css_parser 1.13.0 → 3.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9bad6c42b4f2fbda14292b503c3f381ea4b3a9a4b77c74dd44da724866237901
-  data.tar.gz: 0b47ed4ef7d197a5552af3a99db42b89a8937cca205c7b6cf865cfb930d2d265
+  metadata.gz: 7286523850595059190f244936748ce609fc7d22de85ef56d5c5c229bd9a4ba4
+  data.tar.gz: 64fe512e21e1687c4221be94793eedbf603bd5723ef32a804177f70ba96e41b7
 SHA512:
-  metadata.gz: e91f481e093e423b873fcfd673bda8337645b066a7c278bea28175f8e11d94d9ac1dc401fc7defa1f8afca11d9125f7007aa8c12e1a4410351511f6e876bf593
-  data.tar.gz: 0fd7db359a459575bc2b7f08b5d6f86d5d78c58247af82db87884e5a1e10e768f9f3f0247abf2d491ebf30c9df8ec623fd65c8c51bf089fa29eba9cf75a9d9ac
+  metadata.gz: 63fa1631ae27fb97c375eb50d2e2b29f99e029872be0ad82191834818ad989470517c7d52cb77291a6a2a58fd920c3d1aa10a6250b5b569641016c77862b57cc
+  data.tar.gz: e6c24be4780b12aff38d866e5f0bc6b2b17deb78a94d2bb5072ec23bd82fcd70e1bcab63e4e02e915d2796e09dcaf9f5a239614c5c792d33003bb8ef0ca89d00

data/lib/css_parser/parser.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'strscan'
+
 module CssParser
   # Exception class used for any errors encountered while downloading remote files.
   class RemoteFileError < IOError; end
@@ -15,9 +17,11 @@ module CssParser
   # [<tt>absolute_paths</tt>] Convert relative paths to absolute paths (<tt>href</tt>, <tt>src</tt> and <tt>url('')</tt>. Boolean, default is <tt>false</tt>.
   # [<tt>import</tt>] Follow <tt>@import</tt> rules. Boolean, default is <tt>true</tt>.
   # [<tt>io_exceptions</tt>] Throw an exception if a link can not be found. Boolean, default is <tt>true</tt>.
+  # [<tt>allow_local_network</tt>] Permit http(s) fetches against loopback / private / link-local / cloud-metadata addresses. Boolean, default is <tt>false</tt>. When <tt>false</tt> (the default), outbound HTTP requests are routed through <tt>ssrf_filter</tt>, which resolves the host and rejects unsafe IP ranges. Set to <tt>true</tt> only when the destination is known to be safe (e.g. local fixture servers in tests). Independent of <tt>allow_file_uris</tt>.
+  # [<tt>allow_file_uris</tt>] Permit <tt>file://</tt> URIs via <tt>load_uri!</tt>. Boolean, default is <tt>false</tt>. When <tt>false</tt> (the default), a caller that passes a <tt>file://</tt> URI to <tt>load_uri!</tt> — directly or via a CSS <tt>@import</tt> resolved against a <tt>file://</tt> base_uri — is refused, closing the local-file-disclosure vector when the URI is influenced by user input. <tt>load_file!</tt> is unaffected: it is the explicit local-file API and takes a caller-supplied path. Independent of <tt>allow_local_network</tt>.
   class Parser
-    USER_AGENT = "Ruby CSS Parser/#{CssParser::VERSION} (https://github.com/premailer/css_parser)"
-
+    USER_AGENT = "Ruby CSS Parser/#{CssParser::VERSION} (https://github.com/premailer/css_parser)".freeze
+    RULESET_TOKENIZER_RX = /\s+|\\{2,}|\\?[{}\s"]|[()]|.[^\s"{}()\\]*/.freeze
     STRIP_CSS_COMMENTS_RX = %r{/\*.*?\*/}m.freeze
     STRIP_HTML_COMMENTS_RX = /<!--|-->/m.freeze
 
@@ -26,27 +30,31 @@ module CssParser
 
     MAX_REDIRECTS = 3
 
-    # Array of CSS files that have been loaded.
-    attr_reader   :loaded_uris
+    # Schemes accepted by `read_remote_file`. `file://` is intentionally
+    # NOT in this list — local files are handled directly by `load_uri!`
+    # and `load_file!`. Keeping `file://` out of the remote read path
+    # closes the cross-scheme redirect (HTTP 3xx → `file://`) vector that
+    # was GHSA-9pmc-p236-855h.
+    REMOTE_ALLOWED_SCHEMES = %w[http https].freeze
 
-    #--
-    # Class variable? see http://www.oreillynet.com/ruby/blog/2007/01/nubygems_dont_use_class_variab_1.html
-    #++
-    @folded_declaration_cache = {}
-    class << self; attr_reader :folded_declaration_cache; end
+    # Array of CSS files that have been loaded.
+    attr_reader :loaded_uris
 
     def initialize(options = {})
-      @options = {absolute_paths: false,
-                  import: true,
-                  io_exceptions: true,
-                  rule_set_exceptions: true,
-                  capture_offsets: false}.merge(options)
+      @options = {
+        absolute_paths: false,
+        import: true,
+        io_exceptions: true,
+        rule_set_exceptions: true,
+        capture_offsets: false,
+        user_agent: USER_AGENT,
+        allow_local_network: false,
+        allow_file_uris: false
+      }.merge(options)
 
       # array of RuleSets
       @rules = []
 
-      @redirect_count = nil
-
       @loaded_uris = []
 
       # unprocessed blocks of CSS
@@ -131,14 +139,14 @@ module CssParser
         block.scan(RE_AT_IMPORT_RULE).each do |import_rule|
           media_types = []
           if (media_string = import_rule[-1])
-            media_string.split(/,/).each do |t|
+            media_string.split(',').each do |t|
               media_types << CssParser.sanitize_media_query(t) unless t.empty?
             end
           else
             media_types = [:all]
           end
 
-          next unless options[:only_media_types].include?(:all) or media_types.empty? or !(media_types & options[:only_media_types]).empty?
+          next unless options[:only_media_types].include?(:all) or media_types.empty? or media_types.intersect?(options[:only_media_types])
 
           import_path = import_rule[0].to_s.gsub(/['"]*/, '').strip
 
@@ -162,14 +170,44 @@ module CssParser
       parse_block_into_rule_sets!(block, options)
     end
 
-    # Add a CSS rule by setting the +selectors+, +declarations+ and +media_types+.
+    # Add a CSS rule by setting the +selectors+, +declarations+
+    # and +media_types+. Optional pass +filename+ , +offset+ for source
+    # reference too.
     #
-    # +media_types+ can be a symbol or an array of symbols.
-    def add_rule!(selectors, declarations, media_types = :all)
-      rule_set = RuleSet.new(selectors, declarations)
-      add_rule_set!(rule_set, media_types)
-    rescue ArgumentError => e
-      raise e if @options[:rule_set_exceptions]
+    # +media_types+ can be a symbol or an array of symbols. default to :all
+    # optional fields for source location for source location
+    # +filename+ can be a string or uri pointing to the file or url location.
+    # +offset+ should be Range object representing the start and end byte locations where the rule was found in the file.
+    def add_rule!(*args, selectors: nil, block: nil, filename: nil, offset: nil, media_types: :all) # rubocop:disable Metrics/ParameterLists
+      if args.any?
+        media_types = nil
+        if selectors || block || filename || offset || media_types
+          raise ArgumentError, "don't mix positional and keyword arguments arguments"
+        end
+
+        warn '[DEPRECATION] `add_rule!` with positional arguments is deprecated. ' \
+             'Please use keyword arguments instead.', uplevel: 1
+
+        case args.length
+        when 2
+          selectors, block = args
+        when 3
+          selectors, block, media_types = args
+        else
+          raise ArgumentError
+        end
+      end
+
+      begin
+        rule_set = RuleSet.new(
+          selectors: selectors, block: block,
+          offset: offset, filename: filename
+        )
+
+        add_rule_set!(rule_set, media_types)
+      rescue ArgumentError => e
+        raise e if @options[:rule_set_exceptions]
+      end
     end
 
     # Add a CSS rule by setting the +selectors+, +declarations+, +filename+, +offset+ and +media_types+.
@@ -178,8 +216,11 @@ module CssParser
     # +offset+ should be Range object representing the start and end byte locations where the rule was found in the file.
     # +media_types+ can be a symbol or an array of symbols.
     def add_rule_with_offsets!(selectors, declarations, filename, offset, media_types = :all)
-      rule_set = OffsetAwareRuleSet.new(filename, offset, selectors, declarations)
-      add_rule_set!(rule_set, media_types)
+      warn '[DEPRECATION] `add_rule_with_offsets!` is deprecated. Please use `add_rule!` instead.', uplevel: 1
+      add_rule!(
+        selectors: selectors, block: declarations, media_types: media_types,
+        filename: filename, offset: offset
+      )
     end
 
     # Add a CssParser RuleSet object.
@@ -321,17 +362,21 @@ module CssParser
       in_at_media_rule = false
       in_media_block = false
 
-      current_selectors = String.new
-      current_media_query = String.new
-      current_declarations = String.new
+      current_selectors = +''
+      current_media_query = +''
+      current_declarations = +''
 
       # once we are in a rule, we will use this to store where we started if we are capturing offsets
       rule_start = nil
-      offset = nil
+      start_offset = nil
+      end_offset = nil
 
-      block.scan(/\s+|\\{2,}|\\?[{}\s"]|.[^\s"{}\\]*/) do |token|
+      scanner = StringScanner.new(block)
+      until scanner.eos?
         # save the regex offset so that we know where in the file we are
-        offset = Regexp.last_match.offset(0) if options[:capture_offsets]
+        start_offset = scanner.pos
+        token = scanner.scan(RULESET_TOKENIZER_RX)
+        end_offset = scanner.pos
 
         if token.start_with?('"') # found un-escaped double quote
           in_string = !in_string
@@ -358,20 +403,24 @@ module CssParser
             current_declarations.strip!
 
             unless current_declarations.empty?
+              add_rule_options = {
+                selectors: current_selectors, block: current_declarations,
+                media_types: current_media_queries
+              }
               if options[:capture_offsets]
-                add_rule_with_offsets!(current_selectors, current_declarations, options[:filename], (rule_start..offset.last), current_media_queries)
-              else
-                add_rule!(current_selectors, current_declarations, current_media_queries)
+                add_rule_options[:filename] = options[:filename]
+                add_rule_options[:offset] = rule_start..end_offset
               end
+              add_rule!(**add_rule_options)
             end
 
-            current_selectors = String.new
-            current_declarations = String.new
+            current_selectors = +''
+            current_declarations = +''
 
             # restart our search for selectors and declarations
             rule_start = nil if options[:capture_offsets]
           end
-        elsif token =~ /@media/i
+        elsif /@media/i.match?(token)
           # found '@media', reset current media_types
           in_at_media_rule = true
           current_media_queries = []
@@ -381,19 +430,28 @@ module CssParser
             in_at_media_rule = false
             in_media_block = true
             current_media_queries << CssParser.sanitize_media_query(current_media_query)
-            current_media_query = String.new
+            current_media_query = +''
           elsif token.include?(',')
             # new media query begins
             token.tr!(',', ' ')
             token.strip!
             current_media_query << token << ' '
             current_media_queries << CssParser.sanitize_media_query(current_media_query)
-            current_media_query = String.new
+            current_media_query = +''
           else
             token.strip!
-            current_media_query << token << ' '
+            # special-case the ( and ) tokens to remove inner-whitespace
+            # (eg we'd prefer '(width: 500px)' to '( width: 500px )' )
+            case token
+            when '('
+              current_media_query << token
+            when ')'
+              current_media_query.sub!(/ ?$/, token)
+            else
+              current_media_query << token << ' '
+            end
           end
-        elsif in_charset or token =~ /@charset/i
+        elsif in_charset or /@charset/i.match?(token)
           # iterate until we are out of the charset declaration
           in_charset = !token.include?(';')
         elsif !in_string && token.include?('}')
@@ -412,18 +470,22 @@ module CssParser
           current_selectors << token
 
           # mark this as the beginning of the selector unless we have already marked it
-          rule_start = offset.first if options[:capture_offsets] && rule_start.nil? && token =~ /^[^\s]+$/
+          rule_start = start_offset if options[:capture_offsets] && rule_start.nil? && /^[^\s]+$/.match?(token)
         end
       end
 
       # check for unclosed braces
       return unless in_declarations > 0
 
-      unless options[:capture_offsets]
-        return add_rule!(current_selectors, current_declarations, current_media_queries)
+      add_rule_options = {
+        selectors: current_selectors, block: current_declarations,
+        media_types: current_media_queries
+      }
+      if options[:capture_offsets]
+        add_rule_options[:filename] = options[:filename]
+        add_rule_options[:offset] = rule_start..end_offset
       end
-
-      add_rule_with_offsets!(current_selectors, current_declarations, options[:filename], (rule_start..offset.last), current_media_queries)
+      add_rule!(**add_rule_options)
     end
 
     # Load a remote CSS file.
@@ -441,6 +503,8 @@ module CssParser
       if options.is_a? Hash
         opts.merge!(options)
       else
+        warn '[DEPRECATION] `load_uri!` with positional arguments is deprecated. ' \
+             'Please use keyword arguments instead.', uplevel: 1
         opts[:base_uri] = options if options.is_a? String
         opts[:media_types] = deprecated if deprecated
       end
@@ -455,7 +519,28 @@ module CssParser
       # pass on the uri if we are capturing file offsets
       opts[:filename] = uri.to_s if opts[:capture_offsets]
 
-      src, = read_remote_file(uri) # skip charset
+      # file:// is handled here, not inside read_remote_file. The
+      # remote-read path must never service file:// URIs, so a 3xx
+      # `Location: file://...` redirect cannot be turned into a local
+      # File.read.
+      #
+      # file:// via `load_uri!` is also gated by `allow_file_uris`:
+      # an attacker who can influence a URI passed here (e.g. via a CSS
+      # @import resolved against an attacker-controlled base_uri) could
+      # otherwise turn it into arbitrary local file disclosure. Callers
+      # that legitimately need to load local files should use
+      # `load_file!` (the explicit local-file API).
+      src = if uri.scheme == 'file'
+              unless @options[:allow_file_uris]
+                raise RemoteFileError, uri.to_s if @options[:io_exceptions]
+
+                return
+              end
+              read_local_file(uri)
+            else
+              src_and_charset, = read_remote_file(uri) # skip charset
+              src_and_charset
+            end
 
       add_block!(src, opts) if src
     end
@@ -467,6 +552,8 @@ module CssParser
       if options.is_a? Hash
         opts.merge!(options)
       else
+        warn '[DEPRECATION] `load_file!` with positional arguments is deprecated. ' \
+             'Please use keyword arguments instead.', uplevel: 1
         opts[:base_dir] = options if options.is_a? String
         opts[:media_types] = deprecated if deprecated
       end
@@ -475,7 +562,7 @@ module CssParser
       return unless File.readable?(file_name)
       return unless circular_reference_check(file_name)
 
-      src = IO.read(file_name)
+      src = File.read(file_name)
 
       opts[:filename] = file_name if opts[:capture_offsets]
       opts[:base_dir] = File.dirname(file_name)
@@ -490,6 +577,8 @@ module CssParser
       if options.is_a? Hash
         opts.merge!(options)
       else
+        warn '[DEPRECATION] `load_file!` with positional arguments is deprecated. ' \
+             'Please use keyword arguments instead.', uplevel: 1
         opts[:base_dir] = options if options.is_a? String
         opts[:media_types] = deprecated if deprecated
       end
@@ -503,7 +592,8 @@ module CssParser
     #
     # Raises a CircularReferenceError exception if io_exceptions are on,
     # otherwise returns true/false.
-    def circular_reference_check(path)
+    # TODO: fix rubocop
+    def circular_reference_check(path) # rubocop:disable Naming/PredicateMethod
       path = path.to_s
       if @loaded_uris.include?(path)
         raise CircularReferenceError, "can't load #{path} more than once" if @options[:io_exceptions]
@@ -544,92 +634,124 @@ module CssParser
       utf8_block
     end
 
-    # Download a file into a string.
+    # Read a local file:// URI. Called only from `load_uri!` — never
+    # from the remote read path — so an HTTP redirect cannot reach this
+    # branch (GHSA-9pmc-p236-855h).
+    def read_local_file(uri) # :nodoc:
+      # Internal invariant: this method is the implementation of the
+      # `allow_file_uris: true` branch of `load_uri!`. If it is ever
+      # reached without that flag set, a future change has bypassed the
+      # LFI gate; refuse to read rather than silently leak.
+      unless @options[:allow_file_uris]
+        raise "BUG: #{self.class}##{__method__} reached with " \
+              'allow_file_uris=false (LFI gate bypassed)'
+      end
+
+      return nil unless circular_reference_check(uri.to_s)
+
+      path = uri.path
+      path.gsub!(%r{^/}, '') if Gem.win_platform?
+      File.read(path, mode: 'rb')
+    rescue
+      raise RemoteFileError, uri.to_s if @options[:io_exceptions]
+
+      nil
+    end
+
+    # Download a remote http(s) file into a string.
     #
     # Returns the file's data and character set in an array.
+    #
+    # In the default (secure) configuration, requests are issued via
+    # `SsrfFilter.get`, which:
+    #   - rejects any scheme other than http/https (defeats redirect-to-
+    #     `file://` / `gopher://` / `dict://` etc.);
+    #   - resolves the hostname with `Resolv` and rejects requests whose
+    #     resolved IP is loopback, RFC-1918, link-local, multicast, or any
+    #     other range typically used for internal services (defeats SSRF
+    #     via literal IPs and via CNAME / attacker-controlled A records);
+    #   - re-validates scheme and IP on every redirect hop.
+    #
+    # When `allow_local_network: true` is set on the Parser, the SSRF
+    # check is bypassed and plain `Net::HTTP` is used — but the scheme
+    # is still validated on every redirect hop, so cross-scheme
+    # redirect to `file://` (the original GHSA-9pmc-p236-855h sink)
+    # remains closed even on this opt-in path.
     #--
     # TODO: add option to fail silently or throw and exception on a 404
     #++
     def read_remote_file(uri) # :nodoc:
-      if @redirect_count.nil?
-        @redirect_count = 0
-      else
-        @redirect_count += 1
-      end
+      uri = Addressable::URI.parse(uri.to_s)
 
       unless circular_reference_check(uri.to_s)
-        @redirect_count = nil
         return nil, nil
       end
 
-      if @redirect_count > MAX_REDIRECTS
-        @redirect_count = nil
+      unless REMOTE_ALLOWED_SCHEMES.include?(uri.scheme)
+        raise RemoteFileError, uri.to_s if @options[:io_exceptions]
+
         return nil, nil
       end
 
-      src = '', charset = nil
-
       begin
-        uri = Addressable::URI.parse(uri.to_s)
-
-        if uri.scheme == 'file'
-          # local file
-          path = uri.path
-          path.gsub!(%r{^/}, '') if Gem.win_platform?
-          src = File.read(path, mode: 'rb')
-        else
-          # remote file
-          if uri.scheme == 'https'
-            uri.port = 443 unless uri.port
-            http = Net::HTTP.new(uri.host, uri.port)
-            http.use_ssl = true
-            http.verify_mode = OpenSSL::SSL::VERIFY_NONE
-          else
-            http = Net::HTTP.new(uri.host, uri.port)
-          end
-
-          res = http.get(uri.request_uri, {'User-Agent' => USER_AGENT, 'Accept-Encoding' => 'gzip'})
-          src = res.body
-          charset = res.respond_to?(:charset) ? res.encoding : 'utf-8'
+        res = if @options[:allow_local_network]
+                fetch_via_net_http(uri)
+              else
+                SsrfFilter.get(
+                  uri.to_s,
+                  scheme_whitelist: REMOTE_ALLOWED_SCHEMES,
+                  max_redirects: MAX_REDIRECTS,
+                  headers: {'User-Agent' => @options[:user_agent]}
+                )
+              end
 
-          if res.code.to_i >= 400
-            @redirect_count = nil
-            raise RemoteFileError, uri.to_s if @options[:io_exceptions]
+        if res.code.to_i >= 400
+          raise RemoteFileError, uri.to_s if @options[:io_exceptions]
 
-            return '', nil
-          elsif res.code.to_i >= 300 and res.code.to_i < 400
-            unless res['Location'].nil?
-              return read_remote_file Addressable::URI.parse(Addressable::URI.escape(res['Location']))
-            end
-          end
-
-          case res['content-encoding']
-          when 'gzip'
-            io = Zlib::GzipReader.new(StringIO.new(res.body))
-            src = io.read
-          when 'deflate'
-            io = Zlib::Inflate.new
-            src = io.inflate(res.body)
-          end
+          return '', nil
         end
 
-        if charset
-          if String.method_defined?(:encode)
-            src.encode!('UTF-8', charset)
-          else
-            ic = Iconv.new('UTF-8//IGNORE', charset)
-            src = ic.iconv(src)
-          end
-        end
+        charset = res.respond_to?(:charset) ? res.encoding : 'utf-8'
+        src = res.body
+        src.encode!('UTF-8', charset) if charset
+
+        [src, charset]
       rescue
-        @redirect_count = nil
         raise RemoteFileError, uri.to_s if @options[:io_exceptions]
 
-        return nil, nil
+        [nil, nil]
+      end
+    end
+
+    # Net::HTTP path used only when `allow_local_network: true`. Validates
+    # the URI scheme on every redirect hop so a `Location: file://...`
+    # cannot be followed even on this opt-in code path.
+    def fetch_via_net_http(uri, redirect_count = 0) # :nodoc:
+      # Internal invariant: this method is the implementation of the
+      # `allow_local_network: true` branch of `read_remote_file`. If it
+      # is ever reached without that flag set, a future change has
+      # bypassed the SSRF gate; refuse to fetch rather than silently
+      # connect. The recursive call on a redirect inherits this guard
+      # because the option does not change mid-request.
+      unless @options[:allow_local_network]
+        raise "BUG: #{self.class}##{__method__} reached with " \
+              'allow_local_network=false (SSRF gate bypassed)'
+      end
+
+      raise RemoteFileError, uri.to_s unless REMOTE_ALLOWED_SCHEMES.include?(uri.scheme)
+      raise RemoteFileError, uri.to_s if redirect_count > MAX_REDIRECTS
+
+      http = Net::HTTP.new(uri.host, uri.port || uri.default_port)
+      http.use_ssl = (uri.scheme == 'https')
+
+      res = http.get(uri.request_uri, {'User-Agent' => @options[:user_agent]})
+
+      if res.code.to_i >= 300 && res.code.to_i < 400 && res['Location']
+        redirect_uri = Addressable::URI.parse(Addressable::URI.escape(res['Location']))
+        return fetch_via_net_http(redirect_uri, redirect_count + 1)
       end
 
-      @redirect_count = nil
-      [src, charset]
+      res
     end
 
   private
@@ -660,7 +782,7 @@ module CssParser
       nodes = {}
       lines.each do |line|
         parts = line.split(':', 2)
-        if parts[1] =~ /:/
+        if parts[1].include?(':')
           nodes[parts[0]] = css_node_to_h(hash, parts[0], parts[1])
         else
           nodes[parts[0].to_s.strip] = parts[1].to_s.strip

data/lib/css_parser/regexps.rb

@@ -11,7 +11,7 @@ module CssParser
   RE_NON_ASCII = Regexp.new('([\x00-\xFF])', Regexp::IGNORECASE | Regexp::NOENCODING) # [^\0-\177]
   RE_UNICODE = Regexp.new('(\\\\[0-9a-f]{1,6}(\r\n|[ \n\r\t\f])*)', Regexp::IGNORECASE | Regexp::EXTENDED | Regexp::MULTILINE | Regexp::NOENCODING)
   RE_ESCAPE = Regexp.union(RE_UNICODE, '|(\\\\[^\n\r\f0-9a-f])')
-  RE_IDENT = Regexp.new("[\-]?([_a-z]|#{RE_NON_ASCII}|#{RE_ESCAPE})([_a-z0-9\-]|#{RE_NON_ASCII}|#{RE_ESCAPE})*", Regexp::IGNORECASE | Regexp::NOENCODING)
+  RE_IDENT = Regexp.new("[-]?([_a-z]|#{RE_NON_ASCII}|#{RE_ESCAPE})([_a-z0-9-]|#{RE_NON_ASCII}|#{RE_ESCAPE})*", Regexp::IGNORECASE | Regexp::NOENCODING)
 
   # General strings
   RE_STRING1 = /("(.[^\n\r\f"]*|\\#{RE_NL}|#{RE_ESCAPE})*")/.freeze
@@ -52,8 +52,10 @@ module CssParser
   # Special units
   BOX_MODEL_UNITS_RX = /(auto|inherit|0|(-*([0-9]+|[0-9]*\.[0-9]+)(rem|vw|vh|vm|vmin|vmax|e[mx]+|px|[cm]+m|p[tc+]|in|%)))([\s;]|\Z)/imx.freeze
   RE_LENGTH_OR_PERCENTAGE = Regexp.new('([\-]*(([0-9]*\.[0-9]+)|[0-9]+)(e[mx]+|px|[cm]+m|p[tc+]|in|\%))', Regexp::IGNORECASE)
-  RE_BACKGROUND_POSITION = Regexp.new("((((#{RE_LENGTH_OR_PERCENTAGE})|left|center|right|top|bottom)[\s]*){1,2})", Regexp::IGNORECASE | Regexp::EXTENDED)
-  RE_BACKGROUND_SIZE = Regexp.new("\\s*/\\s*((((#{RE_LENGTH_OR_PERCENTAGE})|auto|cover|contain|initial|inherit)[\\s]*){1,2})", Regexp::IGNORECASE | Regexp::EXTENDED)
+  RE_SINGLE_BACKGROUND_POSITION = /#{RE_LENGTH_OR_PERCENTAGE}|left|center|right|top|bottom/i.freeze
+  RE_SINGLE_BACKGROUND_SIZE = /#{RE_LENGTH_OR_PERCENTAGE}|auto|cover|contain|initial|inherit/i.freeze
+  RE_BACKGROUND_POSITION = /#{RE_SINGLE_BACKGROUND_POSITION}\s+#{RE_SINGLE_BACKGROUND_POSITION}|#{RE_SINGLE_BACKGROUND_POSITION}/.freeze
+  RE_BACKGROUND_SIZE = %r{\s*/\s*(#{RE_SINGLE_BACKGROUND_SIZE}\s+#{RE_SINGLE_BACKGROUND_SIZE}|#{RE_SINGLE_BACKGROUND_SIZE})}.freeze
   FONT_UNITS_RX = /((x+-)*small|medium|larger*|auto|inherit|([0-9]+|[0-9]*\.[0-9]+)(e[mx]+|px|[cm]+m|p[tc+]|in|%)*)/i.freeze
   RE_BORDER_STYLE = /(\s*^)?(none|hidden|dotted|dashed|solid|double|dot-dash|dot-dot-dash|wave|groove|ridge|inset|outset)(\s*$)?/imx.freeze
   RE_BORDER_UNITS = Regexp.union(BOX_MODEL_UNITS_RX, /(thin|medium|thick)/i)
@@ -257,8 +259,10 @@ module CssParser
     inherit
     currentColor
   ].freeze
-  RE_COLOUR_NUMERIC = /\b(hsl|rgb)\s*\(-?\s*-?\d+(\.\d+)?%?\s*%?,-?\s*-?\d+(\.\d+)?%?\s*%?,-?\s*-?\d+(\.\d+)?%?\s*%?\)/i.freeze
-  RE_COLOUR_NUMERIC_ALPHA = /\b(hsla|rgba)\s*\(-?\s*-?\d+(\.\d+)?%?\s*%?,-?\s*-?\d+(\.\d+)?%?\s*%?,-?\s*-?\d+(\.\d+)?%?\s*%?,-?\s*-?\d+(\.\d+)?%?\s*%?\)/i.freeze
+  # CSS <number> allows the integer part to be omitted (e.g. `.1`), per CSS Values & Units.
+  # `(?:\d*\.)?\d+` accepts `1`, `1.5`, and `.5` while still rejecting bare `1.`.
+  RE_COLOUR_NUMERIC = /\b(hsl|rgb)\s*\(-?\s*-?(?:\d*\.)?\d+%?\s*%?,-?\s*-?(?:\d*\.)?\d+%?\s*%?,-?\s*-?(?:\d*\.)?\d+%?\s*%?\)/i.freeze
+  RE_COLOUR_NUMERIC_ALPHA = /\b(hsla|rgba)\s*\(-?\s*-?(?:\d*\.)?\d+%?\s*%?,-?\s*-?(?:\d*\.)?\d+%?\s*%?,-?\s*-?(?:\d*\.)?\d+%?\s*%?,-?\s*-?(?:\d*\.)?\d+%?\s*%?\)/i.freeze
   RE_COLOUR_HEX = /\s*#([0-9a-fA-F]{6}|[0-9a-fA-F]{3})\b/.freeze
   RE_COLOUR_NAMED = /\s*\b(#{NAMED_COLOURS.join('|')})\b/i.freeze
   RE_COLOUR = Regexp.union(RE_COLOUR_NUMERIC, RE_COLOUR_NUMERIC_ALPHA, RE_COLOUR_HEX, RE_COLOUR_NAMED)

data/lib/css_parser/rule_set.rb

@@ -11,8 +11,10 @@ module CssParser
     BACKGROUND_PROPERTIES = ['background-color', 'background-image', 'background-repeat', 'background-position', 'background-size', 'background-attachment'].freeze
     LIST_STYLE_PROPERTIES = ['list-style-type', 'list-style-position', 'list-style-image'].freeze
     FONT_STYLE_PROPERTIES = ['font-style', 'font-variant', 'font-weight', 'font-size', 'line-height', 'font-family'].freeze
+    FONT_WEIGHT_PROPERTIES = ['font-style', 'font-weight', 'font-variant'].freeze
     BORDER_STYLE_PROPERTIES = ['border-width', 'border-style', 'border-color'].freeze
     BORDER_PROPERTIES = ['border', 'border-left', 'border-right', 'border-top', 'border-bottom'].freeze
+    DIMENSION_DIRECTIONS = [:top, :right, :bottom, :left].freeze
 
     NUMBER_OF_DIMENSIONS = 4
 
@@ -26,6 +28,12 @@ module CssParser
 
     WHITESPACE_REPLACEMENT = '___SPACE___'
 
+    # Tokens for parse_declarations!
+    COLON = ':'.freeze
+    SEMICOLON = ';'.freeze
+    LPAREN = '('.freeze
+    RPAREN = ')'.freeze
+    IMPORTANT = '!important'.freeze
     class Declarations
       class Value
         attr_reader :value
@@ -58,7 +66,7 @@ module CssParser
 
       extend Forwardable
 
-      def_delegators :declarations, :each
+      def_delegators :declarations, :each, :each_value
 
       def initialize(declarations = {})
         self.declarations = {}
@@ -81,17 +89,20 @@ module CssParser
       #   puts declarations['margin']
       #   => #<CssParser::RuleSet::Declarations::Value:0x00000000030c1838 @important=true, @order=2, @value="0px auto">
       #
-      # If the property already exists its value will be over-written.
+      # If the property already exists its value will be over-written unless it was !important and the new value
+      # is not !important.
       # If the value is empty - property will be deleted
       def []=(property, value)
         property = normalize_property(property)
+        currently_important = declarations[property]&.important
 
-        if value.is_a?(Value)
+        if value.is_a?(Value) && (!currently_important || value.important)
           declarations[property] = value
         elsif value.to_s.strip.empty?
           delete property
         else
-          declarations[property] = Value.new(value)
+          value = Value.new(value)
+          declarations[property] = value if !currently_important || value.important
         end
       rescue ArgumentError => e
         raise e.exception, "#{property} #{e.message}"
@@ -142,7 +153,7 @@ module CssParser
 
         if preserve_importance
           importance = get_value(property).important
-          replacement_declarations.each { |_key, value| value.important = importance }
+          replacement_declarations.each_value { |value| value.important = importance }
         end
 
         replacement_keys = declarations.keys
@@ -190,7 +201,7 @@ module CssParser
       end
 
       def to_s(options = {})
-        str = declarations.reduce(String.new) do |memo, (prop, value)|
+        str = declarations.reduce(+'') do |memo, (prop, value)|
           importance = options[:force_important] || value.important ? ' !important' : ''
           memo << "#{prop}: #{value.value}#{importance}; "
         end
@@ -223,6 +234,12 @@ module CssParser
 
     extend Forwardable
 
+    # optional field for storing source reference
+    # File offset range
+    attr_reader :offset
+    # the local or remote location
+    attr_accessor :filename
+
     # Array of selector strings.
     attr_reader :selectors
 
@@ -237,9 +254,38 @@ module CssParser
     alias []= add_declaration!
     alias remove_declaration! delete
 
-    def initialize(selectors, block, specificity = nil)
+    def initialize(*args, selectors: nil, block: nil, offset: nil, filename: nil, specificity: nil) # rubocop:disable Metrics/ParameterLists
+      if args.any?
+        if selectors || block || offset || filename || specificity
+          raise ArgumentError, "don't mix positional and keyword arguments"
+        end
+
+        warn '[DEPRECATION] positional arguments are deprecated use keyword instead.', uplevel: 1
+
+        case args.length
+        when 2
+          selectors, block = args
+        when 3
+          selectors, block, specificity = args
+        when 4
+          filename, offset, selectors, block = args
+        when 5
+          filename, offset, selectors, block, specificity = args
+        else
+          raise ArgumentError
+        end
+      end
+
       @selectors = []
       @specificity = specificity
+
+      unless offset.nil? == filename.nil?
+        raise ArgumentError, 'require both offset and filename or no offset and no filename'
+      end
+
+      @offset = offset
+      @filename = filename
+
       parse_selectors!(selectors) if selectors
       parse_declarations!(block)
     end
@@ -308,7 +354,7 @@ module CssParser
 
       replacement =
         if value.match(CssParser::RE_INHERIT)
-          BACKGROUND_PROPERTIES.map { |key| [key, 'inherit'] }.to_h
+          BACKGROUND_PROPERTIES.to_h { |key| [key, 'inherit'] }
         else
           {
             'background-image' => value.slice!(CssParser::RE_IMAGE),
@@ -414,17 +460,17 @@ module CssParser
           else
             font_props['font-family'] = m
           end
-        elsif m =~ /normal|inherit/i
-          ['font-style', 'font-weight', 'font-variant'].each do |font_prop|
+        elsif /normal|inherit/i.match?(m)
+          FONT_WEIGHT_PROPERTIES.each do |font_prop|
             font_props[font_prop] ||= m
           end
-        elsif m =~ /italic|oblique/i
+        elsif /italic|oblique/i.match?(m)
           font_props['font-style'] = m
-        elsif m =~ /small-caps/i
+        elsif /small-caps/i.match?(m)
           font_props['font-variant'] = m
-        elsif m =~ /[1-9]00$|bold|bolder|lighter/i
+        elsif /[1-9]00$|bold|bolder|lighter/i.match?(m)
           font_props['font-weight'] = m
-        elsif m =~ CssParser::FONT_UNITS_RX
+        elsif CssParser::FONT_UNITS_RX.match?(m)
           if m.include?('/')
             font_props['font-size'], font_props['line-height'] = m.split('/', 2)
           else
@@ -447,8 +493,8 @@ module CssParser
       value = declaration.value.dup
 
       replacement =
-        if value =~ CssParser::RE_INHERIT
-          LIST_STYLE_PROPERTIES.map { |key| [key, 'inherit'] }.to_h
+        if CssParser::RE_INHERIT.match?(value)
+          LIST_STYLE_PROPERTIES.to_h { |key| [key, 'inherit'] }
         else
           {
             'list-style-type' => value.slice!(CssParser::RE_LIST_STYLE_TYPE),
@@ -513,15 +559,15 @@ module CssParser
     #
     # TODO: this is extremely similar to create_background_shorthand! and should be combined
     def create_border_shorthand! # :nodoc:
-      values = BORDER_STYLE_PROPERTIES.map do |property|
+      values = BORDER_STYLE_PROPERTIES.filter_map do |property|
         next unless (declaration = declarations[property])
         next if declaration.important
         # can't merge if any value contains a space (i.e. has multiple values)
         # we temporarily remove any spaces after commas for the check (inside rgba, etc...)
-        next if declaration.value.gsub(/,\s/, ',').strip =~ /\s/
+        next if /\s/.match?(declaration.value.gsub(/,\s/, ',').strip)
 
         declaration.value
-      end.compact
+      end
 
       return if values.size != BORDER_STYLE_PROPERTIES.size
 
@@ -538,7 +584,7 @@ module CssParser
       return if declarations.size < NUMBER_OF_DIMENSIONS
 
       DIMENSIONS.each do |property, dimensions|
-        values = [:top, :right, :bottom, :left].each_with_index.with_object({}) do |(side, index), result|
+        values = DIMENSION_DIRECTIONS.each_with_index.with_object({}) do |(side, index), result|
           next unless (declaration = declarations[dimensions[index]])
 
           result[side] = declaration.value
@@ -561,7 +607,7 @@ module CssParser
     def create_font_shorthand! # :nodoc:
       return unless FONT_STYLE_PROPERTIES.all? { |prop| declarations.key?(prop) }
 
-      new_value = String.new
+      new_value = +''
       ['font-style', 'font-variant', 'font-weight'].each do |property|
         unless declarations[property].value == 'normal'
           new_value << declarations[property].value << ' '
@@ -598,7 +644,7 @@ module CssParser
       return [:top] if values.values.uniq.count == 1
 
       # `/* top | right | bottom | left */`
-      return [:top, :right, :bottom, :left] if values[:left] != values[:right]
+      return DIMENSION_DIRECTIONS if values[:left] != values[:right]
 
       # Vertical are the same & horizontal are the same, `/* vertical | horizontal */`
       return [:top, :left] if values[:top] == values[:bottom]
@@ -612,20 +658,32 @@ module CssParser
       return unless block
 
       continuation = nil
-      block.split(/[;$]+/m).each do |decs|
-        decs = (continuation ? continuation + decs : decs)
-        if decs =~ /\([^)]*\Z/ # if it has an unmatched parenthesis
-          continuation = "#{decs};"
-        elsif (matches = decs.match(/\s*(.[^:]*)\s*:\s*(.+?)(?:;?\s*\Z)/i))
-          # skip end_of_declaration
-          property = matches[1]
-          value = matches[2]
-          add_declaration!(property, value)
-          continuation = nil
+      block.split(SEMICOLON) do |decs|
+        decs = (continuation ? "#{continuation};#{decs}" : decs)
+        if unmatched_open_parenthesis?(decs)
+          # Semicolon happened within parenthesis, so it is a part of the value
+          # the rest of the value is in the next segment
+          continuation = decs
+          next
         end
+
+        next unless (colon = decs.index(COLON))
+
+        property = decs[0, colon]
+        value = decs[(colon + 1)..]
+        property.strip!
+        value.strip!
+        next if property.empty? || value.empty? || value.casecmp?(IMPORTANT)
+
+        add_declaration!(property, value)
+        continuation = nil
       end
     end
 
+    def unmatched_open_parenthesis?(declarations)
+      (lparen_index = declarations.index(LPAREN)) && !declarations.index(RPAREN, lparen_index)
+    end
+
     #--
     # TODO: way too simplistic
     #++
@@ -650,18 +708,4 @@ module CssParser
       end
     end
   end
-
-  class OffsetAwareRuleSet < RuleSet
-    # File offset range
-    attr_reader :offset
-
-    # the local or remote location
-    attr_accessor :filename
-
-    def initialize(filename, offset, selectors, block, specificity = nil)
-      super(selectors, block, specificity)
-      @offset = offset
-      @filename = filename
-    end
-  end
 end

data/lib/css_parser/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module CssParser
-  VERSION = '1.13.0'.freeze
+  VERSION = '3.0.0'.freeze
 end

data/lib/css_parser.rb

@@ -4,9 +4,7 @@ require 'addressable/uri'
 require 'uri'
 require 'net/https'
 require 'digest/md5'
-require 'zlib'
-require 'stringio'
-require 'iconv' unless String.method_defined?(:encode)
+require 'ssrf_filter'
 
 require 'css_parser/version'
 require 'css_parser/rule_set'
@@ -53,12 +51,10 @@ module CssParser
   # TODO: declaration_hashes should be able to contain a RuleSet
   #       this should be a Class method
   def self.merge(*rule_sets)
-    @folded_declaration_cache = {}
-
     # in case called like CssParser.merge([rule_set, rule_set])
     rule_sets.flatten! if rule_sets[0].is_a?(Array)
 
-    unless rule_sets.all? { |rs| rs.is_a?(CssParser::RuleSet) }
+    unless rule_sets.all?(CssParser::RuleSet)
       raise ArgumentError, 'all parameters must be CssParser::RuleSets.'
     end
 
@@ -71,17 +67,17 @@ module CssParser
       rule_set.expand_shorthand!
 
       specificity = rule_set.specificity
-      specificity ||= rule_set.selectors.map { |s| calculate_specificity(s) }.compact.max || 0
+      specificity ||= rule_set.selectors.filter_map { |s| calculate_specificity(s) }.max || 0
 
       rule_set.each_declaration do |property, value, is_important|
         # Add the property to the list to be folded per http://www.w3.org/TR/CSS21/cascade.html#cascading-order
-        if not properties.key?(property)
+        if !properties.key?(property)
           properties[property] = {value: value, specificity: specificity, is_important: is_important}
         elsif is_important
-          if not properties[property][:is_important] or properties[property][:specificity] <= specificity
+          if !properties[property][:is_important] || properties[property][:specificity] <= specificity
             properties[property] = {value: value, specificity: specificity, is_important: is_important}
           end
-        elsif properties[property][:specificity] < specificity or properties[property][:specificity] == specificity
+        elsif properties[property][:specificity] < specificity || properties[property][:specificity] == specificity
           unless properties[property][:is_important]
             properties[property] = {value: value, specificity: specificity, is_important: is_important}
           end
@@ -111,7 +107,7 @@ module CssParser
   #++
   def self.calculate_specificity(selector)
     a = 0
-    b = selector.scan(/\#/).length
+    b = selector.scan('#').length
     c = selector.scan(NON_ID_ATTRIBUTES_AND_PSEUDO_CLASSES_RX_NC).length
     d = selector.scan(ELEMENTS_AND_PSEUDO_ELEMENTS_RX_NC).length
 
@@ -139,7 +135,7 @@ module CssParser
     css.gsub(URI_RX) do
       uri = Regexp.last_match(1).to_s.gsub(/["']+/, '')
       # Don't process URLs that are already absolute
-      unless uri.match(%r{^[a-z]+://}i)
+      unless uri.match?(%r{^[a-z]+://}i)
         begin
           uri = base_uri.join(uri)
         rescue

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: css_parser
 version: !ruby/object:Gem::Version
-  version: 1.13.0
+  version: 3.0.0
 platform: ruby
 authors:
 - Alex Dunae
-autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-12-29 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable
@@ -25,117 +24,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: benchmark-ips
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: bump
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: maxitest
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: memory_profiler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rubocop
+  name: ssrf_filter
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.8'
-  type: :development
+        version: '1.5'
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.8'
-- !ruby/object:Gem::Dependency
-  name: rubocop-rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: webrick
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
+        version: '1.5'
 description: A set of classes for parsing CSS in Ruby.
 email: code@dunae.ca
 executables: []
@@ -155,7 +56,7 @@ metadata:
   changelog_uri: https://github.com/premailer/css_parser/blob/master/CHANGELOG.md
   source_code_uri: https://github.com/premailer/css_parser
   bug_tracker_uri: https://github.com/premailer/css_parser/issues
-post_install_message: 
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib
@@ -163,15 +64,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.7'
+      version: '3.3'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.6
-signing_key: 
+rubygems_version: 4.0.3
 specification_version: 4
 summary: Ruby CSS parser.
 test_files: []