Release Overview for 1.4.32

This page contains a high level description of the most notable changes in this release. For full details of user-visible changes, see the NEWS files in each module:

• xapian-core
• omega
• xapian-bindings

See also the full list of bug reports marked as fixed in this release.

C++ API

• MSet::snippet(): Fix missing escaping when parameters hi_start and hi_end are empty strings and text.size() <= length. This is essentially a missed corner case from ​CVE-2018-0499.

To be exploitable requires that hi_start and hi_end are empty, which is atypical usage in a web context (because highlighting search terms in snippets is very widespread and so expected by users), and searching FOSS code we didn't find any vulnerable usage. An attacker would also need to be able to supply content to the system, or find suitable content already in the system. Reported by Arpit Jain on the xapian-devel list.

Omega

• Fix date term filter for SPAN without START/END. In this case we're meant to use the current date as the end of the range, but were actually using the start of 1970. Bug introduced in 1.4.27. The value range filter case was unaffected by this bug. Fixes #853, reported by Darrin Smart.