crass 1.0.7 → 1.0.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a90afad390dcbfa666bb15dcc55ff6bc7711a4fabd9e5a920c53783bc22d2c8b
-  data.tar.gz: ba5fe09c8233f06503da5bf0f89a9c716cb19aa6b867eb6e1bff3f3d7153446d
+  metadata.gz: 4519ecea822a7a2632913d4ed71cb69c7258f52be999546e0cf6c3e07b3c1977
+  data.tar.gz: 679720a3e80e1cd1b7a9a2e74918006deb3f515f1f1adef72675f2e34b031231
 SHA512:
-  metadata.gz: efc02970ebefe0e0baf624b97c4aa43f9ce95c39acb7c3a8ccd8e5e74d56545bf9ee4efb0b5d67ba4c5e80f1c13563e8fbc1332feea7cd0ac6c207312c57cab4
-  data.tar.gz: 999316893f90a5f3a7fc9cd48dd20f2f1afd8c3087e772bec065bde19bfe08ad59d7430e786b232bd03f78a3f8054bc79cb4800130cab66ddaf93aff1dcc4a47
+  metadata.gz: f10e1e6862c2af99e8a703695cd88576cbe67d4bfd12f11d2eaed16d5a2d0bc1662a515b1e43e2e7371a0bef42f86a7af04dc1f5c4a84fe2136d7c6bebae0f47
+  data.tar.gz: c55f035f81dbaa5a3a0abfd0fcbb2636ec151ae24e50806e3bcd871a10af281a35b3d892281a15bade02fb36bc38de945fa547110c74442e2fac3f86b910a204

data/HISTORY.md

@@ -1,5 +1,11 @@
 # Crass Changelog
 
+## 1.0.8 (2026-10-21)
+
+### Security
+
+- Moderate: Fixed a tokenizer bug in which a `)` following an escaped backslash (`\\`) inside a bad URL didn't terminate the bad URL token, causing Crass to consume more input than a spec-compliant browser would. CSS sanitizers built on Crass could be tricked into passing through declarations, rules, or at-rules that a browser would then apply. (GHSA-pq4g-8rxf-4g29)
+
 ## 1.0.7 (2026-06-25)
 
 ### Security

data/SECURITY.md

@@ -0,0 +1,3 @@
+# Security Policy
+
+To report a security vulnerability in Crass, please email [ryan@wonko.com](mailto:ryan@wonko.com) or use GitHub's [Report a vulnerability](https://github.com/rgrove/crass/security/advisories/new) feature.

data/lib/crass/tokenizer.rb

@@ -89,7 +89,7 @@ module Crass
 
       case char.to_sym
       when :'"'
-        consume_string
+        consume_string(char)
 
       when :'#'
         if @s.peek =~ RE_NAME || valid_escape?(@s.peek(2))
@@ -109,7 +109,7 @@ module Crass
         end
 
       when :"'"
-        consume_string
+        consume_string(char)
 
       when :'('
         create_token(:'(')
@@ -132,7 +132,7 @@ module Crass
         end
 
       when :+
-        if start_number?
+        if start_number?(char + @s.peek(2))
           @s.reconsume
           consume_numeric
         else
@@ -161,7 +161,7 @@ module Crass
         end
 
       when :'.'
-        if start_number?
+        if start_number?(char + @s.peek(2))
           @s.reconsume
           consume_numeric
         else
@@ -196,7 +196,7 @@ module Crass
         create_token(:'[')
 
       when :'\\'
-        if valid_escape?
+        if valid_escape?(char + @s.peek)
           @s.reconsume
           consume_ident
         else
@@ -277,9 +277,7 @@ module Crass
       text = String.new
 
       until @s.eos?
-        if valid_escape?
-          text << consume_escaped
-        elsif valid_escape?(@s.peek(2))
+        if valid_escape?(@s.peek(2))
           @s.consume
           text << consume_escaped
         else
@@ -320,8 +318,8 @@ module Crass
     # Consumes an escaped code point and returns its unescaped value.
     #
     # This method assumes that the `\` has already been consumed, and that the
-    # next character in the input has already been verified not to be a newline
-    # or EOF.
+    # next character in the input has already been verified not to be a
+    # newline. If the input is at EOF, U+FFFD is returned.
     #
     # 4.3.8. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#consume-an-escaped-code-point
     def consume_escaped
@@ -384,7 +382,7 @@ module Crass
 
         char = @s.consume
 
-        if valid_escape?
+        if valid_escape?(char + @s.peek)
           result << consume_escaped
 
         # Non-standard: IE * hack
@@ -567,7 +565,7 @@ module Crass
             :value => value + consume_bad_url)
 
         when '\\'
-          if valid_escape?
+          if valid_escape?(char + @s.peek)
             value << consume_escaped
           else
             # Parse error.

data/lib/crass/version.rb

@@ -1,5 +1,5 @@
 # encoding: utf-8
 
 module Crass
-  VERSION = '1.0.7'
+  VERSION = '1.0.8'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: crass
 version: !ruby/object:Gem::Version
-  version: 1.0.7
+  version: 1.0.8
 platform: ruby
 authors:
 - Ryan Grove
@@ -52,6 +52,7 @@ files:
 - LICENSE
 - README.md
 - Rakefile
+- SECURITY.md
 - crass.gemspec
 - lib/crass.rb
 - lib/crass/parser.rb
@@ -64,10 +65,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rgrove/crass/issues
-  changelog_uri: https://github.com/rgrove/crass/blob/v1.0.7/HISTORY.md
-  documentation_uri: https://www.rubydoc.info/gems/crass/1.0.7
+  changelog_uri: https://github.com/rgrove/crass/blob/v1.0.8/HISTORY.md
+  documentation_uri: https://www.rubydoc.info/gems/crass/1.0.8
   rubygems_mfa_required: 'true'
-  source_code_uri: https://github.com/rgrove/crass/tree/v1.0.7
+  source_code_uri: https://github.com/rgrove/crass/tree/v1.0.8
 rdoc_options: []
 require_paths:
 - lib
@@ -82,7 +83,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.20
 specification_version: 4
 summary: CSS parser based on the CSS Syntax Level 3 spec.
 test_files: []