Re: [BLFS Trac] #23149: mako-1.3.11 (Python module)

#23149: mako-1.3.11 (Python module)
-------------------------+------------------------
 Reporter:  Bruce Dubbs  |       Owner:  blfs-book
     Type:  enhancement  |      Status:  new
 Priority:  normal       |   Milestone:  13.1
Component:  BOOK         |     Version:  git
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+------------------------
Comment (by Douglas R. Reno):

 {{{
 1.3.11
 Released: Tue Apr 14 2026
 bug

     [bug] [template]

     Fixed issue in TemplateLookup where a URI with a double-slash prefix
 (e.g. //../../)
 could bypass the directory traversal check in Template, allowing reads of
 arbitrary
 files outside of the template directory. The issue was caused by an
 inconsistency in how
 leading slashes were stripped between TemplateLookup.get_template() and
 Template
 initialization.

     References: #434
 }}}

 This fixes a pretty important path traversal issue
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/blfs/ticket/23149#comment:1>
BLFS Trac <https://wiki.linuxfromscratch.org/blfs/>
Beyond Linux From Scratch

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-book
Unsubscribe: See the above information page