Repository navigation
·
4 commits
to master
since this release
5.2.3
colinodell
Colin O'Dell
This tag was signed with the committer’s verified signature.
colinodell
Colin O'Dell
905eb93
This commit was signed with the committer’s verified signature.
colinodell
Colin O'Dell
This is a security release. All users who convert HTML they don't fully control should upgrade.
Security
- Fixed the time taken to convert certain documents growing with the square of their size, rather than in proportion to it (GHSA-4xjf-2r66-5r28). This affected a long run of backslashes before inline code, content after a large list item, many comments or processing instructions outside of
<html>, and processing instructions anywhere, as well as misplaced table parts and long runs of backslashes in table cells whenTableConverteris used.
The fixes for these issues do not change the Markdown which is output.
Fixed
- Fixed text inside of
<pre>and<code>which looked like those tags, such as</pre>, being removed - Fixed attribute values of
<pre>and<code>containing>being output as part of their content - Fixed code nested inside of other code which is kept as HTML being encoded twice
Full Changelog: 5.2.2...5.2.3