Skip to content

Commit 6e74a50

Browse files
Greg Gutheg-k
authored andcommitted
Update for v3.1.4 release
1 parent d6018f2 commit 6e74a50

File tree

2 files changed

+35
-2
lines changed

2 files changed

+35
-2
lines changed

CHANGES

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,39 @@
11
Bleach changes
22
==============
33

4+
Version 3.1.4 (March 24th, 2020)
5+
--------------------------------
6+
7+
**Security fixes**
8+
9+
* ``bleach.clean`` behavior parsing style attributes could result in a
10+
regular expression denial of service (ReDoS).
11+
12+
Calls to ``bleach.clean`` with an allowed tag with an allowed
13+
``style`` attribute were vulnerable to ReDoS. For example,
14+
``bleach.clean(..., attributes={'a': ['style']})``.
15+
16+
This issue was confirmed in Bleach versions v3.1.3, v3.1.2, v3.1.1,
17+
v3.1.0, v3.0.0, v2.1.4, and v2.1.3. Earlier versions used a similar
18+
regular expression and should be considered vulnerable too.
19+
20+
Anyone using Bleach <=v3.1.3 is encouraged to upgrade.
21+
22+
https://bugzilla.mozilla.org/show_bug.cgi?id=1623633
23+
24+
**Backwards incompatible changes**
25+
26+
* Style attributes with dashes, or single or double quoted values are
27+
cleaned instead of passed through.
28+
29+
**Features**
30+
31+
None
32+
33+
**Bug fixes**
34+
35+
None
36+
437
Version 3.1.3 (March 17th, 2020)
538
--------------------------------
639

bleach/__init__.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,9 @@
1818

1919

2020
# yyyymmdd
21-
__releasedate__ = '20200317'
21+
__releasedate__ = '20200324'
2222
# x.y.z or x.y.z.dev0 -- semver
23-
__version__ = '3.1.3'
23+
__version__ = '3.1.4'
2424
VERSION = parse_version(__version__)
2525

2626

0 commit comments

Comments
 (0)