deeplook/svglib v2.3.2

on GitHub

Security

• A long run of digits in the arguments of a path arc command (A or a)
  could make parsing take exponential time, so a tiny SVG could block a
  process for minutes or longer (CWE-1333, CWE-400, GHSA-249c-7rgc-f52h).
  Arc arguments are now read one token at a time, without regex backtracking.
  Parsing of a malformed arc stops at the first argument that does not fit.

Fixed

• Accept explicit plus signs on arc rotation and endpoints, and tab, carriage
  return and line feed separators in transform arguments, as allowed by SVG
  (#524, thanks to @jdotc1).
• svg2rlg() no longer unpacks a .svgz file to a sibling .svg file, which
  overwrote an existing file of that name and then deleted it. The compressed
  data is now read as a stream (#518, thanks to @jdotc1).
• A <use> that refers to itself, or to a cycle of elements that each <use>
  the next one, no longer crashes with RecursionError. The offending <use>
  is skipped and an error is logged, as already done for cyclic references
  between external files (#519, thanks to @gistrec for the report).