Skip to content

Commit

Permalink
Update for v3.1.2 release
Browse files Browse the repository at this point in the history
  • Loading branch information
Greg Guthe authored and g-k committed Mar 17, 2020
1 parent 3f39d48 commit 59cc502
Show file tree
Hide file tree
Showing 2 changed files with 36 additions and 2 deletions.
34 changes: 34 additions & 0 deletions CHANGES
Original file line number Diff line number Diff line change
@@ -1,6 +1,40 @@
Bleach changes
==============

Version 3.1.2 (March 11th, 2020)
--------------------------------

**Security fixes**

* ``bleach.clean`` behavior parsing embedded MathML and SVG content
with RCDATA tags did not match browser behavior and could result in
a mutation XSS.

Calls to ``bleach.clean`` with ``strip=False`` and ``math`` or
``svg`` tags and one or more of the RCDATA tags ``script``,
``noscript``, ``style``, ``noframes``, ``iframe``, ``noembed``, or
``xmp`` in the allowed tags whitelist were vulnerable to a mutation
XSS.

This security issue was confirmed in Bleach version v3.1.1. Earlier
versions are likely affected too.

Anyone using Bleach <=v3.1.1 is encouraged to upgrade.

https://bugzilla.mozilla.org/show_bug.cgi?id=1621692

**Backwards incompatible changes**

None

**Features**

None

**Bug fixes**

None

Version 3.1.1 (February 13th, 2020)
-----------------------------------

Expand Down
4 changes: 2 additions & 2 deletions bleach/__init__.py
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,9 @@


# yyyymmdd
__releasedate__ = '20200213'
__releasedate__ = '20200311'
# x.y.z or x.y.z.dev0 -- semver
__version__ = '3.1.1'
__version__ = '3.1.2'
VERSION = parse_version(__version__)


Expand Down

0 comments on commit 59cc502

Please sign in to comment.