Upgrading Mako 0.2 to 0.3
Unknown0.2.5 → 0.3.6Security1
SecurityMako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.GHSA-7q8x-38mc-p84f · CVE-2010-2480 ↗
UnknownUpgrade verdict
DepDelta hasn't looked for this range's notes yet, so breaking changes can't be ruled out.
In plain terms
- DepDelta hasn't finished looking for the notes in this range, so it can't rule out breaking changes yet.
Must act 1 item needs code or config changes
What you must change
Security1
Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.
API changes
Generated by DepDelta from published Python source. Not mixed with prose notes.
- added:
class MakoBridge(TemplateBridge) - added:
class StripDocTestFilter(Filter) - added:
function autodoc_skip_member(app, what, name, obj, skip, options) - added:
function setup(app) - added:
method MakoBridge.init(builder, *args, **kw) - added:
method MakoBridge.render(template, context) - added:
method MakoBridge.render_string(template, context) - added:
method StripDocTestFilter.filter(lexer, stream)
- added:
function go(m) - added:
function strip_toplevel_anchors(text) - added:
function striptags(text)
- added:
class BeakerMissing(object) - added:
method BeakerMissing.get_cache(name, **kwargs)
- changed:
function compile(node, uri, filename=…, default_filters=…, buffer_filters=…, imports=…, source_encoding=…, generate_unicode=…) → function compile(node, uri, filename=…, default_filters=…, buffer_filters=…, imports=…, source_encoding=…, generate_magic_comment=…, disable_unicode=…, strict_undefined=…)
- removed:
field RichTraceback.reverse_traceback - removed:
field RichTraceback.traceback - changed:
constructor RichTraceback(traceback=…) → constructor RichTraceback(error=…, traceback=…) - added:
class UnsupportedError(MakoException) - added:
property RichTraceback.errorname - added:
property RichTraceback.reverse_records - added:
property RichTraceback.reverse_traceback - added:
property RichTraceback.traceback
- removed:
function create_tag(callable)
- added:
function legacy_html_escape(string) - added:
variable NON_UNICODE_ESCAPES - added:
variable html_escape
- removed:
field Lexer.exception_kwargs - removed:
method Lexer.escape_code(text) - removed:
method Lexer.match_encoding() - added:
method Lexer.decode_raw_stream(text, decode_raw, known_encoding, filename) - added:
method Lexer.match_reg(reg) - added:
property Lexer.exception_kwargs
- changed:
constructor TemplateLookup(directories=…, module_directory=…, filesystem_checks=…, collection_size=…, format_exceptions=…, error_handler=…, disable_unicode=…, output_encoding=…, encoding_errors=…, cache_type=…, cache_dir=…, cache_url=…, cache_enabled=…, modulename_callable=…, default_filters=…, buffer_filters=…, imports=…, input_encoding=…, preprocessor=…) → constructor TemplateLookup(directories=…, module_directory=…, filesystem_checks=…, collection_size=…, format_exceptions=…, error_handler=…, disable_unicode=…, output_encoding=…, encoding_errors=…, cache_type=…, cache_dir=…, cache_url=…, cache_enabled=…, modulename_callable=…, default_filters=…, buffer_filters=…, strict_undefined=…, imports=…, input_encoding=…, preprocessor=…)
- removed:
field Node.exception_kwargs - removed:
method Node.exception_kwargs() - added:
property Node.exception_kwargs
- removed:
field Context.kwargs - removed:
field Context.lookup - removed:
field Namespace.attr - removed:
field Namespace.cache - removed:
field Namespace.filename - removed:
field Namespace.module - removed:
field Namespace.uri - removed:
method Namespace.attr() - removed:
method Namespace.cache() - added:
field Namespace.context - added:
field Namespace.template - added:
property Context.kwargs - added:
property Context.lookup - added:
property Namespace.attr - added:
property Namespace.cache - added:
property Namespace.filename - added:
property Namespace.module - added:
property Namespace.uri