Skip to content

Upgrading Werkzeug 0.10 to 0.11

Review needed0.10.4 → 0.11.15Security6New2Changed10Fixed32Other1

Full comparisonBack to Werkzeug
Review neededUpgrade verdict

10 changed defaults and 5 security fixes.

In plain terms
  • Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message.
  • Malicious multipart uploads can no longer exhaust server memory.
  • The debugger's PIN check is harder to guess by repeatedly trying cookies. The debugger is still not meant for production.
  • Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.
Must act Top 3 of 5 that need code or config changes

What you must change

Security5
Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message.
0.11.11GitHub AdvisoryOriginalView source
Fixes an issue with multipart parsing that could cause memory exhaustion.
0.11.10CHANGES.rstSummarizedView source
Improves PIN based debugger protection to make it harder to brute force via cookies.
0.11.6CHANGES.rstSummarizedView source
Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.
0.11.6GitHub AdvisoryOriginalView source
Implements PIN based authentication for the debugger, which can optionally be disabled but is discouraged.
0.11CHANGES.rstSummarizedView source

API changes

Generated by DepDelta from published Python source. Not mixed with prose notes.

  • added: method BaseCache.has(key)
  • added: method FileSystemCache.has(key)
  • added: method MemcachedCache.has(key)
  • added: method RedisCache.has(key)
  • added: method SimpleCache.has(key)
  • removed: method DebuggedApplication.get_source(request, frame)
  • changed: constructor DebuggedApplication(app, evalex=…, request_key=…, console_path=…, console_init_func=…, show_hidden_frames=…, lodgeit_url=…) → constructor DebuggedApplication(app, evalex=…, request_key=…, console_path=…, console_init_func=…, show_hidden_frames=…, lodgeit_url=…, pin_security=…, pin_logging=…)
  • added: export parse_cookie
  • added: export text_type
  • added: field DebuggedApplication.pin
  • added: function get_machine_id()
  • added: function get_pin_and_cookie_name(app)
  • added: function hash_pin(pin)
  • added: method DebuggedApplication.check_pin_trust(environ)
  • added: method DebuggedApplication.log_pin_request()
  • added: method DebuggedApplication.pin_auth(request)
  • added: property DebuggedApplication.pin_cookie_name
  • added: variable PIN_TIME
  • removed: method Frame.render_source()
  • removed: variable SOURCE_TABLE_HTML
  • changed: function render_console_html(secret) → function render_console_html(secret, evalex_trusted=…)
  • changed: method Traceback.render_full(evalex=…, secret=…) → method Traceback.render_full(evalex=…, secret=…, evalex_trusted=…)
  • added: method Frame.get_context_lines(context=…)
  • added: method Frame.render_line_context()
  • added: class BrokenFilesystemWarning(RuntimeWarning, UnicodeWarning)
  • added: function get_filesystem_encoding()
  • added: variable has_likely_buggy_unicode_filesystem
  • changed: method MultiPartParser.parse_lines(file, boundary, content_length) → method MultiPartParser.parse_lines(file, boundary, content_length, cap_at_buffer=…)
  • changed: function parse_options_header(value) → function parse_options_header(value, multiple=…)
  • changed: constructor BuildError(endpoint, values, method) → constructor BuildError(endpoint, values, method, adapter=…)
  • added: method BuildError.closest_rule(adapter)
  • changed: constructor BaseWSGIServer(host, port, app, handler=…, passthrough_errors=…, ssl_context=…) → constructor BaseWSGIServer(host, port, app, handler=…, passthrough_errors=…, ssl_context=…, fd=…)
  • changed: constructor ForkingWSGIServer(host, port, app, processes=…, handler=…, passthrough_errors=…, ssl_context=…) → constructor ForkingWSGIServer(host, port, app, processes=…, handler=…, passthrough_errors=…, ssl_context=…, fd=…)
  • changed: function make_server(host, port, app=…, threaded=…, processes=…, request_handler=…, passthrough_errors=…, ssl_context=…) → function make_server(host=…, port=…, app=…, threaded=…, processes=…, request_handler=…, passthrough_errors=…, ssl_context=…, fd=…)
  • added: class ForkingMixIn(object)
  • added: method WSGIRequestHandler.port_integer()
  • added: variable ForkingMixIn
  • added: variable LISTEN_QUEUE
  • added: variable ThreadingMixIn
  • added: variable can_fork
  • added: variable can_open_by_fd
  • added: variable ssl
  • changed: class cached_property(object) → class cached_property(property)
  • changed: function make_chunk_iter(stream, separator, limit=…, buffer_size=…) → function make_chunk_iter(stream, separator, limit=…, buffer_size=…, cap_at_buffer=…)
  • changed: function make_line_iter(stream, limit=…, buffer_size=…) → function make_line_iter(stream, limit=…, buffer_size=…, cap_at_buffer=…)