Subject: CVS commit: pkgsrc/www/py-bleach
From: Adam Ciarcinski
Date: 2020-03-18 11:08:16
Message id: 20200318100816.6656AFB27@cvs.NetBSD.org

Log Message:
py-bleach: updated to 3.1.3

Version 3.1.3:

**Features**

* Add relative link to code of conduct.
* Drop deprecated 'setup.py test' support.
* Fix typo: curren -> current in tests/test_clean.py
* Test on PyPy 7
* Drop test support for end of life Python 3.4

Version 3.1.2:

**Security fixes**

* ``bleach.clean`` behavior parsing embedded MathML and SVG content
  with RCDATA tags did not match browser behavior and could result in
  a mutation XSS.

  Calls to ``bleach.clean`` with ``strip=False`` and ``math`` or
  ``svg`` tags and one or more of the RCDATA tags ``script``,
  ``noscript``, ``style``, ``noframes``, ``iframe``, ``noembed``, or
  ``xmp`` in the allowed tags whitelist were vulnerable to a mutation
  XSS.

  This security issue was confirmed in Bleach version v3.1.1. Earlier
  versions are likely affected too.

Version 3.1.1:

**Security fixes**

* ``bleach.clean`` behavior parsing ``noscript`` tags did not match
  browser behavior.

  Calls to ``bleach.clean`` allowing ``noscript`` and one or more of
  the raw text tags (``title``, ``textarea``, ``script``, ``style``,
  ``noembed``, ``noframes``, ``iframe``, and ``xmp``) were vulnerable
  to a mutation XSS.

  This security issue was confirmed in Bleach versions v2.1.4, v3.0.2,
  and v3.1.0. Earlier versions are probably affected too.

Files:
RevisionActionfile
1.14modifypkgsrc/www/py-bleach/Makefile
1.12modifypkgsrc/www/py-bleach/distinfo