46a9d0e6f7
- Update to 6.5.4 * The in operator for HTTPHeaders was incorrectly case-sensitive, causing lookups to fail for headers with different casing than the original header name. This was a regression in version 6.5.3 and has been fixed to restore the intended case-insensitive behavior from version 6.5.2 and earlier. - Update to 6.5.3 (bsc#1254903, bsc#1254905, bsc#1254904) * Fixed a denial-of-service vulnerability involving quadratic computation when parsing multipart/form-data request bodies. CVE-2025-67726 Thanks to Finder16 for reporting this issue. * Fixed a denial-of-service vulnerability involving quadratic computation when parsing repeated HTTP headers. CVE-2025-67725. Thanks to Finder16 for reporting this issue. * Fixed a header injection and XSS vulnerability involving the reason argument to .RequestHandler.set_status and tornado.web.HTTPError. CVE-2025-67724. Thanks to Finder16 and Cheshire1225 for reporting this issue. * Several demo applications bundled with the Tornado repo (blog, chat, facebook) had an open redirect vulnerability which has been fixed. This is not covered by a CVE or security advisory since the demo applications are not included as a part of the Tornado package when installed, but developers who have copied code from these demos may which to review their own applications for open redirects. Thanks to J1vvoo for reporting this issue. * he s3server demo application contained some path traversal vulnerabilities. Since this demo application was not demonstrating any interesting aspects of Tornado, it has been deleted rather than being fixed. Thanks to J1vvoo for reporting this issue. - Update to 6.5.2 * Fixed a bug that resulted in WebSocket pings not being sent at the configured interval. * Improved logging for invalid Host headers. This was previously logged as an uncaught exception with a stack trace, now it is simply a 400 response (logged as a warning in the access log). * Restored the host argument to .HTTPServerRequest. This argument is deprecated and will be removed in the future, but its removal with no warning in 6.5.0 was a mistake. * Removed a debugging print statement that was left in the code. * Improved type hints for gen.multi. - Update to 6.5.1 * Fixed a bug in multipart/form-data parsing that could incorrectly reject filenames containing characters above U+00FF (i.e. most characters outside the Latin alphabet).
Steve Kowalik2025-12-18 23:48:04 +00:00
8f0aed5840
Accepting request 1277990 from devel:languages:python
Ana Guerrero2025-05-23 12:27:19 +00:00
d509d3561b
- Update to 6.5.0 (CVE-2025-47287, bsc#1243268): * Security Improvements: - Previously, malformed multipart-form-data requests could log multiple warnings and constitute a denial-of-service attack. Now an exception is raised at the first error, so there is only one log message per request. This fixes CVE-2025-47287. * General Changes: - Python 3.14 is now supported. Older versions of Tornado will work on Python 3.14 but may log deprecation warnings. - The free-threading mode of Python 3.13 is now supported on an experimental basis. Prebuilt wheels are not yet available for this configuration, but it can be built from source. - The minimum supported Python version is 3.9. * Deprecation Notices: - Support for obs-fold continuation lines in HTTP headers is deprecated and will be removed in Tornado 7.0, as is the use of carriage returns without line feeds as header separators. - The callback argument to websocket_connect is deprecated and will be removed in Tornado 7.0. Note that on_message_callback is not deprecated. - The log_message and args attributes of tornado.web.HTTPError are deprecated. Use the new get_message method instead.
Daniel Garcia2025-05-16 09:31:51 +00:00
da9e76faa6
Accepting request 1226139 from devel:languages:python
Ana Guerrero2024-11-26 19:55:22 +00:00
c3ee285ce0
- Update to 6.4.2: + Security Improvements: * Parsing of the cookie header is now much more efficient. The older algorithm sometimes had quadratic performance which allowed for a denial-of-service attack in which the server would spend excessive CPU time parsing cookies and block the event loop. (CVE-2024-52804, bsc#1233668)
Steve Kowalik2024-11-25 03:21:09 +00:00
108259eb7b
- update to 6.4: * https://www.tornadoweb.org/en/stable/releases/v6.4.0.html * Python 3.12 is now supported. - drop py312-datetime.patch (upstream) * The Content-Length header and chunked Transfer-Encoding sizes are now parsed more strictly (according to the relevant RFCs) to avoid potential request-smuggling vulnerabilities when * Do not test multi-line headers. - require python-backports.ssl_hostname only on python 2.x or 3.2. * This release fixes a path traversal vulnerability in StaticFileHandler, in which files whose names started with the static_path directory * SSLIOStream.connect and IOStream.start_tls now * Certificate validation will now use the system CA root certificates instead of certifi when possible (i.e. Python 2.7.9+ or 3.4+). * The default SSL configuration has become stricter, using ssl.create_default_context where available on the client side. (On the server side, applications are encouraged to migrate from * The deprecated classes in the tornado.auth module, GoogleMixin, + See more release details at - added python3 package
Dirk Mueller2024-01-03 10:28:18 +00:00
440d8d0f16
Accepting request 1112880 from devel:languages:python
Ana Guerrero2023-09-26 20:00:21 +00:00
4b07d776a9
Accepting request 1112758 from home:mcalabkova:branches:devel:languages:python:312
Matej Cepl2023-09-21 16:50:37 +00:00
444c98fdb2
- Add ignore-resourcewarning-doctests.patch to ignore ResourceWarnings when running doctests. - Use %autopatch macro instead of specific patch number macros
Steve Kowalik2019-11-18 04:02:23 +00:00
ffd7e28fa4
- Define TRAVIS to disable unreliable tests
Tomáš Chvátal
2019-11-08 15:02:44 +00:00
cef319f125
- Replace %fdupes -s with plain %fdupes; hardlinks are better.
Matej Cepl2019-10-14 14:46:09 +00:00
58645cf8ce
- Per discussion with RM switch back to python-tornado<version> system with python-tornado standing in as a metapkg
Tomáš Chvátal
2019-10-01 13:30:32 +00:00
9e9667542f
osc copypac from project:devel:languages:python package:python-tornado revision:115, using expand
Tomáš Chvátal
2019-10-01 13:26:17 +00:00
Dominique Leuenberger
Steve Kowalik
nkrapp
Ana Guerrero
Daniel Garcia
Matej Cepl
Dirk Mueller
Markéta Machová
Tomáš Chvátal