search

Tethik / flask-session-captcha

A captcha implemention for flask
MIT License
24 stars 8 forks source link

Add support to Pillow > 10 #42

Closed jrdiniz closed 9 months ago

jrdiniz commented 9 months ago

I'm receive this error after update Pillow package

File "/home/juliano/apps/app-video-distribution/env/lib/python3.10/site-packages/captcha/image.py", line 165, in _draw_character w, h = draw.textsize(c, font=font) AttributeError: 'ImageDraw' object has no attribute 'textsize'

Minor version of Pillow has security issues

An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.

jrdiniz commented 9 months ago

Can be solve update the captcha package to 0.5

Tethik commented 9 months ago

Hey, I just saw this. Does the captcha package need to be bumped? @jrdiniz

jrdiniz commented 9 months ago

Hi @Tethik

Not really, I'm using the Python venv module to manage the virtual environment of my app, and the extension is using Pipenv (I think) with the "*" in the Pipfile. It's best practice to set dependency versions in requirements.txt or Pipfile. I don't know anything about publishing a pip package; maybe it's necessary to update version dependencies.

Thanks for the project, it's very helpful.