mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-11-13 03:37:15 +00:00
python3-svglib: Upgrade 2.3.2 -> 2.3.3
Upgrade to release 2.3.3: Security: - The limit on <use> expansions added in 2.3.1 counted expansions, not their size. Each expansion copies and renders the whole element it refers to, so a few kilobytes of nested <use> groups with a large group at the bottom could still take minutes and gigabytes to render (CWE-400, GHSA-xpfm-fw4h-qxwv, an incomplete fix of GHSA-555j-qj3j-c8jv). The elements copied by all expansions of a document, external SVGs included, are now limited too (MAX_USE_CLONED_ELEMENTS, 20,000); once it is spent the remaining <use> elements are skipped and an error is logged. Thanks to Adrian Korwel for the report. Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This commit is contained in:
1 parent
6178510d46
commit
bab1ebbba3
1 file changed
+1
-1
@@ -0,0 +1,24 @@
|
||||
SUMMARY = "A pure-Python library for reading and converting SVG."
|
||||
DESCRIPTION = "Svglib is a Python library for reading SVG files and \
|
||||
converting them (to a reasonable degree) to other formats using the \
|
||||
ReportLab Open Source toolkit."
|
||||
|
||||
LICENSE = "LGPL-3.0-or-later"
|
||||
LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=b52f2d57d10c4f7ee67a7eb9615d5d24"
|
||||
|
||||
CVE_PRODUCT = "svglib"
|
||||
|
||||
SRC_URI[sha256sum] = "1aef52f3dc651416119b55716e673995d2c9f90c86a07df0b2bcf6de26c7e0ff"
|
||||
|
||||
inherit pypi python_hatchling
|
||||
|
||||
BBCLASSEXTEND = "native nativesdk"
|
||||
|
||||
RDEPENDS:${PN} = " \
|
||||
python3-pillow \
|
||||
python3-html \
|
||||
python3-cssselect2 \
|
||||
python3-webencodings \
|
||||
python3-lxml \
|
||||
python3-reportlab \
|
||||
"
|
||||
Reference in new issue
Block a user