Path to this page:
Subject: CVS commit: pkgsrc/security/py-mohawk
From: Adam Ciarcinski
Date: 2019-01-17 14:22:00
Message id: 20190117132200.DE41DFB16@cvs.NetBSD.org
Log Message:
py-mohawk: updated to 1.0.0
1.0.0:
Security related: Bewit MACs were not compared in constant time and were thus \
possibly circumventable by an attacker.
Breaking change: Escape characters in header values (such as a back slash) are \
no longer allowed, potentially breaking clients that depended on this behavior. \
See https://github.com/kumar303/mohawk/issues/34
A sender is allowed to omit the content hash as long as their request has no \
content. The mohawk.Receiver will skip the content hash check in this situation, \
regardless of the value of accept_untrusted_content. See Empty requests for more \
details.
Introduced max limit of 4096 characters in the Authorization header
Changed default values of content and content_type arguments to \
mohawk.base.EmptyValue in order to differentiate between misconfiguration and \
cases where these arguments are explicitly given as None (as with some web \
frameworks). See Skipping content checks for more details.
Failing to pass content and content_type arguments to mohawk.Receiver or \
mohawk.Sender.accept_response() without specifying accept_untrusted_content=True \
will now raise mohawk.exc.MissingContent instead of ValueError.
Files: