Merge develop into main#1295
Merged
Merged
Conversation
- `ReactPy` class has been created as the standalone API for ReactPy. - `ReactPyMiddleware` has been created as the version of ReactPy that can wrap other ASGI web frameworks. - Added a template tag to use alongside our middleware. - `@reactpy/client` has been rewritten to be more modular. - `reactpy.backends.*` is removed.
- Add template tags for rendering pyscript components - Add `pyscript_component` component to embed pyscript components into standard ReactPy server-side applications - Create new ASGI app that can run standalone client-side ReactPy - Convert all ASGI dependencies into an optional `reactpy[asgi]` parameter to minimize client-side install size - Start throwing 404 errors when static files are not found
- Change our preferred type checker from MyPy to Pyright - Don't rely on `asgiref.types` as much, since they're a bit too strict and cause a lot of type errors in use code.
* Bug fix for corrupted hook state - change hook state to a contextvar --------- Co-authored-by: James Hutchison <122519877+JamesHutchison@users.noreply.github.com>
- Renamed `reactpy.utils.html_to_vdom` to `reactpy.utils.string_to_reactpy`. - Renamed `reactpy.utils.vdom_to_html` to `reactpy.utils.reactpy_to_string`. - `reactpy.utils.string_to_reactpy` has been upgraded to handle more complex scenarios without causing ReactJS rendering errors. - `reactpy.utils.reactpy_to_string` will now retain the user's original casing for element `data-*` and `aria-*` attributes. - Convert `pragma: no cover` comments to `nocov`
- Removed ``reactpy.vdom``. Use ``reactpy.Vdom`` instead. - Removed ``reactpy.core.make_vdom_constructor``. Use ``reactpy.Vdom`` instead. - Removed ``reactpy.core.custom_vdom_constructor``. Use ``reactpy.Vdom`` instead. - ``reactpy.html`` will now automatically flatten lists recursively (ex. ``reactpy.html(["child1", ["child2"]])``) - Added type hints to ``reactpy.html`` attributes.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| "</body>" | ||
| "</html>" | ||
| ) | ||
| self._etag = f'"{hashlib.md5(self._index_html.encode(), usedforsecurity=False).hexdigest()}"' |
Check failure
Code scanning / CodeQL
Use of a broken or weak cryptographic hashing algorithm on sensitive data
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 year ago
To address the issue, we will replace the use of hashlib.md5 with hashlib.sha256, a stronger cryptographic hash function. This change ensures that the generated _etag is more secure and resistant to collision attacks. The fix involves modifying the line where the MD5 hash is computed and updating it to use SHA-256 instead. No additional imports or dependencies are required, as hashlib already supports SHA-256.
Suggested changeset
1
src/reactpy/executors/asgi/pyscript.py
| @@ -119,3 +119,3 @@ | ||
| ) | ||
| self._etag = f'"{hashlib.md5(self._index_html.encode(), usedforsecurity=False).hexdigest()}"' | ||
| self._etag = f'"{hashlib.sha256(self._index_html.encode()).hexdigest()}"' | ||
| self._last_modified = formatdate( |
Copilot is powered by AI and may make mistakes. Always verify output.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The develop branch was temporarily made to track breaking changes from ReactPy v1 to v2. Since we are preparing to do a public beta release of v2, this branch is no longer relevant.
Checklist
Please update this checklist as you complete each item:
By submitting this pull request I agree that all contributions comply with this project's open source license(s).