File CVE-2026-2297-SourcelessFileLoader-io_open_code.patch of Package python314

From 4ce6b1be9c5c81ce46f23140603b5de7d6b7812d Mon Sep 17 00:00:00 2001
From: Steve Dower <steve.dower@python.org>
Date: Wed, 4 Mar 2026 19:55:52 +0000
Subject: [PATCH] gh-145506: Fixes CVE-2026-2297 by ensuring
 SourcelessFileLoader uses io.open_code (GH-145507) (cherry picked from commit
 a51b1b512de1d56b3714b65628a2eae2b07e535e)

Co-authored-by: Steve Dower <steve.dower@python.org>
---
 Lib/importlib/_bootstrap_external.py                                     |    2 +-
 Misc/NEWS.d/next/Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst |    2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)
 create mode 100644 Misc/NEWS.d/next/Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst

Index: Python-3.14.3/Lib/importlib/_bootstrap_external.py
===================================================================
--- Python-3.14.3.orig/Lib/importlib/_bootstrap_external.py	2026-03-13 19:20:04.870121875 +0100
+++ Python-3.14.3/Lib/importlib/_bootstrap_external.py	2026-03-13 19:20:11.591272163 +0100
@@ -946,7 +946,7 @@
 
     def get_data(self, path):
         """Return the data from path as raw bytes."""
-        if isinstance(self, (SourceLoader, ExtensionFileLoader)):
+        if isinstance(self, (SourceLoader, SourcelessFileLoader, ExtensionFileLoader)):
             with _io.open_code(str(path)) as file:
                 return file.read()
         else:
Index: Python-3.14.3/Misc/NEWS.d/next/Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ Python-3.14.3/Misc/NEWS.d/next/Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst	2026-03-13 19:20:11.591522695 +0100
@@ -0,0 +1,2 @@
+Fixes :cve:`2026-2297` by ensuring that ``SourcelessFileLoader`` uses
+:func:`io.open_code` when opening ``.pyc`` files.