Received: by mail.netbsd.org (Postfix, from userid 605) id 990F184E87; Wed, 1 Feb 2023 12:36:08 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id CACDB84E71 for ; Wed, 1 Feb 2023 12:36:07 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([IPv6:::1]) by localhost (mail.netbsd.org [IPv6:::1]) (amavisd-new, port 10025) with ESMTP id nT6ETDPCVMlp for ; Wed, 1 Feb 2023 12:36:07 +0000 (UTC) Received: from cvs.NetBSD.org (ivanova.NetBSD.org [IPv6:2001:470:a085:999:28c:faff:fe03:5984]) by mail.netbsd.org (Postfix) with ESMTP id 458A584D17 for ; Wed, 1 Feb 2023 12:36:07 +0000 (UTC) Received: by cvs.NetBSD.org (Postfix, from userid 500) id 3CF22FA90; Wed, 1 Feb 2023 12:36:07 +0000 (UTC) Content-Transfer-Encoding: 7bit Content-Type: multipart/mixed; boundary="_----------=_1675254967248590" MIME-Version: 1.0 Date: Wed, 1 Feb 2023 12:36:07 +0000 From: "Nia Alarie" Subject: CVS commit: pkgsrc/www/lua-web-sanitize To: pkgsrc-changes@NetBSD.org Reply-To: nia@netbsd.org X-Mailer: log_accum Message-Id: <20230201123607.3CF22FA90@cvs.NetBSD.org> Sender: pkgsrc-changes-owner@NetBSD.org List-Id: Precedence: bulk List-Unsubscribe: This is a multi-part message in MIME format. --_----------=_1675254967248590 Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII" Module Name: pkgsrc Committed By: nia Date: Wed Feb 1 12:36:07 UTC 2023 Modified Files: pkgsrc/www/lua-web-sanitize: Makefile distinfo Log Message: lua-web-sanitize: update to 1.4.0 Stricter attribute value escaping This is a critical update if you are using a custom white list with iframe elements allowed. Due to their non-standard parsing within browsers it maybe be possible to craft HTML to bypass sanitization by using an element with an attribute value of a closing iframe tag. Those using the default whitelist are not affected. To generate a diff of this commit: cvs rdiff -u -r1.3 -r1.4 pkgsrc/www/lua-web-sanitize/Makefile cvs rdiff -u -r1.5 -r1.6 pkgsrc/www/lua-web-sanitize/distinfo Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. --_----------=_1675254967248590 Content-Disposition: inline Content-Length: 1630 Content-Transfer-Encoding: binary Content-Type: text/x-diff; charset=us-ascii Modified files: Index: pkgsrc/www/lua-web-sanitize/Makefile diff -u pkgsrc/www/lua-web-sanitize/Makefile:1.3 pkgsrc/www/lua-web-sanitize/Makefile:1.4 --- pkgsrc/www/lua-web-sanitize/Makefile:1.3 Wed Jul 13 08:44:24 2022 +++ pkgsrc/www/lua-web-sanitize/Makefile Wed Feb 1 12:36:06 2023 @@ -1,6 +1,6 @@ -# $NetBSD: Makefile,v 1.3 2022/07/13 08:44:24 nia Exp $ +# $NetBSD: Makefile,v 1.4 2023/02/01 12:36:06 nia Exp $ -DISTNAME= web_sanitize-1.3.0 +DISTNAME= web_sanitize-1.4.0 PKGNAME= ${LUA_PKGPREFIX}-${DISTNAME:S/_/-/g} CATEGORIES= www lua MASTER_SITES= ${MASTER_SITE_GITHUB:=leafo/} Index: pkgsrc/www/lua-web-sanitize/distinfo diff -u pkgsrc/www/lua-web-sanitize/distinfo:1.5 pkgsrc/www/lua-web-sanitize/distinfo:1.6 --- pkgsrc/www/lua-web-sanitize/distinfo:1.5 Wed Jul 13 08:44:24 2022 +++ pkgsrc/www/lua-web-sanitize/distinfo Wed Feb 1 12:36:06 2023 @@ -1,5 +1,5 @@ -$NetBSD: distinfo,v 1.5 2022/07/13 08:44:24 nia Exp $ +$NetBSD: distinfo,v 1.6 2023/02/01 12:36:06 nia Exp $ -BLAKE2s (web_sanitize-1.3.0.tar.gz) = 13a976c5121c181fbd00e41c75550d329e15e50b25a35168b6a3f472bcc426a1 -SHA512 (web_sanitize-1.3.0.tar.gz) = b842d4f2cc07bd3a4cda1c57ff8c8684c1318feb22673cfeaa5a0960e5801ec21f5b9a8c16832eeb8dad0954f9e87d241694789ccf431d69c0bb9fba01c81a64 -Size (web_sanitize-1.3.0.tar.gz) = 55057 bytes +BLAKE2s (web_sanitize-1.4.0.tar.gz) = ac1b0c4b22d52035f2b061231ed273174bee752707c9c16f1fd4cc7e5f1cbdc6 +SHA512 (web_sanitize-1.4.0.tar.gz) = 18a748df89eac379a10514947635688f9f34471174e182e25526e7959c1e83400c5aaa3b48f0ebd6348ea4cb07aad50809fecef803c226addc5a3d1d620ca86e +Size (web_sanitize-1.4.0.tar.gz) = 55489 bytes --_----------=_1675254967248590--