CVS commit: pkgsrc/textproc/py-lxml-html-clean

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Mon Oct 26 15:43:33 UTC 2026

Modified Files:
        pkgsrc/textproc/py-lxml-html-clean: Makefile distinfo

Log Message:
py-lxml-html-clean: updated to 0.4.6

0.4.6 (2026-10-26)

Bugs fixed

* Fixed a ReDoS (regular expression denial of service) vulnerability in the
  CSS ``expression()`` sanitizer. The pattern ``expression\s*\(.*?\)`` with
  ``re.S`` was quadratic when input contained many ``expression(`` tokens
  without a closing parenthesis. The body is now bounded to 1024 characters;
  longer bodies are handled fail-closed by ``_has_sneaky_javascript()``, which
  drops the entire style. Reported by Brian Willows.

* Fixed a ReDoS vulnerability in the conditional comment detector used when
  ``comments=False``. The pattern ``\[if\s+.*?]\s*>`` with ``re.S`` was
  quadratic when comment text contained many ``[if`` tokens without a closing
  ``]>``. Replaced with a linear two-pass search. Reported by Brian Willows.

* Fixed a ReDoS vulnerability in the CSS comment stripper. The pattern
  ``/\*.*?\*/`` with ``re.S`` was quadratic when style content contained many
  ``/*`` tokens without a closing ``*/``. Replaced with a linear
  ``str.find()``-based scan. Reachable under default configuration via
  ``<style>`` element content.

* Fixed a ReDoS vulnerability in the image data-URL scanner. The pattern
  ``data:image/(.+?);base64,`` was quadratic when input contained many
  ``data:image/`` tokens without a following ``;base64,``. The MIME subtype
  body is now bounded to 255 characters. Reachable under default configuration
  via link attributes and ``<style>`` element content.


To generate a diff of this commit:
cvs rdiff -u -r1.16 -r1.17 pkgsrc/textproc/py-lxml-html-clean/Makefile
cvs rdiff -u -r1.11 -r1.12 pkgsrc/textproc/py-lxml-html-clean/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/textproc/py-lxml-html-clean/Makefile
diff -u pkgsrc/textproc/py-lxml-html-clean/Makefile:1.16 pkgsrc/textproc/py-lxml-html-clean/Makefile:1.17
--- pkgsrc/textproc/py-lxml-html-clean/Makefile:1.16    Fri Oct 16 19:44:17 2026
+++ pkgsrc/textproc/py-lxml-html-clean/Makefile Mon Oct 26 15:43:33 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.16 2026/10/16 19:44:17 adam Exp $
+# $NetBSD: Makefile,v 1.17 2026/10/26 15:43:33 adam Exp $
 
-DISTNAME=      lxml_html_clean-0.4.5
+DISTNAME=      lxml_html_clean-0.4.6
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:S/_/-/g}
 CATEGORIES=    textproc python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=l/lxml-html-clean/}

Index: pkgsrc/textproc/py-lxml-html-clean/distinfo
diff -u pkgsrc/textproc/py-lxml-html-clean/distinfo:1.11 pkgsrc/textproc/py-lxml-html-clean/distinfo:1.12
--- pkgsrc/textproc/py-lxml-html-clean/distinfo:1.11    Fri May 22 12:50:00 2026
+++ pkgsrc/textproc/py-lxml-html-clean/distinfo Mon Oct 26 15:43:33 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.11 2026/05/22 12:50:00 adam Exp $
+$NetBSD: distinfo,v 1.12 2026/10/26 15:43:33 adam Exp $
 
-BLAKE2s (lxml_html_clean-0.4.5.tar.gz) = a954aa1bdb1309e59f505d2a7629986e6e61469248f69b39c315e5ff4f9b488a
-SHA512 (lxml_html_clean-0.4.5.tar.gz) = 3be6270eb583c0a0124c0369b6871acf0dbc26da1ea3221e00858af83e127d33182db2495ceb9c64e16650993748e2bc6fc3192059ba296cf14a36bc6b8a7607
-Size (lxml_html_clean-0.4.5.tar.gz) = 24142 bytes
+BLAKE2s (lxml_html_clean-0.4.6.tar.gz) = 862a2e6239464278e6a99fc4fabd711fff77f31637f034f2c4b067ec53f10263
+SHA512 (lxml_html_clean-0.4.6.tar.gz) = 55aabf4f1e96f2ca9a12acf9c7556bf0619de2b1c89cfc1015e84754b6968f3b774c9377ef53321b7cace95eacc6ed18344d14ea5cc3c88e5839579be0e898d4
+Size (lxml_html_clean-0.4.6.tar.gz) = 26385 bytes