fix: patch bounded Python parser and TLS dependencies

tools/summarizer/tests/test_parser_security.py

@@ -0,0 +1,57 @@
+"""Bounded regressions for upload-parser advisories, without hostile large allocations."""
+
+import io
+import struct
+import subprocess
+import sys
+import zlib
+
+import pytest
+from PIL import Image
+
+
+def test_truncated_pdf_xref_finishes_without_exhausting_parser_timeout():
+    # GHSA-39mj-jf6j-2qj3: an incomplete xref's final short line must not spin.
+    script = """
+import io
+from pypdf import PdfReader
+from pypdf.errors import PdfReadError
+body = b'%PDF-1.0\\n 1 0 obj<</Type/Catalog/Pages 2 0 R>>endobj\\n 2 0 obj<</Type/Pages/Kids[]/Count 0>>endobj\\n'
+tail = b'\\n startxref\\n%d\\n%%%%EOF' % len(body)
+try:
+    PdfReader(io.BytesIO(body + b'xref\\n 0 3\\n 0000000000 65535 f \\n' + tail))
+except PdfReadError:
+    print('rejected')
+else:
+    raise AssertionError('Incomplete xref was accepted')
+"""
+    result = subprocess.run([sys.executable, "-c", script], capture_output=True, text=True, timeout=5)
+    assert result.returncode == 0, result.stderr
+    assert result.stdout.strip() == "rejected"
+
+
+def test_apng_rejects_oversized_canvas_before_background_allocation(monkeypatch):
+    # GHSA-5xm2-6676-qcp9, scaled to64 pixels so the RED case stays harmless.
+    def chunk(kind, data):
+        return struct.pack(">I", len(data)) + kind + data + struct.pack(">I", zlib.crc32(kind + data))
+
+    png = (
+        b"\x89PNG\r\n\x1a\n"
+        + chunk(b"IHDR", struct.pack(">IIBBBBB", 8, 8, 8, 6, 0, 0, 0))
+        + chunk(b"acTL", struct.pack(">II", 2, 0))
+        + chunk(b"fcTL", struct.pack(">IIIIIHHBB", 0, 1, 1, 0, 0, 1, 10, 1, 0))
+        + chunk(b"IDAT", zlib.compress(b"\x00\x00\x00\x00\x00"))
+        + chunk(b"IEND", b"")
+    )
+    monkeypatch.setattr(Image, "MAX_IMAGE_PIXELS", 16)
+    fills = []
+    original_fill = Image.core.fill
+
+    def record_fill(mode, size, *args):
+        fills.append(size)
+        return original_fill(mode, size, *args)
+
+    monkeypatch.setattr(Image.core, "fill", record_fill)
+    with pytest.raises(Image.DecompressionBombError):
+        Image.open(io.BytesIO(png))
+    assert (8, 8) not in fills, "An oversized canvas was allocated before bomb rejection"