Bump version

michalmuskala · May 4, 2020 · c12a20f · c12a20f
1 parent c998492
commit c12a20f
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,21 @@
 # Changelog
 
+## 1.2.1 (04.05.2020)
+
+### Security
+
+* Fix `html_safe` escaping in `Jason.encode`
+
+The `<!--` sequence of characters would not be escaped in `Jason.encode`
+with`html_escape` mode, which could lead to DoS attacks when used for
+embedding of arbitrary, user controlled strings into HTML through JSON
+(e.g. inside of `<script>` tags).
+
+If you were not using the `html_safe` option, you are not affected.
+
+Affected versions: < 1.2.1
+Patched versions: >= 1.2.1
+
 ## 1.2.0 (17.03.2020)
 
 ### Enhancements

diff --git a/mix.exs b/mix.exs
@@ -1,7 +1,7 @@
 defmodule Jason.Mixfile do
   use Mix.Project
 
-  @version "1.2.0"
+  @version "1.2.1"
 
   def project() do
     [