.. changelog::
:version: 1.4.3
:released: Tue Sep 22 2026
.. change::
:tags: bug, tests
:tickets: 441
Fixed regression caused in 1.4.2 where tests added to the suite were
unable to run directly on Windows, due to posix mechanics: the tests
force ``os.path`` to ``posixpath``, whereas
:meth:`.TemplateLookup.get_template` converts the configured directory
using ``os.path.sep``. These tests are now skipped on that platform,
where the traversal check is instead exercised against ``ntpath``
natively.
.. changelog::
:version: 1.4.2
:released: Tue Sep 22 2026
.. change::
:tags: bug, tests
:tickets: 440
Adjusted the test suite to accommodate for a change in Pygments 2.21.0
where the ``HtmlFormatter`` now renders ``"`` and ``'`` characters
literally rather than as HTML entities, which caused failures in tests
that assert against the rendered output of
:func:`.html_error_template`.
.. change::
:tags: bug, template
:tickets: 441
Fixed issue in :class:`.TemplateLookup` where a URI beginning with a
drive designator (e.g. ``C:/../../secret.txt``) could bypass the
directory
traversal check on Windows, allowing reads of arbitrary files outside of
the template directory. The check in :class:`.Template` normalized the
URI using ``os.path``, which on Windows is ``ntpath``; as ``ntpath``
splits
the drive designator off and treats the remainder as rooted, the ``..``
segments were absorbed before the check could inspect them.
Normalization
is now performed with ``posixpath``, which is the same module used by
:meth:`.TemplateLookup.get_template` to resolve the URI to a file.
Signed-off-by: Richard Purdie <[email protected]>
---
.../python/{python3-mako_1.4.1.bb => python3-mako_1.4.3.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-devtools/python/{python3-mako_1.4.1.bb =>
python3-mako_1.4.3.bb} (88%)
diff --git a/meta/recipes-devtools/python/python3-mako_1.4.1.bb
b/meta/recipes-devtools/python/python3-mako_1.4.3.bb
similarity index 88%
rename from meta/recipes-devtools/python/python3-mako_1.4.1.bb
rename to meta/recipes-devtools/python/python3-mako_1.4.3.bb
index 367a65271f5..41bccec9ebc 100644
--- a/meta/recipes-devtools/python/python3-mako_1.4.1.bb
+++ b/meta/recipes-devtools/python/python3-mako_1.4.3.bb
@@ -6,7 +6,7 @@ LIC_FILES_CHKSUM =
"file://LICENSE;md5=c79ceff89df0a72f29bb0e1b6f0e36ed"
inherit pypi python_setuptools_build_meta ptest-python-pytest
-SRC_URI[sha256sum] =
"d7904710b662996425a21627710c4777c45053146942cf8a7aebf757c92b8c27"
+SRC_URI[sha256sum] =
"cd6537fe88d5fec315c55c2f8529bc4ce7a9a352ad7db3eeaa6a66e2dd4ec37a"
CVE_PRODUCT = "makotemplates:mako sqlalchemy:mako"
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#246518):
https://lists.openembedded.org/g/openembedded-core/message/246518
Mute This Topic: https://lists.openembedded.org/mt/121392800/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
