RedCloth 4.3.0 → 4.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: b7fe64e2539886d29943f4e885d85dcf8dc03447
-  data.tar.gz: 9459eee884a36becdf207f1d5392840bae5e45d8
+  metadata.gz: f4dab006159116d5844e7b36a71a8f91137b348d
+  data.tar.gz: df7575fcd69f0277ea3bb4be5fc9a7d2e40fc2e4
 SHA512:
-  metadata.gz: 4530cd8f7da18a7240faf7fb0f03e8ee6fa34120db0bbee548c4df6d6a3725f9030e703eb891228a0238f67bbfce65d8c601f26d43795b9b14f3e37bdebc786d
-  data.tar.gz: 40dd60702099cd06ae4480d00714e3d155c914ea87fc0f24f12d2c2ea4bc114e206740248ea9f7928575a5668d7d53d6b26c33f1ef4623652ee1a98b4f63090c
+  metadata.gz: ff442c6bdda870628086f27ac426a365d219ca66b62be13da42ad56e1ed71de93eede49766a3bbf94944988aa971c99cc46c4055521945116154f9ca72dbf8ae
+  data.tar.gz: 44ab0803ef262e6ed09c58a181720a8a625653001e9b98ebf92d715f375646344d72f7af1e74e85f1788417274bc9e8fae1ecceede466c2728d045e0eef229a0

data/CHANGELOG

@@ -1,3 +1,7 @@
+== 4.3.1 / May 17th, 2016
+
+* Fix additional case for CVE-2012-6684 [Joshua Siler]
+
 == 4.3.0 / April 29th, 2016
 
 * Remove JRuby and Windows cross compilation and support

data/lib/redcloth/formatters/html.rb

@@ -119,11 +119,15 @@ module RedCloth::Formatters::HTML
   end
   
   def image(opts)
-    opts.delete(:align)
-    opts[:alt] = opts[:title]
-    img = "<img src=\"#{escape_attribute opts[:src]}\"#{pba(opts)} alt=\"#{escape_attribute opts[:alt].to_s}\" />"  
-    img = "<a href=\"#{escape_attribute opts[:href]}\">#{img}</a>" if opts[:href]
-    img
+    if (filter_html || sanitize_html) && ( opts[:src] =~ /^\s*javascript:/ || opts[:href] =~ /^\s*javascript:/ )
+      opts[:title]
+    else
+      opts.delete(:align)
+      opts[:alt] = opts[:title]
+      img = "<img src=\"#{escape_attribute opts[:src]}\"#{pba(opts)} alt=\"#{escape_attribute opts[:alt].to_s}\" />"  
+      img = "<a href=\"#{escape_attribute opts[:href]}\">#{img}</a>" if opts[:href]
+      img
+    end
   end
   
   def footno(opts)

data/lib/redcloth/version.rb

@@ -2,7 +2,7 @@ module RedCloth
   module VERSION
     MAJOR = 4
     MINOR = 3
-    TINY  = 0
+    TINY  = 1
 #    RELEASE_CANDIDATE = 0
 
     STRING = [MAJOR, MINOR, TINY].compact.join('.')

data/spec/security/CVE-2012-6684_spec.rb

@@ -10,5 +10,13 @@ describe 'CVE-2012-6684' do
     expect(output).to_not match(/href=.javascript:alert/)
   end
 
+  it 'should not let javascript links pass through on images' do
+  	output = RedCloth.new('"!<javascript:alert(1)(2)!:javascript:prompt(document.domain)"').to_html
+    expect(output).to match(/src=.javascript:alert/)
+    expect(output).to match(/href=.javascript:prompt/)
 
+    output = RedCloth.new('"!<javascript:alert(1)(2)!:javascript:prompt(document.domain)"', [:filter_html, :filter_styles, :filter_classes, :filter_ids]).to_html
+    expect(output).to_not match(/src=.javascript:alert/)
+    expect(output).to_not match(/href=.javascript:prompt/)
+  end
 end

data/tasks/release.rake

@@ -1,8 +1,14 @@
 namespace :release do
   desc 'Push all gems to rubygems.org'
+  # git tag and push tag
+  # branch into stable vx.x branch
+  # change version in version.rb
+  # update changelog
+  # run rake test
+
   task :gem do
     puts "Did you git tag and git push the tag for this release yet?"
-    sh("rm *.gem")
+    #sh("rm *.gem")
     sh("gem build redcloth.gemspec")
     sh("gem push RedCloth-*.gem")
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: RedCloth
 version: !ruby/object:Gem::Version
-  version: 4.3.0
+  version: 4.3.1
 platform: ruby
 authors:
 - Jason Garber
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-05-02 00:00:00.000000000 Z
+date: 2016-05-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -174,7 +174,7 @@ rubyforge_project: redcloth
 rubygems_version: 2.4.8
 signing_key: 
 specification_version: 4
-summary: RedCloth-4.3.0
+summary: RedCloth-4.3.1
 test_files:
 - spec/benchmark_spec.rb
 - spec/parser_spec.rb