caldav v3.4.1a0 - v3.4.1 without the niquests dependency
Security release: 3.4.0 with only the fix below. Also released without the niquests dependency as 3.4.1a0.
Security
- A small DoS-risk found. An attacker controlling the icalendar data flowing through the library can aggressively burn CPU-cycles.
vcal.fix(), run on every iCalendar object fetched from a server, took quadratic time on a long run of blanks or backslashes - 100 kB took more than 20 s, so a hostile server or a shared calendar could stall the client. The regexp has been fixed up and now takes linear time to run; the output is unchanged. Reported by @BrianWillows. GHSA-5h4q-xm57-3mh5 Also fixed in 3.5.0 and 3.3.2.