caldav v3.3.2a0 - v3.3.2 without the niquests dependency
Security release: 3.3.1 with only the fix below. Also released without the niquests dependency as 3.3.2a0.
Security
- A small DoS-risk found. An attacker controlling the icalendar data flowing through the library can aggressively burn CPU-cycles.
vcal.fix(), run on every iCalendar object fetched from a server, took quadratic time on a long run of blanks or backslashes - 100 kB took more than 20 s, so a hostile server or a shared calendar could stall the client. The regexp has been fixed up and now takes linear time to run; the output is unchanged. Reported by @BrianWillows. GHSA-5h4q-xm57-3mh5 Also fixed in 3.5.0 and 3.4.1.