Skip to content

Commit 78a0672

Browse files
Greg Gutheg-k
Greg Guthe
authored andcommitted
Update for v3.1.2 release
1 parent 7b625ff commit 78a0672

File tree

2 files changed

+36
-2
lines changed

2 files changed

+36
-2
lines changed

Diff for: CHANGES

+34
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,40 @@
11
Bleach changes
22
==============
33

4+
Version 3.1.2 (March 11th, 2020)
5+
--------------------------------
6+
7+
**Security fixes**
8+
9+
* ``bleach.clean`` behavior parsing embedded MathML and SVG content
10+
with RCDATA tags did not match browser behavior and could result in
11+
a mutation XSS.
12+
13+
Calls to ``bleach.clean`` with ``strip=False`` and ``math`` or
14+
``svg`` tags and one or more of the RCDATA tags ``script``,
15+
``noscript``, ``style``, ``noframes``, ``iframe``, ``noembed``, or
16+
``xmp`` in the allowed tags whitelist were vulnerable to a mutation
17+
XSS.
18+
19+
This security issue was confirmed in Bleach version v3.1.1. Earlier
20+
versions are likely affected too.
21+
22+
Anyone using Bleach <=v3.1.1 is encouraged to upgrade.
23+
24+
https://bugzilla.mozilla.org/show_bug.cgi?id=1621692
25+
26+
**Backwards incompatible changes**
27+
28+
None
29+
30+
**Features**
31+
32+
None
33+
34+
**Bug fixes**
35+
36+
None
37+
438
Version 3.1.1 (February 13th, 2020)
539
-----------------------------------
640

Diff for: bleach/__init__.py

+2-2
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,9 @@
1818

1919

2020
# yyyymmdd
21-
__releasedate__ = '20200213'
21+
__releasedate__ = '20200311'
2222
# x.y.z or x.y.z.dev0 -- semver
23-
__version__ = '3.1.1'
23+
__version__ = '3.1.2'
2424
VERSION = parse_version(__version__)
2525

2626

0 commit comments

Comments
 (0)