Companies/PyPI (Python Infrastructure)/Incidents

PyPI (Python Infrastructure): Failure to Escape HTML on PyPI

Timeline of updates

1. resolved2015-08-27 23:51 UTC

   It has come to our attention that in certain cases PyPI failed to correctly escape HTML that was uploaded as the long_description for projects. This was specific to projects whose long_description fields did not successfully render as reStructuredText and fell back to the plaintext rendering code. It was introduced in commit e2ea08abfb on 2015-01-24. We have found no evidence of any projects exploiting this and we do not believe that anyone is at risk. This issue was discovered by Keryn Knight whom we'd like to thank for finding it and reporting it to us. The timeline of what occured is: * 2015-08-26 @ 1700 UTC - I received an email by Keryn Knight reporting the issue. * 2015-08-26 @ 1703 UTC - I responded to the email confirming the problem and asserting I’d have the problem fixed shortly. * 2015-08-26 @ 1743 UTC - Fixes pushed to https://testpypi.python.org/ (opens in new tab) * 2015-08-26 @ 1746 UTC - Fixes pushed to https://pypi.python.org/ (opens in new tab) * 2015-08-26 @ 1805 UTC - Fixes pushed to https://warehouse-staging.python.org/ (opens in new tab) * 2015-08-26 @ 1809 UTC - Fixes pushed to https://warehouse.python.org/ (opens in new tab) * 2015-08-26 @ 1815 UTC - Emailed Keryn Knight confirming the fix had been deployed. - Donald Stufft

From PyPI (Python Infrastructure)’s published incident history: for incidents before Rewindex began polling this status page, only the final update text is available.

Impact, status and times are the vendor’s own, as last archived. View on status.python.org (opens in new tab).

PyPI (Python Infrastructure) profileRecent PyPI (Python Infrastructure) incidentsAll outages on August 27, 2015PyPI (Python Infrastructure) in August 2015MarkdownJSON