Subject: CVS commit: pkgsrc/security/py-mohawk
From: Adam Ciarcinski
Date: 2019-01-17 14:22:00
Message id: 20190117132200.DE41DFB16@cvs.NetBSD.org

Log Message:
py-mohawk: updated to 1.0.0

1.0.0:
Security related: Bewit MACs were not compared in constant time and were thus \ 
possibly circumventable by an attacker.
Breaking change: Escape characters in header values (such as a back slash) are \ 
no longer allowed, potentially breaking clients that depended on this behavior. \ 
See https://github.com/kumar303/mohawk/issues/34
A sender is allowed to omit the content hash as long as their request has no \ 
content. The mohawk.Receiver will skip the content hash check in this situation, \ 
regardless of the value of accept_untrusted_content. See Empty requests for more \ 
details.
Introduced max limit of 4096 characters in the Authorization header
Changed default values of content and content_type arguments to \ 
mohawk.base.EmptyValue in order to differentiate between misconfiguration and \ 
cases where these arguments are explicitly given as None (as with some web \ 
frameworks). See Skipping content checks for more details.
Failing to pass content and content_type arguments to mohawk.Receiver or \ 
mohawk.Sender.accept_response() without specifying accept_untrusted_content=True \ 
will now raise mohawk.exc.MissingContent instead of ValueError.

Files:
RevisionActionfile
1.2modifypkgsrc/security/py-mohawk/Makefile
1.2modifypkgsrc/security/py-mohawk/distinfo