diff options
| author | Kornelius Kalnbach <murphy@rubychan.de> | 2013-08-23 06:03:29 -0700 |
|---|---|---|
| committer | Kornelius Kalnbach <murphy@rubychan.de> | 2013-08-23 06:03:29 -0700 |
| commit | d9ee8379543c59e75e39a7a233df6639ee7d4160 (patch) | |
| tree | b3b4ab995e8270cdce5453c35378c5619670fb17 /Changes.textile | |
| parent | 21d07b305f6293065cf08134cee2c66e727422cf (diff) | |
| parent | 28c57a5f02ca066e66346a69db1bfe33fc6bfb6e (diff) | |
| download | coderay-d9ee8379543c59e75e39a7a233df6639ee7d4160.tar.gz | |
Merge pull request #149 from rubychan/fix-cache-attack
Fix Symbol/Cache attacks
Diffstat (limited to 'Changes.textile')
| -rw-r--r-- | Changes.textile | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/Changes.textile b/Changes.textile index f57faf5..e54970d 100644 --- a/Changes.textile +++ b/Changes.textile @@ -24,9 +24,14 @@ h2. Changes in 1.1 * New token type @:id@ for CSS/Sass [#27] * New token type @:done@ for Taskpaper [#39] * New token type @:map@ for Lua, introducing a nice nested-shades trick [#22, thanks to Quintus and Nathan Youngman] +* New token type @:unknown@ for Debug scanner * Display line numbers in HTML @:table@ mode even for single-line code (remove special case) [#41, thanks to Ariejan de Vroom] * Override Bootstrap's @pre { word-break: break-all }@ styling for line numbers [#102, thanks to lightswitch05] * Fixed @:docstring@ token type style +* Fixed several problems related to Hash caches and dynamic Symbol creation that might have been exploited by an attacker [#148] +* @PluginHost@ now works with Strings instead of Symbols internally (to avoid using @#to_sym@) +* The @Debug@ scanner maps unknown token kinds to @:unknown@ (to avoid creating Symbols based on possibly unsafe input) +* The @Raydebug@ scanner highlights unknown token kinds as @:plain@ * @Plugin@ does not warn about fallback when default is defined * @HTML@ encoder will not warn about unclosed token groups at the end of the stream * @Debug@ encoder refactored; use @DebugLint@ if you want strict checking now |