cadwyn 5.4.2__tar.gz → 5.4.3__tar.gz

cadwyn-5.4.3/.all-contributorsrc

@@ -0,0 +1,4 @@
+{
+    "projectName": "cadwyn",
+    "projectOwner": "zmievsa"
+}

{cadwyn-5.4.2 → cadwyn-5.4.3}/CHANGELOG.md

@@ -5,6 +5,12 @@ Please follow [the Keep a Changelog standard](https://keepachangelog.com/en/1.0.
 
 ## [Unreleased]
 
+## [5.4.3]
+
+### Fixed
+
+* XSS vulnerability in `/docs` and `/redoc` endpoints where the `version` parameter was not properly sanitized, allowing potential cross-site scripting attacks
+
 ## [5.4.2]
 
 ### Fixed

{cadwyn-5.4.2 → cadwyn-5.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cadwyn
-Version: 5.4.2
+Version: 5.4.3
 Summary: Production-ready community-driven modern Stripe-like API versioning in FastAPI
 Project-URL: Source code, https://github.com/zmievsa/cadwyn
 Project-URL: Documentation, https://docs.cadwyn.dev
@@ -88,3 +88,26 @@ The [documentation](https://docs.cadwyn.dev) has everything you need to succeed.
 ## Sponsors
 
 These are our gorgeous sponsors. They are using Cadwyn and are sponsoring it through various means. Contact [me](https://github.com/zmievsa) if you would like to become one, too!
+
+## Contributors
+
+<details>
+
+<summary>Thanks goes to these wonderful people:</summary>
+<a href="https://allcontributors.org/docs/en/emoji-key">Emoji Key </a>
+
+<!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section -->
+<!-- prettier-ignore-start -->
+<!-- markdownlint-disable -->
+
+<!-- markdownlint-restore -->
+<!-- prettier-ignore-end -->
+
+<!-- ALL-CONTRIBUTORS-LIST:END -->
+
+This project follows the [all-contributors](https://github.com/all-contributors/all-contributors) specification.
+Contributions are welcome!
+
+</details>
+
+<!-- contributors-end -->

{cadwyn-5.4.2 → cadwyn-5.4.3}/README.md

@@ -40,3 +40,26 @@ The [documentation](https://docs.cadwyn.dev) has everything you need to succeed.
 ## Sponsors
 
 These are our gorgeous sponsors. They are using Cadwyn and are sponsoring it through various means. Contact [me](https://github.com/zmievsa) if you would like to become one, too!
+
+## Contributors
+
+<details>
+
+<summary>Thanks goes to these wonderful people:</summary>
+<a href="https://allcontributors.org/docs/en/emoji-key">Emoji Key </a>
+
+<!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section -->
+<!-- prettier-ignore-start -->
+<!-- markdownlint-disable -->
+
+<!-- markdownlint-restore -->
+<!-- prettier-ignore-end -->
+
+<!-- ALL-CONTRIBUTORS-LIST:END -->
+
+This project follows the [all-contributors](https://github.com/all-contributors/all-contributors) specification.
+Contributions are welcome!
+
+</details>
+
+<!-- contributors-end -->

{cadwyn-5.4.2 → cadwyn-5.4.3}/cadwyn/applications.py

@@ -5,6 +5,7 @@ from datetime import date
 from logging import getLogger
 from pathlib import Path
 from typing import TYPE_CHECKING, Annotated, Any, Optional, Union, cast
+from urllib.parse import quote
 
 import fastapi
 from fastapi import APIRouter, FastAPI, HTTPException, routing
@@ -389,7 +390,7 @@ class Cadwyn(FastAPI):
 
         if version:
             root_path = self._extract_root_path(req)
-            openapi_url = root_path + f"{self.openapi_url}?version={version}"
+            openapi_url = root_path + f"{self.openapi_url}?version={quote(version, safe='')}"
             oauth2_redirect_url = self.swagger_ui_oauth2_redirect_url
             if oauth2_redirect_url:
                 oauth2_redirect_url = root_path + oauth2_redirect_url
@@ -407,7 +408,7 @@ class Cadwyn(FastAPI):
 
         if version:
             root_path = self._extract_root_path(req)
-            openapi_url = root_path + f"{self.openapi_url}?version={version}"
+            openapi_url = root_path + f"{self.openapi_url}?version={quote(version, safe='')}"
             return get_redoc_html(openapi_url=openapi_url, title=f"{self.title} - ReDoc")
 
         return self._render_docs_dashboard(req, docs_url=cast("str", self.redoc_url))

{cadwyn-5.4.2 → cadwyn-5.4.3}/docs/home/CONTRIBUTING.md

@@ -22,6 +22,7 @@ versions on your system.
 4. Make your changes
 5. Commit your changes to git.
 6. Open a [pull request](https://docs.github.com/en/pull-requests). Give the pull request a descriptive title indicating what it changes.
+7. Add yourself as a contributor using the [all-contributors bot](https://allcontributors.org/docs/en/bot/usage)
 
 ## Guidelines for writing code
 

{cadwyn-5.4.2 → cadwyn-5.4.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "cadwyn"
-version = "5.4.2"
+version = "5.4.3"
 description = "Production-ready community-driven modern Stripe-like API versioning in FastAPI"
 authors = [{ name = "Stanislav Zmiev", email = "zmievsa@gmail.com" }]
 license = "MIT"

{cadwyn-5.4.2 → cadwyn-5.4.3}/uv.lock

@@ -98,7 +98,7 @@ wheels = [
 
 [[package]]
 name = "cadwyn"
-version = "5.4.2"
+version = "5.4.3"
 source = { editable = "." }
 dependencies = [
     { name = "backports-strenum", marker = "python_full_version < '3.11'" },