mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-11-13 03:37:15 +00:00
Leon Anavi
bab1ebbba3
Upgrade to release 2.3.3: Security: - The limit on <use> expansions added in 2.3.1 counted expansions, not their size. Each expansion copies and renders the whole element it refers to, so a few kilobytes of nested <use> groups with a large group at the bottom could still take minutes and gigabytes to render (CWE-400, GHSA-xpfm-fw4h-qxwv, an incomplete fix of GHSA-555j-qj3j-c8jv). The elements copied by all expansions of a document, external SVGs included, are now limited too (MAX_USE_CLONED_ELEMENTS, 20,000); once it is spent the remaining <use> elements are skipped and an error is logged. Thanks to Adrian Korwel for the report. Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
25 lines
693 B
BlitzBasic
25 lines
693 B
BlitzBasic
SUMMARY = "A pure-Python library for reading and converting SVG."
|
|
DESCRIPTION = "Svglib is a Python library for reading SVG files and \
|
|
converting them (to a reasonable degree) to other formats using the \
|
|
ReportLab Open Source toolkit."
|
|
|
|
LICENSE = "LGPL-3.0-or-later"
|
|
LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=b52f2d57d10c4f7ee67a7eb9615d5d24"
|
|
|
|
CVE_PRODUCT = "svglib"
|
|
|
|
SRC_URI[sha256sum] = "1aef52f3dc651416119b55716e673995d2c9f90c86a07df0b2bcf6de26c7e0ff"
|
|
|
|
inherit pypi python_hatchling
|
|
|
|
BBCLASSEXTEND = "native nativesdk"
|
|
|
|
RDEPENDS:${PN} = " \
|
|
python3-pillow \
|
|
python3-html \
|
|
python3-cssselect2 \
|
|
python3-webencodings \
|
|
python3-lxml \
|
|
python3-reportlab \
|
|
"
|