Update bleach to 6.2.0 #812

pyup-bot · 2024-10-29T19:45:26Z

This PR updates bleach from 3.1.0 to 6.2.0.

Changelog

6.2.0

----------------------------------
**Backwards incompatible changes**

* Dropped support for Python 3.8. (737)

**Security fixes**

None

**Bug fixes**

* Add support for Python 3.13. (736)
* Remove six depdenncy. (618)
* Update known-good versions for tinycss2. (732)
* Fix additional &lt; followed by characters and EOF issues. (728)

6.1.0

---------------------------------

**Backwards incompatible changes**

* Dropped support for Python 3.7. (709)

**Security fixes**

None

**Bug fixes**

* Add support for Python 3.12. (710)
* Fix linkify with arrays in querystring (436)
* Handle more cases with &lt; followed by character data (705)
* Fix entities inside a tags in linkification (704)
* Update cap for tinycss2 to &lt;1.3 (702)
* Updated Sphinx requirement
* Add dependabot for github actions and update github actions

6.0.0

----------------------------------

**Backwards incompatible changes**

* ``bleach.clean``, ``bleach.sanitizer.Cleaner``,
``bleach.html5lib_shim.BleachHTMLParser``: the ``tags`` and ``protocols``
arguments were changed from lists to sets.

Old pre-6.0.0:

.. code-block:: python

  bleach.clean(
      &quot;some text&quot;,
      tags=[&quot;a&quot;, &quot;p&quot;, &quot;img&quot;],
          ^               ^ list
      protocols=[&quot;http&quot;, &quot;https&quot;],
               ^               ^ list
  )


New 6.0.0 and later:

.. code-block:: python

  bleach.clean(
      &quot;some text&quot;,
      tags={&quot;a&quot;, &quot;p&quot;, &quot;img&quot;},
          ^               ^ set
      protocols={&quot;http&quot;, &quot;https&quot;},
               ^               ^ set
  )

* ``bleach.linkify``, ``bleach.linkifier.Linker``: the ``skip_tags`` and
``recognized_tags`` arguments were changed from lists to sets.

Old pre-6.0.0:

.. code-block:: python

  bleach.linkify(
      &quot;some text&quot;,
      skip_tags=[&quot;pre&quot;],
               ^     ^ list
  )

  linker = Linker(
      skip_tags=[&quot;pre&quot;],
               ^     ^ list
      recognized_tags=html5lib_shim.HTML_TAGS + [&quot;custom-element&quot;],
                                             ^ ^                ^ list
                                             |
                                             | list concatenation
  )

New 6.0.0 and later:

.. code-block:: python

  bleach.linkify(
      &quot;some text&quot;,
      skip_tags={&quot;pre&quot;},
               ^     ^ set
  )

  linker = Linker(
      skip_tags={&quot;pre&quot;},
               ^     ^ set
      recognized_tags=html5lib_shim.HTML_TAGS | {&quot;custom-element&quot;},
                                             ^ ^                ^ set
                                             |
                                             | union operator
  )

* ``bleach.sanitizer.BleachSanitizerFilter``: ``strip_allowed_elements`` is now
``strip_allowed_tags``. We now use &quot;tags&quot; everywhere rather than a mishmash
of &quot;tags&quot; in some places and &quot;elements&quot; in others.


**Security fixes**

None


**Bug fixes**

* Add support for Python 3.11. (675)

* Fix API weirness in ``BleachSanitizerFilter``. (649)

We&#x27;re using &quot;tags&quot; instead of &quot;elements&quot; everywhere--no more weird
overloading of &quot;elements&quot; anymore.

Also, it no longer calls the superclass constructor.

* Add warning when ``css_sanitizer`` isn&#x27;t set, but the ``style``
attribute is allowed. (676)

* Fix linkify handling of character entities. (501)

* Rework dev dependencies to use ``requirements-dev.txt`` and
``requirements-flake8.txt`` instead of extras.

* Fix project infrastructure to be tox-based so it&#x27;s easier to have CI
run the same things we&#x27;re running in development and with flake8
in an isolated environment.

* Update action versions in CI.

* Switch to f-strings where possible. Make tests parametrized to be
easier to read/maintain.

5.0.1

-------------------------------

**Security fixes**

None


**Bug fixes**

* Add missing comma to tinycss2 require. Thank you, shadchin!

* Add url parse tests based on wpt url tests. (688)

* Support scheme-less urls if &quot;https&quot; is in allow list. (662)

* Handle escaping ``&lt;`` in edge cases where it doesn&#x27;t start a tag. (544)

* Fix reference warnings in docs. (660)

* Correctly urlencode email address parts. Thank you, larseggert! (659)

5.0.0

-------------------------------

**Backwards incompatible changes**

* ``clean`` and ``linkify`` now preserve the order of HTML attributes. Thank
you, askoretskly! (566)

* Drop support for Python 3.6. Thank you, hugovk! (629)

* CSS sanitization in style tags is completely different now. If you&#x27;re using
Bleach ``clean`` to sanitize css in style tags, you&#x27;ll need to update your
code and you&#x27;ll need to install the ``css`` extras::

   pip install &#x27;bleach[css]&#x27;

See `the documentation on sanitizing CSS for how to do it
&lt;https://bleach.readthedocs.io/en/latest/clean.html#sanitizing-css&gt;`_. (633)

**Security fixes**

None

**Bug fixes**

* Rework dev dependencies. We no longer have
``requirements-dev.in``/``requirements-dev.txt``. Instead, we&#x27;re using
``dev`` extras.

See `development docs &lt;https://bleach.readthedocs.io/en/latest/dev.html&gt;`_
for more details. (620)

* Add newline when dropping block-level tags. Thank you, jvanasco! (369)

4.1.0

---------------------------------

**Features**

* Python 3.9 support

**Security fixes**

None

**Bug fixes**

* Update sanitizer clean to use vendored 3.6.14 stdlib urllib.parse to
fix test failures on Python 3.9. (536)

4.0.0

--------------------------------

**Backwards incompatible changes**

* Drop support for unsupported Python versions &lt;3.6. (520)

**Security fixes**

None

**Features**

* fix attribute name in the linkify docs (thanks CheesyFeet!)

3.3.1

-------------------------------

**Security fixes**

None

**Features**

* add more tests for CVE-2021-23980 / GHSA-vv2x-vrpj-qqpq
* bump python version to 3.8 for tox doc, vendorverify, and lint targets
* update bug report template tag
* update vendorverify script to detect and fail when extra files are vendored
* update release process docs to check vendorverify passes locally

**Bug fixes**

* remove extra vendored django present in the v3.3.0 whl (595)
* duplicate h1 header doc fix (thanks Nguyễn Gia Phong / McSinyx!)

3.3.0

----------------------------------

**Backwards incompatible changes**

* clean escapes HTML comments even when strip_comments=False

**Security fixes**

* Fix bug 1621692 / GHSA-m6xf-fq7q-8743. See the advisory for details.

**Features**

None

**Bug fixes**

None

3.2.3

----------------------------------

**Security fixes**

None

**Features**

None

**Bug fixes**

* fix clean and linkify raising ValueErrors for certain inputs. Thank you Google-Autofuzz.

3.2.2

----------------------------------

**Security fixes**

None

**Features**

* Migrate CI to Github Actions. Thank you hugovk.

**Bug fixes**

* fix linkify raising an IndexError on certain inputs. Thank you Google-Autofuzz.

3.2.1

------------------------------------

**Security fixes**

None

**Features**

None

**Bug fixes**

* change linkifier to add rel=&quot;nofollow&quot; as documented. Thank you mitar.
* suppress html5lib sanitizer DeprecationWarnings (557)

3.2.0

------------------------------------

**Security fixes**

None

**Features**

None

**Bug fixes**

* ``html5lib`` dependency to version 1.1.0. Thank you Sam Sneddon.
* update tests_website terminology. Thank you Thomas Grainger.

3.1.5

--------------------------------

**Security fixes**

None

**Features**

None

**Bug fixes**

* replace missing ``setuptools`` dependency with ``packaging``. Thank you Benjamin Peterson.

3.1.4

--------------------------------

**Security fixes**

* ``bleach.clean`` behavior parsing style attributes could result in a
regular expression denial of service (ReDoS).

Calls to ``bleach.clean`` with an allowed tag with an allowed
``style`` attribute were vulnerable to ReDoS. For example,
``bleach.clean(..., attributes={&#x27;a&#x27;: [&#x27;style&#x27;]})``.

This issue was confirmed in Bleach versions v3.1.3, v3.1.2, v3.1.1,
v3.1.0, v3.0.0, v2.1.4, and v2.1.3. Earlier versions used a similar
regular expression and should be considered vulnerable too.

Anyone using Bleach &lt;=v3.1.3 is encouraged to upgrade.

https://bugzilla.mozilla.org/show_bug.cgi?id=1623633

**Backwards incompatible changes**

* Style attributes with dashes, or single or double quoted values are
cleaned instead of passed through.

**Features**

None

**Bug fixes**

None

3.1.3

--------------------------------

**Security fixes**

None

**Backwards incompatible changes**

* Drop support for Python 3.4. Thank you, hugovk!

* Drop deprecated ``setup.py test`` support. Thank you, jdufresne! (507)

**Features**

* Add support for Python 3.8. Thank you, jdufresne!

* Add support for PyPy 7. Thank you, hugovk!

* Add pypy3 testing to tox and travis. Thank you, jdufresne!

**Bug fixes**

* Add relative link to code of conduct. (442)

* Fix typo: curren -&gt; current in tests/test_clean.py Thank you, timgates42! (504)

* Fix handling of non-ascii style attributes. Thank you, sekineh! (426)

* Simplify tox configuration. Thank you, jdufresne!

* Make documentation reproducible. Thank you, lamby!

* Fix typos in code comments. Thank you, zborboa-g!

* Fix exception value testing. Thank you, mastizada!

* Fix parser-tags NoneType exception. Thank you, bope!

* Improve TLD support in linkify. Thank you, pc-coholic!

3.1.2

--------------------------------

**Security fixes**

* ``bleach.clean`` behavior parsing embedded MathML and SVG content
with RCDATA tags did not match browser behavior and could result in
a mutation XSS.

Calls to ``bleach.clean`` with ``strip=False`` and ``math`` or
``svg`` tags and one or more of the RCDATA tags ``script``,
``noscript``, ``style``, ``noframes``, ``iframe``, ``noembed``, or
``xmp`` in the allowed tags whitelist were vulnerable to a mutation
XSS.

This security issue was confirmed in Bleach version v3.1.1. Earlier
versions are likely affected too.

Anyone using Bleach &lt;=v3.1.1 is encouraged to upgrade.

https://bugzilla.mozilla.org/show_bug.cgi?id=1621692

**Backwards incompatible changes**

None

**Features**

None

**Bug fixes**

None

3.1.1

-----------------------------------

**Security fixes**

* ``bleach.clean`` behavior parsing ``noscript`` tags did not match
browser behavior.

Calls to ``bleach.clean`` allowing ``noscript`` and one or more of
the raw text tags (``title``, ``textarea``, ``script``, ``style``,
``noembed``, ``noframes``, ``iframe``, and ``xmp``) were vulnerable
to a mutation XSS.

This security issue was confirmed in Bleach versions v2.1.4, v3.0.2,
and v3.1.0. Earlier versions are probably affected too.

Anyone using Bleach &lt;=v3.1.0 is highly encouraged to upgrade.

https://bugzilla.mozilla.org/show_bug.cgi?id=1615315

**Backwards incompatible changes**

None

**Features**

None

**Bug fixes**

None

Links

PyPI: https://pypi.org/project/bleach
Changelog: https://data.safetycli.com/changelogs/bleach/
Repo: https://github.com/mozilla/bleach
Docs: https://pythonhosted.org/bleach/

Update bleach from 3.1.0 to 6.2.0

06d0be4

pyup-bot mentioned this pull request Oct 29, 2024

Update bleach to 6.0.0 #456

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update bleach to 6.2.0 #812

Update bleach to 6.2.0 #812

pyup-bot commented Oct 29, 2024

Update bleach to 6.2.0 #812

Are you sure you want to change the base?

Update bleach to 6.2.0 #812

Conversation

pyup-bot commented Oct 29, 2024

6.2.0

6.1.0

6.0.0

5.0.1

5.0.0

4.1.0

4.0.0

3.3.1

3.3.0

3.2.3

3.2.2

3.2.1

3.2.0

3.1.5

3.1.4

3.1.3

3.1.2

3.1.1