mirror of
https://git.yoctoproject.org/poky
synced 2026-09-20 12:49:33 +02:00
81c4f97c54
This patch applies the upstream fix as referenced in [2], using
the commit shown in [1].
The backport makes Template URI normalization strip all leading
slashes, preventing a double-slash URI from bypassing the path
traversal check while keeping Mako at version 1.3.2.
[1] e05ac61989
[2] https://github.com/advisories/GHSA-v92g-xgxw-vvmm
(From OE-Core rev: 0c13fdc7798a24dadb60b7dba60049558bf5c021)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>