File tree Expand file tree Collapse file tree 2 files changed +35
-2
lines changed Expand file tree Collapse file tree 2 files changed +35
-2
lines changed Original file line number Diff line number Diff line change 1
1
Bleach changes
2
2
==============
3
3
4
+ Version 3.1.4 (March 24th, 2020)
5
+ --------------------------------
6
+
7
+ **Security fixes**
8
+
9
+ * ``bleach.clean`` behavior parsing style attributes could result in a
10
+ regular expression denial of service (ReDoS).
11
+
12
+ Calls to ``bleach.clean`` with an allowed tag with an allowed
13
+ ``style`` attribute were vulnerable to ReDoS. For example,
14
+ ``bleach.clean(..., attributes={'a': ['style']})``.
15
+
16
+ This issue was confirmed in Bleach versions v3.1.3, v3.1.2, v3.1.1,
17
+ v3.1.0, v3.0.0, v2.1.4, and v2.1.3. Earlier versions used a similar
18
+ regular expression and should be considered vulnerable too.
19
+
20
+ Anyone using Bleach <=v3.1.3 is encouraged to upgrade.
21
+
22
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1623633
23
+
24
+ **Backwards incompatible changes**
25
+
26
+ * Style attributes with dashes, or single or double quoted values are
27
+ cleaned instead of passed through.
28
+
29
+ **Features**
30
+
31
+ None
32
+
33
+ **Bug fixes**
34
+
35
+ None
36
+
4
37
Version 3.1.3 (March 17th, 2020)
5
38
--------------------------------
6
39
Original file line number Diff line number Diff line change 18
18
19
19
20
20
# yyyymmdd
21
- __releasedate__ = '20200317 '
21
+ __releasedate__ = '20200324 '
22
22
# x.y.z or x.y.z.dev0 -- semver
23
- __version__ = '3.1.3 '
23
+ __version__ = '3.1.4 '
24
24
VERSION = parse_version (__version__ )
25
25
26
26
You can’t perform that action at this time.
0 commit comments