Skip to content

v1.1.3

Latest
Latest

Choose a tag to compare

View all tags
@lavr lavr released this 28 Sep 21:55
v1.1.3
cb5175c

Security

Fixes GHSA-g9x3-2q64-m592 (SSRF via remote CSS and images in untrusted HTML).

  • SSRF hardening when fetching external CSS and images during HTML transformation and loading: urls (including every redirect hop) whose host resolves to a loopback, private, link-local or other non-public address are rejected with emails.UnsafeURLError. Use emails.utils.url_validator to customize or disable the check for trusted HTML. This is a mitigation: DNS rebinding, proxies from the environment and .netrc credentials are not covered; restrict egress traffic when rendering untrusted HTML.
  • CSS @import rules are no longer fetched while inlining styles.
  • TLS certificates are now verified when fetching remote resources (verify=True by default).
  • External stylesheets are now loaded via fetch_url, so they honor requests_params and the default timeout.

Behavior change

Fetching resources from loopback/private hosts (e.g. emails.loader.from_url("http://localhost/...")) now raises emails.UnsafeURLError. Set emails.utils.url_validator = None if your HTML comes from trusted sources only.

Full Changelog: v1.1.2...v1.1.3

Assets 2
Loading