CHANGES.txt 1.3 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455
  1. Changelog
  2. =========
  3. defusedxml 0.4.1
  4. ----------------
  5. *Release date: 28-Mar-2013*
  6. - Add more demo exploits, e.g. python_external.py and Xalan XSLT demos.
  7. - Improved documentation.
  8. defusedxml 0.4
  9. --------------
  10. *Release date: 25-Feb-2013*
  11. - As per http://seclists.org/oss-sec/2013/q1/340 please REJECT
  12. CVE-2013-0278, CVE-2013-0279 and CVE-2013-0280 and use CVE-2013-1664,
  13. CVE-2013-1665 for OpenStack/etc.
  14. - Add missing parser_list argument to sax.make_parser(). The argument is
  15. ignored, though. (thanks to Florian Apolloner)
  16. - Add demo exploit for external entity attack on Python's SAX parser, XML-RPC
  17. and WebDAV.
  18. defusedxml 0.3
  19. --------------
  20. *Release date: 19-Feb-2013*
  21. - Improve documentation
  22. defusedxml 0.2
  23. --------------
  24. *Release date: 15-Feb-2013*
  25. - Rename ExternalEntitiesForbidden to ExternalReferenceForbidden
  26. - Rename defusedxml.lxml.check_dtd() to check_docinfo()
  27. - Unify argument names in callbacks
  28. - Add arguments and formatted representation to exceptions
  29. - Add forbid_external argument to all functions and classs
  30. - More tests
  31. - LOTS of documentation
  32. - Add example code for other languages (Ruby, Perl, PHP) and parsers (Genshi)
  33. - Add protection against XML and gzip attacks to xmlrpclib
  34. defusedxml 0.1
  35. --------------
  36. *Release date: 08-Feb-2013*
  37. - Initial and internal release for PSRT review