapter):
             else:
                 # Wrap the response file with a wrapper that will cache the
                 #   response when the stream has been consumed.
-                response._fp = CallbackFileWrapper(  # type: ignore[assignment]
-                    response._fp,  # type: ignore[arg-type]
+                response._fp = CallbackFileWrapper(  # type: ignore[attr-defined]
+                    response._fp,  # type: ignore[attr-defined]
                     functools.partial(
-                        self.controller.cache_response, request, weakref.ref(response)
+                        self.controller.cache_response, request, response
                     ),
                 )
                 if response.chunked:
-                    super_update_chunk_length = response.__class__._update_chunk_length
+                    super_update_chunk_length = response._update_chunk_length  # type: ignore[attr-defined]
 
-                    def _update_chunk_length(
-                        weak_self: weakref.ReferenceType[HTTPResponse],
-                    ) -> None:
-                        self = weak_self()
-                        if self is None:
-                            return
-
-                        super_update_chunk_length(self)
+                    def _update_chunk_length(self: HTTPResponse) -> None:
+                        super_update_chunk_length()
                         if self.chunk_left == 0:
-                            self._fp._close()  # type: ignore[union-attr]
+                            self._fp._close()  # type: ignore[attr-defined]
 
-                    response._update_chunk_length = functools.partial(  # type: ignore[method-assign]
-                        _update_chunk_length, weakref.ref(response)
+                    response._update_chunk_length = types.MethodType(  # type: ignore[attr-defined]
+                        _update_chunk_length, response
                     )
 
-        resp: Response = super().build_response(request, response)
+        resp: Response = super().build_response(request, response)  # type: ignore[no-untyped-call]
 
         # See if we should invalidate the cache.
         if request.method in self.invalidating_methods and resp.ok:

venv/lib/python3.12/site-packages/pip/_vendor/cachecontrol/cache.py

@@ -6,7 +6,6 @@
 The cache object API for implementing caches. The default is a thread
 safe in-memory dictionary.
 """
-
 from __future__ import annotations
 
 from threading import Lock

venv/lib/python3.12/site-packages/pip/_vendor/cachecontrol/caches/file_cache.py

@@ -5,10 +5,8 @@ from __future__ import annotations
 
 import hashlib
 import os
-import tempfile
 from textwrap import dedent
 from typing import IO, TYPE_CHECKING
-from pathlib import Path
 
 from pip._vendor.cachecontrol.cache import BaseCache, SeparateBodyBaseCache
 from pip._vendor.cachecontrol.controller import CacheController
@@ -19,12 +17,53 @@ if TYPE_CHECKING:
     from filelock import BaseFileLock
 
 
+def _secure_open_write(filename: str, fmode: int) -> IO[bytes]:
+    # We only want to write to this file, so open it in write only mode
+    flags = os.O_WRONLY
+
+    # os.O_CREAT | os.O_EXCL will fail if the file already exists, so we only
+    #  will open *new* files.
+    # We specify this because we want to ensure that the mode we pass is the
+    # mode of the file.
+    flags |= os.O_CREAT | os.O_EXCL
+
+    # Do not follow symlinks to prevent someone from making a symlink that
+    # we follow and insecurely open a cache file.
+    if hasattr(os, "O_NOFOLLOW"):
+        flags |= os.O_NOFOLLOW
+
+    # On Windows we'll mark this file as binary
+    if hasattr(os, "O_BINARY"):
+        flags |= os.O_BINARY
+
+    # Before we open our file, we want to delete any existing file that is
+    # there
+    try:
+        os.remove(filename)
+    except OSError:
+        # The file must not exist already, so we can just skip ahead to opening
+        pass
+
+    # Open our file, the use of os.O_CREAT | os.O_EXCL will ensure that if a
+    # race condition happens between the os.remove and this line, that an
+    # error will be raised. Because we utilize a lockfile this should only
+    # happen if someone is attempting to attack us.
+    fd = os.open(filename, flags, fmode)
+    try:
+        return os.fdopen(fd, "wb")
+
+    except:
+        # An error occurred wrapping our FD in a file object
+        os.close(fd)
+        raise
+
+
 class _FileCacheMixin:
     """Shared implementation for both FileCache variants."""
 
     def __init__(
         self,
-        directory: str | Path,
+        directory: str,
         forever: bool = False,
         filemode: int = 0o0600,
         dirmode: int = 0o0700,
@@ -40,7 +79,7 @@ class _FileCacheMixin:
                 """
             NOTE: In order to use the FileCache you must have
             filelock installed. You can install it via pip:
-              pip install cachecontrol[filecache]
+              pip install filelock
             """
             )
             raise ImportError(notice)
@@ -82,18 +121,15 @@ class _FileCacheMixin:
         Safely write the data to the given path.
         """
         # Make sure the directory exists
-        dirname = os.path.dirname(path)
-        os.makedirs(dirname, self.dirmode, exist_ok=True)
+        try:
+            os.makedirs(os.path.dirname(path), self.dirmode)
+        except OSError:
+            pass
 
         with self.lock_class(path + ".lock"):
             # Write our actual file
-            (fd, name) = tempfile.mkstemp(dir=dirname)
-            try:
-                os.write(fd, data)
-            finally:
-                os.close(fd)
-            os.chmod(name, self.filemode)
-            os.replace(name, path)
+            with _secure_open_write(path, self.filemode) as fh:
+                fh.write(data)
 
     def _delete(self, key: str, suffix: str) -> None:
         name = self._fn(key) + suffix

venv/lib/python3.12/site-packages/pip/_vendor/cachecontrol/controller.py

@@ -5,14 +5,12 @@
 """
 The httplib2 algorithms ported for use with requests.
 """
-
 from __future__ import annotations
 
 import calendar
 import logging
 import re
 import time
-import weakref
 from email.utils import parsedate_tz
 from typing import TYPE_CHECKING, Collection, Mapping
 
@@ -144,11 +142,6 @@ class CacheController:
         """
         Load a cached response, or return None if it's not available.
         """
-        # We do not support caching of partial content: so if the request contains a
-        # Range header then we don't want to load anything from the cache.
-        if "Range" in request.headers:
-            return None
-
         cache_url = request.url
         assert cache_url is not None
         cache_data = self.cache.get(cache_url)
@@ -324,7 +317,7 @@ class CacheController:
     def cache_response(
         self,
         request: PreparedRequest,
-        response_or_ref: HTTPResponse | weakref.ReferenceType[HTTPResponse],
+        response: HTTPResponse,
         body: bytes | None = None,
         status_codes: Collection[int] | None = None,
     ) -> None:
@@ -333,16 +326,6 @@ class CacheController:
 
         This assumes a requests Response object.
         """
-        if isinstance(response_or_ref, weakref.ReferenceType):
-            response = response_or_ref()
-            if response is None:
-                # The weakref can be None only in case the user used streamed request
-                # and did not consume or close it, and holds no reference to requests.Response.
-                # In such case, we don't want to cache the response.
-                return
-        else:
-            response = response_or_ref
-
         # From httplib2: Don't cache 206's since we aren't going to
         #                handle byte range requests
         cacheable_status_codes = status_codes or self.cacheable_status_codes
@@ -497,7 +480,7 @@ class CacheController:
         cached_response.headers.update(
             {
                 k: v
-                for k, v in response.headers.items()
+                for k, v in response.headers.items()  # type: ignore[no-untyped-call]
                 if k.lower() not in excluded_headers
             }
         )

venv/lib/python3.12/site-packages/pip/_vendor/cachecontrol/filewrapper.py

@@ -38,10 +38,10 @@ class CallbackFileWrapper:
         self.__callback = callback
 
     def __getattr__(self, name: str) -> Any:
-        # The vagaries of garbage collection means that self.__fp is
+        # The vaguaries of garbage collection means that self.__fp is
         # not always set.  By using __getattribute__ and the private
         # name[0] allows looking up the attribute value and raising an
-        # AttributeError when it doesn't exist. This stop things from
+        # AttributeError when it doesn't exist. This stop thigns from
         # infinitely recursing calls to getattr in the case where
         # self.__fp hasn't been set.
         #

venv/lib/python3.12/site-packages/pip/_vendor/cachecontrol/heuristics.py

@@ -68,10 +68,7 @@ class OneDayCache(BaseHeuristic):
 
         if "expires" not in response.headers:
             date = parsedate(response.headers["date"])
-            expires = expire_after(
-                timedelta(days=1),
-                date=datetime(*date[:6], tzinfo=timezone.utc),  # type: ignore[index,misc]
-            )
+            expires = expire_after(timedelta(days=1), date=datetime(*date[:6], tzinfo=timezone.utc))  # type: ignore[misc]
             headers["expires"] = datetime_to_header(expires)
             headers["cache-control"] = "public"
         return headers

venv/lib/python3.12/site-packages/pip/_vendor/cachecontrol/serialize.py

@@ -32,13 +32,13 @@ class Serializer:
             # also update the response with a new file handler to be
             # sure it acts as though it was never read.
             body = response.read(decode_content=False)
-            response._fp = io.BytesIO(body)  # type: ignore[assignment]
+            response._fp = io.BytesIO(body)  # type: ignore[attr-defined]
             response.length_remaining = len(body)
 
         data = {
             "response": {
                 "body": body,  # Empty bytestring if body is stored separately
-                "headers": {str(k): str(v) for k, v in response.headers.items()},
+                "headers": {str(k): str(v) for k, v in response.headers.items()},  # type: ignore[no-untyped-call]
                 "status": response.status,
                 "version": response.version,
                 "reason": str(response.reason),
@@ -72,13 +72,30 @@ class Serializer:
         if not data:
             return None
 
-        # Previous versions of this library supported other serialization
-        # formats, but these have all been removed.
-        if not data.startswith(f"cc={self.serde_version},".encode()):
-            return None
+        # Determine what version of the serializer the data was serialized
+        # with
+        try:
+            ver, data = data.split(b",", 1)
+        except ValueError:
+            ver = b"cc=0"
 
-        data = data[5:]
-        return self._loads_v4(request, data, body_file)
+        # Make sure that our "ver" is actually a version and isn't a false
+        # positive from a , being in the data stream.
+        if ver[:3] != b"cc=":
+            data = ver + data
+            ver = b"cc=0"
+
+        # Get the version number out of the cc=N
+        verstr = ver.split(b"=", 1)[-1].decode("ascii")
+
+        # Dispatch to the actual load method for the given version
+        try:
+            return getattr(self, f"_loads_v{verstr}")(request, data, body_file)  # type: ignore[no-any-return]
+
+        except AttributeError:
+            # This is a version we don't have a loads function for, so we'll
+            # just treat it as a miss and return None
+            return None
 
     def prepare_response(
         self,
@@ -132,6 +149,49 @@ class Serializer:
 
         return HTTPResponse(body=body, preload_content=False, **cached["response"])
 
+    def _loads_v0(
+        self,
+        request: PreparedRequest,
+        data: bytes,
+        body_file: IO[bytes] | None = None,
+    ) -> None:
+        # The original legacy cache data. This doesn't contain enough
+        # information to construct everything we need, so we'll treat this as
+        # a miss.
+        return None
+
+    def _loads_v1(
+        self,
+        request: PreparedRequest,
+        data: bytes,
+        body_file: IO[bytes] | None = None,
+    ) -> HTTPResponse | None:
+        # The "v1" pickled cache format. This is no longer supported
+        # for security reasons, so we treat it as a miss.
+        return None
+
+    def _loads_v2(
+        self,
+        request: PreparedRequest,
+        data: bytes,
+        body_file: IO[bytes] | None = None,
+    ) -> HTTPResponse | None:
+        # The "v2" compressed base64 cache format.
+        # This has been removed due to age and poor size/performance
+        # characteristics, so we treat it as a miss.
+        return None
+
+    def _loads_v3(
+        self,
+        request: PreparedRequest,
+        data: bytes,
+        body_file: IO[bytes] | None = None,
+    ) -> None:
+        # Due to Python 2 encoding issues, it's impossible to know for sure
+        # exactly how to load v3 entries, thus we'll treat these as a miss so
+        # that they get rewritten out as v4 entries.
+        return None
+
     def _loads_v4(
         self,
         request: PreparedRequest,