- Update to version 1.0.0:
* Security related: Bewit MACs were not compared in constant time
and were thus possibly circumventable by an attacker.
* Breaking change: Escape characters in header values (such as a
back slash) are no longer allowed, potentially breaking clients
that depended on this behavior.
* A sender is allowed to omit the content hash as long as their
request has no content. The `mohawk.Receiver` will skip the
content hash check in this situation, regardless of the value
of accept_untrusted_content.
* Introduced max limit of 4096 characters in the Authorization
header.
* Changed default values of content and content_type arguments to
`mohawk.base.EmptyValue` in order to differentiate between
misconfiguration and cases where these arguments are explicitly
given as None (as with some web frameworks).
* Failing to pass content and content_type arguments to
`mohawk.Receiver` or `mohawk.Sender.accept_response` without
specifying accept_untrusted_content=True will now raise
`mohawk.exc.MissingContent` instead of `ValueError`.
OBS-URL: https://build.opensuse.org/request/show/664544
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-mohawk?expand=0&rev=3
* Security related: Bewit MACs were not compared in constant time
and were thus possibly circumventable by an attacker.
* Breaking change: Escape characters in header values (such as a
back slash) are no longer allowed, potentially breaking clients
that depended on this behavior.
* A sender is allowed to omit the content hash as long as their
request has no content. The `mohawk.Receiver` will skip the
content hash check in this situation, regardless of the value
of accept_untrusted_content.
* Introduced max limit of 4096 characters in the Authorization
header.
* Changed default values of content and content_type arguments to
`mohawk.base.EmptyValue` in order to differentiate between
misconfiguration and cases where these arguments are explicitly
given as None (as with some web frameworks).
* Failing to pass content and content_type arguments to
`mohawk.Receiver` or `mohawk.Sender.accept_response` without
specifying accept_untrusted_content=True will now raise
`mohawk.exc.MissingContent` instead of `ValueError`.
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-mohawk?expand=0&rev=5
