RedCloth 4.3.1 → 4.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: f4dab006159116d5844e7b36a71a8f91137b348d
-  data.tar.gz: df7575fcd69f0277ea3bb4be5fc9a7d2e40fc2e4
+  metadata.gz: cb8013b7856c3d48cf999269f6e5ace370d013e0
+  data.tar.gz: 7de8b1d1218414598ebf7a0c89421a14679fa034
 SHA512:
-  metadata.gz: ff442c6bdda870628086f27ac426a365d219ca66b62be13da42ad56e1ed71de93eede49766a3bbf94944988aa971c99cc46c4055521945116154f9ca72dbf8ae
-  data.tar.gz: 44ab0803ef262e6ed09c58a181720a8a625653001e9b98ebf92d715f375646344d72f7af1e74e85f1788417274bc9e8fae1ecceede466c2728d045e0eef229a0
+  metadata.gz: 7e2a5a2be89e930fd388c0432413b41981d8862f27edf32bc32529db441e8b7380185d3dd221439ab3cb9cf2a89ff3cd1eb3f93d1577646ed07d7a264cbad4f7
+  data.tar.gz: 0a28c28367cc94dbb0a256bfae245fe75257cf5e821813b4f802ee79158771b0627e60ea70796b02118b31eb9b6d712473c70a0d4dd58d80d08dbb9921c53289

data/CHANGELOG

@@ -1,3 +1,7 @@
+== 4.3.2 / May 23rd, 2016
+
+* Fix additional case for CVE-2012-6684 [Joshua Siler]
+
 == 4.3.1 / May 17th, 2016
 
 * Fix additional case for CVE-2012-6684 [Joshua Siler]

data/lib/redcloth/formatters/html.rb

@@ -111,7 +111,7 @@ module RedCloth::Formatters::HTML
   end
   
   def link(opts)
-    if (filter_html || sanitize_html) && opts[:href] =~ /^\s*javascript:/
+    if (filter_html || sanitize_html) && opts[:href] =~ /^\s*javascript:/i
       opts[:name]
     else
       "<a href=\"#{escape_attribute opts[:href]}\"#{pba(opts)}>#{opts[:name]}</a>"
@@ -119,7 +119,7 @@ module RedCloth::Formatters::HTML
   end
   
   def image(opts)
-    if (filter_html || sanitize_html) && ( opts[:src] =~ /^\s*javascript:/ || opts[:href] =~ /^\s*javascript:/ )
+    if (filter_html || sanitize_html) && ( opts[:src] =~ /^\s*javascript:/i || opts[:href] =~ /^\s*javascript:/i )
       opts[:title]
     else
       opts.delete(:align)

data/lib/redcloth/version.rb

@@ -2,7 +2,7 @@ module RedCloth
   module VERSION
     MAJOR = 4
     MINOR = 3
-    TINY  = 1
+    TINY  = 2
 #    RELEASE_CANDIDATE = 0
 
     STRING = [MAJOR, MINOR, TINY].compact.join('.')

data/spec/security/CVE-2012-6684_spec.rb

@@ -8,6 +8,9 @@ describe 'CVE-2012-6684' do
     # PoC from http://co3k.org/blog/redcloth-unfixed-xss-en
     output = RedCloth.new('["clickme":javascript:alert(%27XSS%27)]', [:filter_html, :filter_styles, :filter_classes, :filter_ids]).to_html
     expect(output).to_not match(/href=.javascript:alert/)
+
+    output = RedCloth.new('["clickme":jAvascript:alert(%27XSS%27)]', [:filter_html, :filter_styles, :filter_classes, :filter_ids]).to_html
+    expect(output).to_not match(/href=.jAvascript:alert/)
   end
 
   it 'should not let javascript links pass through on images' do
@@ -18,5 +21,13 @@ describe 'CVE-2012-6684' do
     output = RedCloth.new('"!<javascript:alert(1)(2)!:javascript:prompt(document.domain)"', [:filter_html, :filter_styles, :filter_classes, :filter_ids]).to_html
     expect(output).to_not match(/src=.javascript:alert/)
     expect(output).to_not match(/href=.javascript:prompt/)
+
+    output = RedCloth.new('"!<jAvascript:alert(1)(2)!:jAvascript:prompt(document.domain)"').to_html
+    expect(output).to match(/src=.jAvascript:alert/)
+    expect(output).to match(/href=.jAvascript:prompt/)
+
+    output = RedCloth.new('"!<jAvascript:alert(1)(2)!:jAvascript:prompt(document.domain)"', [:filter_html, :filter_styles, :filter_classes, :filter_ids]).to_html
+    expect(output).to_not match(/src=.jAvascript:alert/)
+    expect(output).to_not match(/href=.jAvascript:prompt/)
   end
 end

data/tasks/release.rake

@@ -1,14 +1,14 @@
 namespace :release do
   desc 'Push all gems to rubygems.org'
   # git tag and push tag
+  # git tag vx.x.x
+  # git push --follow-tags
   # branch into stable vx.x branch
   # change version in version.rb
   # update changelog
   # run rake test
 
   task :gem do
-    puts "Did you git tag and git push the tag for this release yet?"
-    #sh("rm *.gem")
     sh("gem build redcloth.gemspec")
     sh("gem push RedCloth-*.gem")
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: RedCloth
 version: !ruby/object:Gem::Version
-  version: 4.3.1
+  version: 4.3.2
 platform: ruby
 authors:
 - Jason Garber
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-05-17 00:00:00.000000000 Z
+date: 2016-05-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -174,7 +174,7 @@ rubyforge_project: redcloth
 rubygems_version: 2.4.8
 signing_key: 
 specification_version: 4
-summary: RedCloth-4.3.1
+summary: RedCloth-4.3.2
 test_files:
 - spec/benchmark_spec.rb
 - spec/parser_spec.rb