Upgrading lxml 3 to 4
Breaking3.8.0 → 4.9.4Breaking1Security9Platform4Deprecated1New23Changed23Fixed56Other10
SecurityWorks around CVE-2022-2309, where namespace declarations from a failed parser run could leak into later parser runs.CVE-2022-2309 ↗
BreakingUpgrade verdict
1 breaking change and 4 platform requirement changes and 9 security fixes.
In plain terms
- Character detection is now off by default for Unicode strings and file objects, and on for URLs and file paths.
- lxml 4.4.0 no longer runs on Python 3.4.
- This release is rebuilt so the package works with Python 3.8.
- This release is rebuilt so the package works with Python 3.8.
Must act Top 5 of 15 that need code or config changes
Requires Python >=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, != 3.4.* from 4.4.1 (none stated before).
What you must change
Breaking1
The html5parser no longer passes useChardet for Unicode string input unless requested, changing the default configuration.
html5parseruseChardetguess_charsetSecurity9
Works around CVE-2022-2309, where namespace declarations from a failed parser run could leak into later parser runs.
NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.
Fixes a vulnerability (GHSL-2021-1038) in the HTML cleaner that allowed script content to be smuggled through SVG images (CVE-2021-43818).
Fixes a vulnerability (GHSL-2021-1037) in the HTML cleaner that allowed script content to be smuggled through CSS imports and other crafted constructs (CVE-2021-43818).
Fixes CVE-2021-28957 in the HTML Cleaner, which allowed JavaScript to pass through, by removing the HTML5 formaction attribute.
formactionFixes CVE-2020-27783, a vulnerability in the HTML Cleaner that allowed JavaScript to pass through.
HTML CleanerFixes an HTML Cleaner vulnerability found by Yaniv Nizry that allowed JavaScript to pass through; the cleaner now removes more sneaky "style" content.
HTML CleanerFixes file paths containing '%' being wrongly URL-unescaped, which could write to a different file or directory.
Fixes HTML cleaner failing to remove JavaScript URLs that used URL escaping (CVE-2018-19787).
Platform4
Removes support for Python 3.4.
Rebuilds with Cython 0.29.13 to support Python 3.8.
Rebuilds with Cython 0.29.10 to support Python 3.8.
Removes support for Python 2.6 and 3.3.
Deprecations to plan for
Deprecated1
ElementTree.write_c14n() is deprecated in favour of ElementTree.write(f, method="c14n") and will be removed in a future release.
ElementTree.write_c14n()ElementTree.write()API changes
Generated by DepDelta from published Python source. Not mixed with prose notes.
- changed:
function include(elem, loader=…, base_url=…) → function include(elem, loader=…, base_url=…, max_depth=…) - added:
class LimitedRecursiveIncludeError(FatalIncludeError) - added:
variable DEFAULT_MAX_INCLUSION_DEPTH