Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-bleach for openSUSE:Factory checked in at 2026-07-21 23:00:18 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-bleach (Old) and /work/SRC/openSUSE:Factory/.python-bleach.new.24530 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-bleach" Tue Jul 21 23:00:18 2026 rev:24 rq:1366730 version:6.4.0 Changes: -------- --- /work/SRC/openSUSE:Factory/python-bleach/python-bleach.changes 2026-03-31 15:23:31.303400994 +0200 +++ /work/SRC/openSUSE:Factory/.python-bleach.new.24530/python-bleach.changes 2026-07-21 23:00:27.461828859 +0200 @@ -1,0 +2,15 @@ +Mon Jul 13 09:26:58 UTC 2026 - Dirk Müller <[email protected]> + +- update to 6.4.0 (bsc#1271307, bsc#1271306): + * **NOTE: 2026-06-05: Bleach is no longer maintained. There + will be no future releases including for security issues.** + * Dropped support for pypy 3.10. (#764) + * Fix bug 2023812 / GHSA-8rfp-98v4-mmr6. + * Fix XSS issue with sanitize_uri_value where disallowed + schemes with + * Unicode invisible characters wouldn't be rejected. + * Fix GHSA-gj48-438w-jh9v. + * Fix issue where URI sanitization wasn't happening in + formaction attributes. + +------------------------------------------------------------------- Old: ---- bleach-6.3.0.tar.gz New: ---- bleach-6.4.0.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-bleach.spec ++++++ --- /var/tmp/diff_new_pack.lEy3mI/_old 2026-07-21 23:00:28.117851214 +0200 +++ /var/tmp/diff_new_pack.lEy3mI/_new 2026-07-21 23:00:28.117851214 +0200 @@ -19,7 +19,7 @@ %{?sle15_python_module_pythons} Name: python-bleach -Version: 6.3.0 +Version: 6.4.0 Release: 0 Summary: A whitelist-based HTML-sanitizing tool License: Apache-2.0 @@ -67,7 +67,7 @@ %check # gh#mozilla/bleach#503 -%pytest -k 'not (test_uri_value_allowed_protocols or test_self_closing_tags_self_close)' +%pytest -k 'not (test_uri_value_allowed_protocols or test_self_closing_tags_self_close or test_formaction_attribute)' %files %{python_files} %license LICENSE ++++++ bleach-6.3.0.tar.gz -> bleach-6.4.0.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/CHANGES new/bleach-6.4.0/CHANGES --- old/bleach-6.3.0/CHANGES 2025-10-27 18:51:42.000000000 +0100 +++ new/bleach-6.4.0/CHANGES 2026-06-05 14:58:26.000000000 +0200 @@ -1,6 +1,54 @@ Bleach changes ============== +Version 6.4.0 (June 5th, 2026) +------------------------------ + +**NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future +releases including for security issues.** +See issue: `<https://github.com/mozilla/bleach/issues/698>`__ + +**Backwards incompatible changes** + +* Dropped support for pypy 3.10. (#764) + +**Security fixes** + +* Fix bug 2023812 / GHSA-8rfp-98v4-mmr6. + + Fix XSS issue with sanitize_uri_value where disallowed schemes with + Unicode invisible characters wouldn't be rejected. + + For example:: + + import bleach + payload1 = '<a href="javascript\u200b:alert(document.cookie)">Click</a>' + result1 = bleach.clean(payload1) + print(repr(result1)) + + outputs:: + + '<a href="javascript\u200b:alert(document.cookie)">Click</a>' + + See the advisory for details. + +* Fix GHSA-gj48-438w-jh9v. + + Fix issue where URI sanitization wasn't happening in formaction attributes. + + See the advisory for details. + +**Bug fixes** + +* Add support for pypy 3.11. (#764) + +* Drop version max in tinycss2 pin. (#772) + + This removes one of the things we had to keep checking and updating. Users + now own the responsibility for correctness with the version of tinycss2 + they're using. + + Version 6.3.0 (October 27th, 2025) ---------------------------------- diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/CONTRIBUTING.rst new/bleach-6.4.0/CONTRIBUTING.rst --- old/bleach-6.3.0/CONTRIBUTING.rst 2022-04-07 17:48:21.000000000 +0200 +++ new/bleach-6.4.0/CONTRIBUTING.rst 2026-06-05 14:48:31.000000000 +0200 @@ -1,19 +1,6 @@ -Reporting Bugs -============== +Status +====== -For regular bugs, please report them `in our issue tracker -<https://github.com/mozilla/bleach/issues>`_. - - -Reporting security bugs ------------------------ - -If you believe that you've found a security vulnerability, please `file a secure -bug report in our bug tracker -<https://bugzilla.mozilla.org/enter_bug.cgi?product=Webtools&component=Bleach-security&groups=webtools-security>`_ -or send an email to *security AT mozilla DOT org*. - -For more information on security-related bug disclosure and the PGP key to use -for sending encrypted mail or to verify responses received from that address, -please read our wiki page at -`<https://www.mozilla.org/en-US/security/#For_Developers>`_. +**NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future +releases including for security issues.** +See issue: https://github.com/mozilla/bleach/issues/698 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/CONTRIBUTORS new/bleach-6.4.0/CONTRIBUTORS --- old/bleach-6.3.0/CONTRIBUTORS 2022-02-18 16:49:27.000000000 +0100 +++ new/bleach-6.4.0/CONTRIBUTORS 2026-06-05 14:48:31.000000000 +0200 @@ -1,18 +1,21 @@ +**NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future +releases including for security issues.** +See issue: https://github.com/mozilla/bleach/issues/698 + Bleach was originally written and maintained by James Socol and various contributors within and without the Mozilla Corporation and Foundation. -It is currently maintained by Will Kahn-Greene, Greg Guthe, and Jon Dufresne. - Maintainers: -- Will Kahn-Greene <[email protected]> -- Greg Guthe <[email protected]> -- Jon Dufresne <[email protected]> +None Maintainer emeritus: - Jannis Leidel <[email protected]> - James Socol <[email protected]> +- Greg Guthe <[email protected]> +- Jon Dufresne <[email protected]> +- Will Kahn-Greene <[email protected]> Contributors: @@ -39,7 +42,6 @@ - dbxnr - Erik Rose - Gaurav Dadhania -- Geoffrey Sneddon - Google Autofuzz Team - Greg Guthe - hugovk diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/MANIFEST.in new/bleach-6.4.0/MANIFEST.in --- old/bleach-6.3.0/MANIFEST.in 2023-10-06 18:19:57.000000000 +0200 +++ new/bleach-6.4.0/MANIFEST.in 2026-03-16 14:26:20.000000000 +0100 @@ -6,7 +6,6 @@ include Makefile include README.rst include requirements-dev.txt -include requirements-flake8.txt include SECURITY.md include tox.ini diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/Makefile new/bleach-6.4.0/Makefile --- old/bleach-6.3.0/Makefile 2025-10-06 17:28:02.000000000 +0200 +++ new/bleach-6.4.0/Makefile 2026-03-16 14:26:20.000000000 +0100 @@ -14,11 +14,13 @@ docs: ## Build docs tox -e py310-docs +.PHONY: format +format: ## Format Python files + tox exec -e py310-lint -- ruff format --target-version=py310 --exclude=_vendor setup.py bleach/ tests/ tests_website/ + .PHONY: lint lint: ## Lint files - tox exec -e py310-format-check -- black --target-version=py310 --exclude=_vendor setup.py bleach/ tests/ tests_website/ tox -e py310-lint - tox -e py310-format-check .PHONY: vendorverify vendorverify: ## Verify vendored files diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/PKG-INFO new/bleach-6.4.0/PKG-INFO --- old/bleach-6.3.0/PKG-INFO 2025-10-27 18:52:20.269979700 +0100 +++ new/bleach-6.4.0/PKG-INFO 2026-06-05 15:00:18.857422400 +0200 @@ -1,12 +1,12 @@ Metadata-Version: 2.4 Name: bleach -Version: 6.3.0 +Version: 6.4.0 Summary: An easy safelist-based HTML-sanitizing tool. Home-page: https://github.com/mozilla/bleach Maintainer: Will Kahn-Greene Maintainer-email: [email protected] License: Apache Software License -Classifier: Development Status :: 5 - Production/Stable +Classifier: Development Status :: 7 - Inactive Classifier: Environment :: Web Environment Classifier: Intended Audience :: Developers Classifier: Operating System :: OS Independent @@ -27,7 +27,7 @@ License-File: bleach/_vendor/html5lib-1.1.dist-info/LICENSE Requires-Dist: webencodings Provides-Extra: css -Requires-Dist: tinycss2<1.5,>=1.1.0; extra == "css" +Requires-Dist: tinycss2>=1.1.0; extra == "css" Dynamic: classifier Dynamic: description Dynamic: description-content-type @@ -45,17 +45,9 @@ Bleach ====== -.. image:: https://github.com/mozilla/bleach/workflows/Test/badge.svg - :target: https://github.com/mozilla/bleach/actions?query=workflow%3ATest - -.. image:: https://github.com/mozilla/bleach/workflows/Lint/badge.svg - :target: https://github.com/mozilla/bleach/actions?query=workflow%3ALint - -.. image:: https://badge.fury.io/py/bleach.svg - :target: http://badge.fury.io/py/bleach - -**NOTE: 2023-01-23: Bleach is deprecated.** See issue: -`<https://github.com/mozilla/bleach/issues/698>`__ +**NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future +releases including for security issues.** +See issue: `<https://github.com/mozilla/bleach/issues/698>`__ Bleach is an allowed-list-based HTML sanitizing library that escapes or strips markup and attributes. @@ -169,6 +161,54 @@ Bleach changes ============== +Version 6.4.0 (June 5th, 2026) +------------------------------ + +**NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future +releases including for security issues.** +See issue: `<https://github.com/mozilla/bleach/issues/698>`__ + +**Backwards incompatible changes** + +* Dropped support for pypy 3.10. (#764) + +**Security fixes** + +* Fix bug 2023812 / GHSA-8rfp-98v4-mmr6. + + Fix XSS issue with sanitize_uri_value where disallowed schemes with + Unicode invisible characters wouldn't be rejected. + + For example:: + + import bleach + payload1 = '<a href="javascript\u200b:alert(document.cookie)">Click</a>' + result1 = bleach.clean(payload1) + print(repr(result1)) + + outputs:: + + '<a href="javascript\u200b:alert(document.cookie)">Click</a>' + + See the advisory for details. + +* Fix GHSA-gj48-438w-jh9v. + + Fix issue where URI sanitization wasn't happening in formaction attributes. + + See the advisory for details. + +**Bug fixes** + +* Add support for pypy 3.11. (#764) + +* Drop version max in tinycss2 pin. (#772) + + This removes one of the things we had to keep checking and updating. Users + now own the responsibility for correctness with the version of tinycss2 + they're using. + + Version 6.3.0 (October 27th, 2025) ---------------------------------- diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/README.rst new/bleach-6.4.0/README.rst --- old/bleach-6.3.0/README.rst 2023-01-23 18:34:25.000000000 +0100 +++ new/bleach-6.4.0/README.rst 2026-06-05 14:48:31.000000000 +0200 @@ -2,17 +2,9 @@ Bleach ====== -.. image:: https://github.com/mozilla/bleach/workflows/Test/badge.svg - :target: https://github.com/mozilla/bleach/actions?query=workflow%3ATest - -.. image:: https://github.com/mozilla/bleach/workflows/Lint/badge.svg - :target: https://github.com/mozilla/bleach/actions?query=workflow%3ALint - -.. image:: https://badge.fury.io/py/bleach.svg - :target: http://badge.fury.io/py/bleach - -**NOTE: 2023-01-23: Bleach is deprecated.** See issue: -`<https://github.com/mozilla/bleach/issues/698>`__ +**NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future +releases including for security issues.** +See issue: `<https://github.com/mozilla/bleach/issues/698>`__ Bleach is an allowed-list-based HTML sanitizing library that escapes or strips markup and attributes. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/SECURITY.md new/bleach-6.4.0/SECURITY.md --- old/bleach-6.3.0/SECURITY.md 2021-12-02 01:16:31.000000000 +0100 +++ new/bleach-6.4.0/SECURITY.md 2026-06-05 14:48:31.000000000 +0200 @@ -1,20 +1,5 @@ # Security Policy -## Supported Versions - -Use this section to tell people about which versions of your project are -currently being supported with security updates. - -| Version | Supported | -| ------- | ------------------ | -| 4.1.x | :white_check_mark: | -| < 4 | :x: | - -## Reporting a Vulnerability - -If you believe that you've found a security vulnerability, please [file a secure -bug report in our bug tracker](https://bugzilla.mozilla.org/enter_bug.cgi?assigned_to=nobody%40mozilla.org&product=Webtools&component=Bleach-security&groups=webtools-security) or send an email to *security AT mozilla DOT org*. - -For more information on security-related bug disclosure and the PGP key to use -for sending encrypted mail or to verify responses received from that address, -please read our wiki page at https://www.mozilla.org/en-US/security/#For_Developers +**NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future +releases including for security issues.** +See issue: https://github.com/mozilla/bleach/issues/698 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/bleach/__init__.py new/bleach-6.4.0/bleach/__init__.py --- old/bleach-6.3.0/bleach/__init__.py 2025-10-27 18:51:42.000000000 +0100 +++ new/bleach-6.4.0/bleach/__init__.py 2026-06-05 14:48:31.000000000 +0200 @@ -11,9 +11,9 @@ # yyyymmdd -__releasedate__ = "20251027" +__releasedate__ = "20260605" # x.y.z or x.y.z.dev0 -- semver -__version__ = "6.3.0" +__version__ = "6.4.0" __all__ = ["clean", "linkify"] diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/bleach/_vendor/html5lib/filters/sanitizer.py new/bleach-6.4.0/bleach/_vendor/html5lib/filters/sanitizer.py --- old/bleach-6.3.0/bleach/_vendor/html5lib/filters/sanitizer.py 2025-10-14 14:33:51.000000000 +0200 +++ new/bleach-6.4.0/bleach/_vendor/html5lib/filters/sanitizer.py 2026-06-05 14:48:31.000000000 +0200 @@ -534,6 +534,7 @@ (None, 'dynsrc'), (None, 'lowsrc'), (None, 'ping'), + (None, 'formaction'), (namespaces['xlink'], 'href'), (namespaces['xml'], 'base'), )) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/bleach/_vendor/vendor_install.sh new/bleach-6.4.0/bleach/_vendor/vendor_install.sh --- old/bleach-6.3.0/bleach/_vendor/vendor_install.sh 2025-10-14 14:33:51.000000000 +0200 +++ new/bleach-6.4.0/bleach/_vendor/vendor_install.sh 2026-06-05 14:48:31.000000000 +0200 @@ -13,6 +13,7 @@ # Apply patches (cd "${DEST}" && patch -p2 < 01_html5lib_six.patch) (cd "${DEST}" && patch -p2 < 02_html5lib_wbr.patch) +(cd "${DEST}" && patch -p2 < 03_html5lib_formaction.patch) # install Python 3.6.14 urllib.urlparse for #536 curl --proto '=https' --tlsv1.2 -o "${DEST}/parse.py" https://raw.githubusercontent.com/python/cpython/v3.6.14/Lib/urllib/parse.py diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/bleach/html5lib_shim.py new/bleach-6.4.0/bleach/html5lib_shim.py --- old/bleach-6.3.0/bleach/html5lib_shim.py 2024-10-28 13:21:49.000000000 +0100 +++ new/bleach-6.4.0/bleach/html5lib_shim.py 2026-03-17 22:15:22.000000000 +0100 @@ -347,6 +347,37 @@ yield token elif ( + last_error_token["data"] + in ( + "invalid-character-in-attribute-name", + "invalid-character-after-attribute-name", + ) + and token["type"] == TAG_TOKEN_TYPE_CHARACTERS + and token.get("data") + and " " in token["data"] + ): + # token["data"] has something that starts with a left angle + # bracket, then has some characters followed by a space + # followed by another left angle bracket and ending with + # a right angle bracket. That part could be a real tag, so + # we don't want it to get treated as Characters. For + # example, soemthing in this shape: <nottag <...> + # If so, we want to take off the first bit that is + # definitely not a tag and reparse the rest. + head, rest = token["data"].split(" ", 1) + if rest.strip().startswith("<"): + # yield the not-a-tag plus the space we split on + token["data"] = head + " " + yield token + + # shove the rest back in the stream for the praser to look + # at + for c in reversed(rest): + self.stream.unget(c) + else: + yield token + + elif ( last_error_token["data"] == "expected-closing-tag-but-got-char" and self.parser.tags is not None and token["data"].lower().strip() not in self.parser.tags diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/bleach/linkifier.py new/bleach-6.4.0/bleach/linkifier.py --- old/bleach-6.3.0/bleach/linkifier.py 2023-10-06 20:49:32.000000000 +0200 +++ new/bleach-6.4.0/bleach/linkifier.py 2026-03-16 14:26:20.000000000 +0100 @@ -48,9 +48,7 @@ (?:[/?][^\s\{{\}}\|\\\^`<>"]*)? # /path/zz (excluding "unsafe" chars from RFC 3986, # except for # and ~, which happen in practice) - """.format( - "|".join(sorted(protocols)), "|".join(sorted(tlds)) - ), + """.format("|".join(sorted(protocols)), "|".join(sorted(tlds))), re.IGNORECASE | re.VERBOSE | re.UNICODE, ) @@ -81,9 +79,7 @@ |^"([\001-\010\013\014\016-\037!#-\[\]-\177] |\\[\001-\011\013\014\016-\177])*" # quoted-string )@(?:[A-Z0-9](?:[A-Z0-9-]{{0,61}}[A-Z0-9])?\.)+(?:{0})) # domain - """.format( - "|".join(tlds) - ), + """.format("|".join(tlds)), re.IGNORECASE | re.MULTILINE | re.VERBOSE, ) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/bleach/sanitizer.py new/bleach-6.4.0/bleach/sanitizer.py --- old/bleach-6.3.0/bleach/sanitizer.py 2025-04-11 13:53:00.000000000 +0200 +++ new/bleach-6.4.0/bleach/sanitizer.py 2026-06-05 14:48:31.000000000 +0200 @@ -488,14 +488,15 @@ # Convert all character entities in the value normalized_uri = html5lib_shim.convert_entities(value) - # Nix backtick, space characters, and control characters + # Strip backtick, whitespace, and control characters normalized_uri = re.sub(r"[`\000-\040\177-\240\s]+", "", normalized_uri) - # Remove REPLACEMENT characters - normalized_uri = normalized_uri.replace("\ufffd", "") + # Strip non-ASCII characters so that urlparse can parse the url into + # components correctly. This drops invisible and whitespace unicode + # characters among other things. + normalized_uri = re.sub(r"[^\x00-\x7f]", "", normalized_uri) - # Lowercase it--this breaks the value, but makes it easier to match - # against + # Lowercase value to make matching easier normalized_uri = normalized_uri.lower() try: diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/bleach.egg-info/PKG-INFO new/bleach-6.4.0/bleach.egg-info/PKG-INFO --- old/bleach-6.3.0/bleach.egg-info/PKG-INFO 2025-10-27 18:52:20.000000000 +0100 +++ new/bleach-6.4.0/bleach.egg-info/PKG-INFO 2026-06-05 15:00:18.000000000 +0200 @@ -1,12 +1,12 @@ Metadata-Version: 2.4 Name: bleach -Version: 6.3.0 +Version: 6.4.0 Summary: An easy safelist-based HTML-sanitizing tool. Home-page: https://github.com/mozilla/bleach Maintainer: Will Kahn-Greene Maintainer-email: [email protected] License: Apache Software License -Classifier: Development Status :: 5 - Production/Stable +Classifier: Development Status :: 7 - Inactive Classifier: Environment :: Web Environment Classifier: Intended Audience :: Developers Classifier: Operating System :: OS Independent @@ -27,7 +27,7 @@ License-File: bleach/_vendor/html5lib-1.1.dist-info/LICENSE Requires-Dist: webencodings Provides-Extra: css -Requires-Dist: tinycss2<1.5,>=1.1.0; extra == "css" +Requires-Dist: tinycss2>=1.1.0; extra == "css" Dynamic: classifier Dynamic: description Dynamic: description-content-type @@ -45,17 +45,9 @@ Bleach ====== -.. image:: https://github.com/mozilla/bleach/workflows/Test/badge.svg - :target: https://github.com/mozilla/bleach/actions?query=workflow%3ATest - -.. image:: https://github.com/mozilla/bleach/workflows/Lint/badge.svg - :target: https://github.com/mozilla/bleach/actions?query=workflow%3ALint - -.. image:: https://badge.fury.io/py/bleach.svg - :target: http://badge.fury.io/py/bleach - -**NOTE: 2023-01-23: Bleach is deprecated.** See issue: -`<https://github.com/mozilla/bleach/issues/698>`__ +**NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future +releases including for security issues.** +See issue: `<https://github.com/mozilla/bleach/issues/698>`__ Bleach is an allowed-list-based HTML sanitizing library that escapes or strips markup and attributes. @@ -169,6 +161,54 @@ Bleach changes ============== +Version 6.4.0 (June 5th, 2026) +------------------------------ + +**NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future +releases including for security issues.** +See issue: `<https://github.com/mozilla/bleach/issues/698>`__ + +**Backwards incompatible changes** + +* Dropped support for pypy 3.10. (#764) + +**Security fixes** + +* Fix bug 2023812 / GHSA-8rfp-98v4-mmr6. + + Fix XSS issue with sanitize_uri_value where disallowed schemes with + Unicode invisible characters wouldn't be rejected. + + For example:: + + import bleach + payload1 = '<a href="javascript\u200b:alert(document.cookie)">Click</a>' + result1 = bleach.clean(payload1) + print(repr(result1)) + + outputs:: + + '<a href="javascript\u200b:alert(document.cookie)">Click</a>' + + See the advisory for details. + +* Fix GHSA-gj48-438w-jh9v. + + Fix issue where URI sanitization wasn't happening in formaction attributes. + + See the advisory for details. + +**Bug fixes** + +* Add support for pypy 3.11. (#764) + +* Drop version max in tinycss2 pin. (#772) + + This removes one of the things we had to keep checking and updating. Users + now own the responsibility for correctness with the version of tinycss2 + they're using. + + Version 6.3.0 (October 27th, 2025) ---------------------------------- diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/bleach.egg-info/SOURCES.txt new/bleach-6.4.0/bleach.egg-info/SOURCES.txt --- old/bleach-6.3.0/bleach.egg-info/SOURCES.txt 2025-10-27 18:52:20.000000000 +0100 +++ new/bleach-6.4.0/bleach.egg-info/SOURCES.txt 2026-06-05 15:00:18.000000000 +0200 @@ -8,7 +8,6 @@ README.rst SECURITY.md requirements-dev.txt -requirements-flake8.txt setup.cfg setup.py tox.ini diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/bleach.egg-info/requires.txt new/bleach-6.4.0/bleach.egg-info/requires.txt --- old/bleach-6.3.0/bleach.egg-info/requires.txt 2025-10-27 18:52:20.000000000 +0100 +++ new/bleach-6.4.0/bleach.egg-info/requires.txt 2026-06-05 15:00:18.000000000 +0200 @@ -1,4 +1,4 @@ webencodings [css] -tinycss2<1.5,>=1.1.0 +tinycss2>=1.1.0 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/requirements-dev.txt new/bleach-6.4.0/requirements-dev.txt --- old/bleach-6.3.0/requirements-dev.txt 2025-05-29 17:25:53.000000000 +0200 +++ new/bleach-6.4.0/requirements-dev.txt 2026-06-05 13:14:54.000000000 +0200 @@ -1,13 +1,13 @@ -e . -black==24.4.2; implementation_name == 'cpython' build==1.2.1 mypy==1.10.1; implementation_name =='cpython' -pytest==8.2.2 +pytest==9.0.3 +ruff==0.15.6; implementation_name == 'cpython' setuptools==80.7.1 tox==4.16.0 tox-gh-actions==3.2.0 twine==6.1.0 -wheel==0.46.1 +wheel==0.46.3 Sphinx==7.4.4 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/requirements-flake8.txt new/bleach-6.4.0/requirements-flake8.txt --- old/bleach-6.3.0/requirements-flake8.txt 2023-01-21 23:17:49.000000000 +0100 +++ new/bleach-6.4.0/requirements-flake8.txt 1970-01-01 01:00:00.000000000 +0100 @@ -1,2 +0,0 @@ -# Requirements for running flake8 -flake8==6.0.0 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/setup.cfg new/bleach-6.4.0/setup.cfg --- old/bleach-6.3.0/setup.cfg 2025-10-27 18:52:20.270255300 +0100 +++ new/bleach-6.4.0/setup.cfg 2026-06-05 15:00:18.857683200 +0200 @@ -1,15 +1,3 @@ -[flake8] -exclude = - .git/, - .tox/, - bleach/_vendor/* -ignore = - E203, - E501, - E731, - W503 -max-line-length = 88 - [tool:pytest] filterwarnings = error diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/setup.py new/bleach-6.4.0/setup.py --- old/bleach-6.3.0/setup.py 2025-10-27 17:33:27.000000000 +0100 +++ new/bleach-6.4.0/setup.py 2026-06-05 14:48:31.000000000 +0200 @@ -31,7 +31,7 @@ EXTRAS_REQUIRE = { "css": [ - "tinycss2>=1.1.0,<1.5", + "tinycss2>=1.1.0", ], } @@ -55,7 +55,7 @@ install_requires=INSTALL_REQUIRES, extras_require=EXTRAS_REQUIRE, classifiers=[ - "Development Status :: 5 - Production/Stable", + "Development Status :: 7 - Inactive", "Environment :: Web Environment", "Intended Audience :: Developers", "Operating System :: OS Independent", diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/tests/test_clean.py new/bleach-6.4.0/tests/test_clean.py --- old/bleach-6.3.0/tests/test_clean.py 2025-10-14 14:33:51.000000000 +0200 +++ new/bleach-6.4.0/tests/test_clean.py 2026-06-05 14:48:31.000000000 +0200 @@ -171,6 +171,19 @@ ("<some thing thing", "<some thing thing"), # this is an expected-end-of-tag-but-got-eof parser error ("<some thing thing2 ", "<some thing thing2 "), + # handle invalid-character-in-attribute-name correctly tests + ("<tag <b><em>text</em></b> <a></a>", "<tag <b><em>text</em></b> <a></a>"), + ("<foo <a>link text</a>", "<foo <a>link text</a>"), + # keep the tag and add an end tag + ("<foo <b>", "<foo <b></b>"), + # escape disallowed tags + ("<foo <p>text</p>", "<foo <p>text</p>"), + # keep tags with attributes + ('<foo <a href="x">text</a>', '<foo <a href="x">text</a>'), + # multiple spaces + ("<foo <a>link text</a>", "<foo <a>link text</a>"), + ("text <foo <b>text</b>", "text <foo <b>text</b>"), + ("text <foo <bar <b>text</b>", "text <foo <bar <b>text</b>"), ], ) def test_lessthan_escaping(text, expected): @@ -414,13 +427,31 @@ assert clean(ok, tags=tags, attributes=attrs) == ok +def test_formaction_attribute(): + """formaction attributes should not allow javascript (GHSA-gj48-438w-jh9v).""" + tags = {"button", "input"} + attrs = {"button": ["formaction"], "input": ["formaction", "type"]} + + test = '<button formaction="javascript:alert(1)">x</button>' + assert clean(test, tags=tags, attributes=attrs) == "<button>x</button>" + + test = '<input type="submit" formaction="javascript:alert(1)">' + assert clean(test, tags=tags, attributes=attrs) == '<input type="submit">' + + ok = '<button formaction="/foo">x</button>' + assert clean(ok, tags=tags, attributes=attrs) == ok + + def test_attributes_callable(): """Verify attributes can take a callable""" - ATTRS = lambda tag, name, val: name == "title" + + def attrs_fun(tag, name, val): + return name == "title" + TAGS = {"a"} text = '<a href="/foo" title="blah">example</a>' - assert clean(text, tags=TAGS, attributes=ATTRS) == '<a title="blah">example</a>' + assert clean(text, tags=TAGS, attributes=attrs_fun) == '<a title="blah">example</a>' def test_attributes_wildcard(): @@ -602,6 +633,22 @@ # Disallowed protocols with sneaky character entities ('<a href="javas	cript:alert(1)">alert</a>', {}, "<a>alert</a>"), ('<a href="javascript:alert(1)">alert</a>', {}, "<a>alert</a>"), + # Disallowed protocols with Unicode characters injected + ( + '<a href="javascript\u200b:alert(1)">alert</a>', + {"protocols": ALLOWED_PROTOCOLS}, + "<a>alert</a>", + ), + ( + '<a href="\ufeffjavascript:alert(1)">alert</a>', + {"protocols": ALLOWED_PROTOCOLS}, + "<a>alert</a>", + ), + ( + '<a href="javascript\u00ad:alert(1)">alert</a>', + {"protocols": ALLOWED_PROTOCOLS}, + "<a>alert</a>", + ), # Checking the uri should change it at all ( '<a href="http://example.com/?foo bar";>foo</a>', diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/bleach-6.3.0/tox.ini new/bleach-6.4.0/tox.ini --- old/bleach-6.3.0/tox.ini 2025-10-13 16:41:57.000000000 +0200 +++ new/bleach-6.4.0/tox.ini 2026-06-05 13:14:54.000000000 +0200 @@ -6,7 +6,6 @@ py{310,311,312,313,314,py3}-tinycss2 py{310,311,312,313,314}-build-no-lang py310-docs - py310-format-check py310-lint py310-vendorverify @@ -17,7 +16,7 @@ 3.12: py312 3.13: py313 3.14: py314 - pypy-3.10: pypy3 + pypy-3.11: pypy3 [testenv] deps = -rrequirements-dev.txt @@ -93,31 +92,24 @@ [testenv:py310-lint] changedir = {toxinidir} -deps = -rrequirements-flake8.txt -platform = linux +platform = linux|darwin commands = - flake8 setup.py tests/ bleach/ tests_website/ + ruff format --check --target-version=py310 --exclude=_vendor setup.py bleach/ tests/ tests_website/ + ruff check --target-version=py310 --exclude=_vendor setup.py bleach/ tests/ tests_website/ [testenv:py310-vendorverify] allowlist_externals = {toxinidir}/scripts/vendor_verify.sh changedir = {toxinidir} deps = -rrequirements-dev.txt -platform = linux +platform = linux|darwin commands = {toxinidir}/scripts/vendor_verify.sh -[testenv:py310-format-check] -changedir = {toxinidir} -deps = -rrequirements-dev.txt -platform = linux -commands = - black --target-version=py310 --check --diff --exclude=_vendor setup.py bleach/ tests/ tests_website/ - [testenv:py310-docs] changedir = docs deps = -rrequirements-dev.txt +platform = linux|darwin extras = css -platform = linux commands = sphinx-build -b html -d {envtmpdir}/doctrees . {envtmpdir}/html sphinx-build -b doctest -d {envtmpdir}/doctrees . {envtmpdir}/doctest
