Florian Weimer

Make more functions available in fb.h with !FB_ACCESS_WRAPPER

Document fetch triggered by XML writer raw XML validation

Thank. Please proceed to make this issue public (if that's what you want to do). Red Hat does not require an embargo for this.

We received another closely related report. I've been instructed to mention: Found by AISLE in partnership with Red Hat The reconstructed reproducer: from docutils.core import publish_string PEP_RST = """\ PEP: 1 Title: </title><script>alert('XSS')</script> Author: Test Author Status: Draft Type: Standards Track Content-Type: text/x-rst Created: 01-Jan-2000 Body text. """ print(publish_string( PEP_RST, reader_name="pep", writer_name="pep_html", settings_overrides={ "raw_enabled": False, "file_insertion_enabled":...

XSS via unescaped HTML in PEP email masking transform

This avoids an error: i_read(spawn_id fd=6): invalid or incomplete multibyte or wide character

Disable text mode translation in unbuffer

The code is non-portable, but for ASCII character sets, the construct is fine because '\200' plus a printable character is in the range of char, whether char is signed or not. The cppcheck warning is bogus.