css_parser 1.21.0 → 3.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c8880ebd6978e8a8a3108ea93b4d567252aee152b28f237dab31809f1488f42e
-  data.tar.gz: 4e8379acf246b7fe2573a2ada4fc49c01e9c3b2de43fe80d07f42390f8f16450
+  metadata.gz: 3ff7ead55436d394e644feb148e017f631ea4ede0783746107a72cc790a70ee5
+  data.tar.gz: 8bdd909c65c7f7fe4139d164898e6cd7906b1b649b6a68429dee620cc5798cd0
 SHA512:
-  metadata.gz: 480947bb06a6c40ab955f76ff9eb7ba9ac5caf160d7fe343d16901e9f37210c9ccab22a07a4d3165ec26bec4cd28547f530718978d2d969ed398c8195351a0c0
-  data.tar.gz: e7a757c9dc096e71d5f617343f0900bacddea42bef4b26ca68f2830728a480ace908807dc4db82b6b0b77a11c1b2c9295ad814bb2aaa80fd069c959cd58afe65
+  metadata.gz: ecf5d9f9ef55e3f69269c511b51f5363bdc6e317fa1446ae04be7850256c30039dd9719c74705df29dbb9011847d3cbe3602bbd11f8b273cd7b6c92b9e2268cb
+  data.tar.gz: 7ddbd0f9bab2c8327f081a48cce1e7fb20cc133eb5af8530eb1dcc6ef1acc2836f9a2274e75e74dec6b9866461754ceecc759efbbd7aec7dbe6b06814bd2cbc9

data/lib/css_parser/parser.rb

@@ -1,11 +1,16 @@
 # frozen_string_literal: true
 
 require 'strscan'
+require 'digest'
+require 'base64'
 
 module CssParser
   # Exception class used for any errors encountered while downloading remote files.
   class RemoteFileError < IOError; end
 
+  # Exception class used when a fetched remote file fails Subresource Integrity verification.
+  class IntegrityError < RemoteFileError; end
+
   # Exception class used if a request is made to load a CSS file more than once.
   class CircularReferenceError < StandardError; end
 
@@ -17,6 +22,8 @@ module CssParser
   # [<tt>absolute_paths</tt>] Convert relative paths to absolute paths (<tt>href</tt>, <tt>src</tt> and <tt>url('')</tt>. Boolean, default is <tt>false</tt>.
   # [<tt>import</tt>] Follow <tt>@import</tt> rules. Boolean, default is <tt>true</tt>.
   # [<tt>io_exceptions</tt>] Throw an exception if a link can not be found. Boolean, default is <tt>true</tt>.
+  # [<tt>allow_local_network</tt>] Permit http(s) fetches against loopback / private / link-local / cloud-metadata addresses. Boolean, default is <tt>false</tt>. When <tt>false</tt> (the default), outbound HTTP requests are routed through <tt>ssrf_filter</tt>, which resolves the host and rejects unsafe IP ranges. Set to <tt>true</tt> only when the destination is known to be safe (e.g. local fixture servers in tests). Independent of <tt>allow_file_uris</tt>.
+  # [<tt>allow_file_uris</tt>] Permit <tt>file://</tt> URIs via <tt>load_uri!</tt>. Boolean, default is <tt>false</tt>. When <tt>false</tt> (the default), a caller that passes a <tt>file://</tt> URI to <tt>load_uri!</tt> — directly or via a CSS <tt>@import</tt> resolved against a <tt>file://</tt> base_uri — is refused, closing the local-file-disclosure vector when the URI is influenced by user input. <tt>load_file!</tt> is unaffected: it is the explicit local-file API and takes a caller-supplied path. Independent of <tt>allow_local_network</tt>.
   class Parser
     USER_AGENT = "Ruby CSS Parser/#{CssParser::VERSION} (https://github.com/premailer/css_parser)".freeze
     RULESET_TOKENIZER_RX = /\s+|\\{2,}|\\?[{}\s"]|[()]|.[^\s"{}()\\]*/.freeze
@@ -28,14 +35,24 @@ module CssParser
 
     MAX_REDIRECTS = 3
 
-    # Array of CSS files that have been loaded.
-    attr_reader   :loaded_uris
+    # Schemes accepted by `read_remote_file`. `file://` is intentionally
+    # NOT in this list — local files are handled directly by `load_uri!`
+    # and `load_file!`. Keeping `file://` out of the remote read path
+    # closes the cross-scheme redirect (HTTP 3xx → `file://`) vector that
+    # was GHSA-9pmc-p236-855h.
+    REMOTE_ALLOWED_SCHEMES = %w[http https].freeze
+
+    # Subresource Integrity hash algorithms this library can verify, strongest first.
+    # Mirrors the SRI spec's "agility" rule (https://www.w3.org/TR/SRI/#agility):
+    #   if `integrity` lists multiple algorithms, only the strongest is checked.
+    INTEGRITY_ALGORITHMS = {
+      'sha512' => Digest::SHA512,
+      'sha384' => Digest::SHA384,
+      'sha256' => Digest::SHA256
+    }.freeze
 
-    #--
-    # Class variable? see http://www.oreillynet.com/ruby/blog/2007/01/nubygems_dont_use_class_variab_1.html
-    #++
-    @folded_declaration_cache = {}
-    class << self; attr_reader :folded_declaration_cache; end
+    # Array of CSS files that have been loaded.
+    attr_reader :loaded_uris
 
     def initialize(options = {})
       @options = {
@@ -44,14 +61,14 @@ module CssParser
         io_exceptions: true,
         rule_set_exceptions: true,
         capture_offsets: false,
-        user_agent: USER_AGENT
+        user_agent: USER_AGENT,
+        allow_local_network: false,
+        allow_file_uris: false
       }.merge(options)
 
       # array of RuleSets
       @rules = []
 
-      @redirect_count = nil
-
       @loaded_uris = []
 
       # unprocessed blocks of CSS
@@ -143,7 +160,7 @@ module CssParser
             media_types = [:all]
           end
 
-          next unless options[:only_media_types].include?(:all) or media_types.empty? or !(media_types & options[:only_media_types]).empty?
+          next unless options[:only_media_types].include?(:all) or media_types.empty? or media_types.intersect?(options[:only_media_types])
 
           import_path = import_rule[0].to_s.gsub(/['"]*/, '').strip
 
@@ -156,6 +173,21 @@ module CssParser
             load_uri!(import_uri, import_options)
           elsif options[:base_dir]
             import_options[:base_dir] = options[:base_dir]
+            # The import path comes from (potentially untrusted) CSS
+            # content, not from the caller. Flag this load so load_file!
+            # keeps it contained within the import root and refuses
+            # absolute paths / `..` traversal that escape it -- otherwise
+            # @import turns into arbitrary local file disclosure. This is
+            # the base_dir sibling of the file://-via-base_uri hole closed
+            # in GHSA-9pmc-p236-855h, which left this arm untouched.
+            #
+            # import_root is the top-level base_dir, threaded through
+            # nested imports so containment is always checked against it.
+            # That still allows legitimate `../` imports that stay inside
+            # the tree (e.g. subdir/import2.css -> ../simple.css) while
+            # rejecting anything that leaves it.
+            import_options[:from_import] = true
+            import_options[:import_root] = options[:import_root] || options[:base_dir]
             load_file!(import_path, import_options)
           end
         end
@@ -448,7 +480,7 @@ module CssParser
               current_media_query << token << ' '
             end
           end
-        elsif in_charset or token =~ /@charset/i
+        elsif in_charset or /@charset/i.match?(token)
           # iterate until we are out of the charset declaration
           in_charset = !token.include?(';')
         elsif !in_string && token.include?('}')
@@ -467,7 +499,7 @@ module CssParser
           current_selectors << token
 
           # mark this as the beginning of the selector unless we have already marked it
-          rule_start = start_offset if options[:capture_offsets] && rule_start.nil? && token =~ /^[^\s]+$/
+          rule_start = start_offset if options[:capture_offsets] && rule_start.nil? && /^[^\s]+$/.match?(token)
         end
       end
 
@@ -489,9 +521,7 @@ module CssParser
     #
     # You can also pass in file://test.css
     #
-    # See add_block! for options.
-    #
-    # Deprecated: originally accepted three params: `uri`, `base_uri` and `media_types`
+    # See add_block! for options and integrity_matches? for integrity
     def load_uri!(uri, options = {}, deprecated = nil)
       uri = Addressable::URI.parse(uri) unless uri.respond_to? :scheme
 
@@ -499,7 +529,7 @@ module CssParser
 
       if options.is_a? Hash
         opts.merge!(options)
-      else
+      else # TODO: start raising
         warn '[DEPRECATION] `load_uri!` with positional arguments is deprecated. ' \
              'Please use keyword arguments instead.', uplevel: 1
         opts[:base_uri] = options if options.is_a? String
@@ -516,14 +546,45 @@ module CssParser
       # pass on the uri if we are capturing file offsets
       opts[:filename] = uri.to_s if opts[:capture_offsets]
 
-      src, = read_remote_file(uri) # skip charset
+      # file:// is handled here, not inside read_remote_file. The
+      # remote-read path must never service file:// URIs, so a 3xx
+      # `Location: file://...` redirect cannot be turned into a local
+      # File.read.
+      #
+      # file:// via `load_uri!` is also gated by `allow_file_uris`:
+      # an attacker who can influence a URI passed here (e.g. via a CSS
+      # @import resolved against an attacker-controlled base_uri) could
+      # otherwise turn it into arbitrary local file disclosure. Callers
+      # that legitimately need to load local files should use
+      # `load_file!` (the explicit local-file API).
+      src = if uri.scheme == 'file'
+              unless @options[:allow_file_uris]
+                raise RemoteFileError, uri.to_s if @options[:io_exceptions]
+
+                return
+              end
+              read_local_file(uri)
+            else
+              src_and_charset, = read_remote_file(uri, integrity: opts[:integrity]) # skip charset
+              src_and_charset
+            end
 
       add_block!(src, opts) if src
     end
 
     # Load a local CSS file.
+    #
+    # +from_import+ (internal) marks a load whose +file_name+ originates
+    # from an @import rule in parsed CSS rather than from the caller. Such
+    # a path is attacker-influenced, so it is contained within the import
+    # root (+import_root+, the top-level +base_dir+): absolute paths and
+    # `..` traversal that escape the root are refused (raising
+    # RemoteFileError when io_exceptions are on, otherwise a silent no-op).
+    # Direct callers (the default, +from_import: false+) are unaffected --
+    # load_file! remains the explicit, trusted local-file API and may load
+    # any readable path.
     def load_file!(file_name, options = {}, deprecated = nil)
-      opts = {base_dir: nil, media_types: :all}
+      opts = {base_dir: nil, media_types: :all, from_import: false, import_root: nil}
 
       if options.is_a? Hash
         opts.merge!(options)
@@ -534,7 +595,29 @@ module CssParser
         opts[:media_types] = deprecated if deprecated
       end
 
+      # Pin the containment root to the first base_dir seen in the chain.
+      # load_file! resets base_dir to each file's own directory as it
+      # recurses, so without this a file loaded from a subdirectory would
+      # shrink the sandbox and reject a legitimate `..` back toward the
+      # caller's original base_dir.
+      opts[:import_root] ||= opts[:base_dir]
+
       file_name = File.expand_path(file_name, opts[:base_dir])
+
+      # Containment check for @import-sourced paths: the resolved file must
+      # stay inside the import root. Rejects both `@import "/etc/passwd"`
+      # (absolute) and `@import "../../secret"` (traversal escaping the
+      # tree) from untrusted CSS, while leaving direct load_file! callers
+      # untouched and still permitting `..` that stays within the root.
+      if opts[:from_import] && (opts[:import_root] || opts[:base_dir])
+        root = File.expand_path((opts[:import_root] || opts[:base_dir]).to_s)
+        unless file_name == root || file_name.start_with?(root + File::SEPARATOR)
+          raise RemoteFileError, file_name if @options[:io_exceptions]
+
+          return
+        end
+      end
+
       return unless File.readable?(file_name)
       return unless circular_reference_check(file_name)
 
@@ -568,7 +651,8 @@ module CssParser
     #
     # Raises a CircularReferenceError exception if io_exceptions are on,
     # otherwise returns true/false.
-    def circular_reference_check(path)
+    # TODO: fix rubocop
+    def circular_reference_check(path) # rubocop:disable Naming/PredicateMethod
       path = path.to_s
       if @loaded_uris.include?(path)
         raise CircularReferenceError, "can't load #{path} more than once" if @options[:io_exceptions]
@@ -609,87 +693,158 @@ module CssParser
       utf8_block
     end
 
-    # Download a file into a string.
+    # Read a local file:// URI. Called only from `load_uri!` — never
+    # from the remote read path — so an HTTP redirect cannot reach this
+    # branch (GHSA-9pmc-p236-855h).
+    def read_local_file(uri) # :nodoc:
+      # Internal invariant: this method is the implementation of the
+      # `allow_file_uris: true` branch of `load_uri!`. If it is ever
+      # reached without that flag set, a future change has bypassed the
+      # LFI gate; refuse to read rather than silently leak.
+      unless @options[:allow_file_uris]
+        raise "BUG: #{self.class}##{__method__} reached with " \
+              'allow_file_uris=false (LFI gate bypassed)'
+      end
+
+      return nil unless circular_reference_check(uri.to_s)
+
+      path = uri.path
+      path.gsub!(%r{^/}, '') if Gem.win_platform?
+      File.read(path, mode: 'rb')
+    rescue
+      raise RemoteFileError, uri.to_s if @options[:io_exceptions]
+
+      nil
+    end
+
+    # Download a remote http(s) file into a string.
     #
     # Returns the file's data and character set in an array.
+    #
+    # In the default (secure) configuration, requests are issued via
+    # `SsrfFilter.get`, which:
+    #   - rejects any scheme other than http/https (defeats redirect-to-
+    #     `file://` / `gopher://` / `dict://` etc.);
+    #   - resolves the hostname with `Resolv` and rejects requests whose
+    #     resolved IP is loopback, RFC-1918, link-local, multicast, or any
+    #     other range typically used for internal services (defeats SSRF
+    #     via literal IPs and via CNAME / attacker-controlled A records);
+    #   - re-validates scheme and IP on every redirect hop.
+    #
+    # When `allow_local_network: true` is set on the Parser, the SSRF
+    # check is bypassed and plain `Net::HTTP` is used — but the scheme
+    # is still validated on every redirect hop, so cross-scheme
+    # redirect to `file://` (the original GHSA-9pmc-p236-855h sink)
+    # remains closed even on this opt-in path.
+    #
+    # `integrity:`, when given, is verified against the raw response body
+    # (before charset decoding, matching Subresource Integrity semantics)
+    # -- see `integrity_matches?` and `load_uri!`'s documentation.
     #--
     # TODO: add option to fail silently or throw and exception on a 404
     #++
-    def read_remote_file(uri) # :nodoc:
-      if @redirect_count.nil?
-        @redirect_count = 0
-      else
-        @redirect_count += 1
-      end
+    def read_remote_file(uri, integrity: nil) # :nodoc:
+      uri = Addressable::URI.parse(uri.to_s)
 
       unless circular_reference_check(uri.to_s)
-        @redirect_count = nil
         return nil, nil
       end
 
-      if @redirect_count > MAX_REDIRECTS
-        @redirect_count = nil
+      unless REMOTE_ALLOWED_SCHEMES.include?(uri.scheme)
+        raise RemoteFileError, uri.to_s if @options[:io_exceptions]
+
         return nil, nil
       end
 
-      src = '', charset = nil
-
       begin
-        uri = Addressable::URI.parse(uri.to_s)
-
-        if uri.scheme == 'file'
-          # local file
-          path = uri.path
-          path.gsub!(%r{^/}, '') if Gem.win_platform?
-          src = File.read(path, mode: 'rb')
-        else
-          # remote file
-          if uri.scheme == 'https'
-            uri.port = 443 unless uri.port
-            http = Net::HTTP.new(uri.host, uri.port)
-            http.use_ssl = true
-            http.verify_mode = OpenSSL::SSL::VERIFY_NONE
-          else
-            http = Net::HTTP.new(uri.host, uri.port)
-          end
+        res = if @options[:allow_local_network]
+                fetch_via_net_http(uri)
+              else
+                SsrfFilter.get(
+                  uri.to_s,
+                  scheme_whitelist: REMOTE_ALLOWED_SCHEMES,
+                  max_redirects: MAX_REDIRECTS,
+                  headers: {'User-Agent' => @options[:user_agent]}
+                )
+              end
 
-          res = http.get(uri.request_uri, {'User-Agent' => @options[:user_agent], 'Accept-Encoding' => 'gzip'})
-          src = res.body
-          charset = res.respond_to?(:charset) ? res.encoding : 'utf-8'
+        if res.code.to_i >= 400
+          raise RemoteFileError, uri.to_s if @options[:io_exceptions]
 
-          if res.code.to_i >= 400
-            @redirect_count = nil
-            raise RemoteFileError, uri.to_s if @options[:io_exceptions]
+          return '', nil
+        end
 
-            return '', nil
-          elsif res.code.to_i >= 300 and res.code.to_i < 400
-            unless res['Location'].nil?
-              return read_remote_file Addressable::URI.parse(Addressable::URI.escape(res['Location']))
-            end
-          end
+        if integrity && !integrity_matches?(res.body, integrity)
+          raise IntegrityError, uri.to_s if @options[:io_exceptions]
 
-          case res['content-encoding']
-          when 'gzip'
-            io = Zlib::GzipReader.new(StringIO.new(res.body))
-            src = io.read
-          when 'deflate'
-            io = Zlib::Inflate.new
-            src = io.inflate(res.body)
-          end
+          return nil, nil
         end
 
-        if charset
-          src.encode!('UTF-8', charset)
-        end
+        charset = res.respond_to?(:charset) ? res.encoding : 'utf-8'
+        src = res.body
+        src.encode!('UTF-8', charset) if charset
+
+        [src, charset]
+      rescue IntegrityError # already is a RemoteFileError
+        raise
       rescue
-        @redirect_count = nil
         raise RemoteFileError, uri.to_s if @options[:io_exceptions]
 
-        return nil, nil
+        [nil, nil]
+      end
+    end
+
+    # Verifies +body+ (raw response bytes, not yet charset-decoded) against a
+    # Subresource Integrity value -- a `<algorithm>-<base64 digest>` token, or
+    # several whitespace-separated tokens (https://www.w3.org/TR/SRI/#the-integrity-attribute).
+    #
+    # - Tokens using an algorithm this library doesn't recognize are ignored
+    # - Multiple recognized algorithms only check the strongest one is checked
+    # - Value containing no recognized algorithm is treated as unverifiable and matches by default
+    def integrity_matches?(body, integrity) # :nodoc:
+      candidates = integrity.to_s.split.filter_map do |token|
+        algorithm, value = token.split('-', 2)
+        [algorithm, value] if algorithm && value && INTEGRITY_ALGORITHMS.key?(algorithm)
+      end
+      return true if candidates.empty?
+
+      algorithms_present = candidates.map(&:first)
+      algorithm = INTEGRITY_ALGORITHMS.each_key.find { |a| algorithms_present.include?(a) }
+      expected_values = candidates.select { |a, _v| a == algorithm }.map { |_a, v| v }
+      digest_class = INTEGRITY_ALGORITHMS.fetch(algorithm)
+
+      expected_values.include?(Base64.strict_encode64(digest_class.digest(body)))
+    end
+
+    # Net::HTTP path used only when `allow_local_network: true`. Validates
+    # the URI scheme on every redirect hop so a `Location: file://...`
+    # cannot be followed even on this opt-in code path.
+    def fetch_via_net_http(uri, redirect_count = 0) # :nodoc:
+      # Internal invariant: this method is the implementation of the
+      # `allow_local_network: true` branch of `read_remote_file`. If it
+      # is ever reached without that flag set, a future change has
+      # bypassed the SSRF gate; refuse to fetch rather than silently
+      # connect. The recursive call on a redirect inherits this guard
+      # because the option does not change mid-request.
+      unless @options[:allow_local_network]
+        raise "BUG: #{self.class}##{__method__} reached with " \
+              'allow_local_network=false (SSRF gate bypassed)'
+      end
+
+      raise RemoteFileError, uri.to_s unless REMOTE_ALLOWED_SCHEMES.include?(uri.scheme)
+      raise RemoteFileError, uri.to_s if redirect_count > MAX_REDIRECTS
+
+      http = Net::HTTP.new(uri.host, uri.port || uri.default_port)
+      http.use_ssl = (uri.scheme == 'https')
+
+      res = http.get(uri.request_uri, {'User-Agent' => @options[:user_agent]})
+
+      if res.code.to_i >= 300 && res.code.to_i < 400 && res['Location']
+        redirect_uri = Addressable::URI.parse(Addressable::URI.escape(res['Location']))
+        return fetch_via_net_http(redirect_uri, redirect_count + 1)
       end
 
-      @redirect_count = nil
-      [src, charset]
+      res
     end
 
   private

data/lib/css_parser/regexps.rb

@@ -35,6 +35,9 @@ module CssParser
   #++
   IMPORTANT_IN_PROPERTY_RX = /\s*!important\b\s*/i.freeze
 
+  # What sanitize_media_query would change: blank, padded, or not single-space separated
+  UNSANITIZED_MEDIA_QUERY_RX = /\A\z|\A[\s\0]|[\s\0]\z|\s\s|[^\S ]/.freeze
+
   RE_INSIDE_OUTSIDE = regex_possible_values 'inside', 'outside'
   RE_SCROLL_FIXED = regex_possible_values 'scroll', 'fixed'
   RE_REPEAT = regex_possible_values 'repeat(\-x|\-y)*|no\-repeat'
@@ -61,20 +64,27 @@ module CssParser
   RE_BORDER_UNITS = Regexp.union(BOX_MODEL_UNITS_RX, /(thin|medium|thick)/i)
 
   # Functions like calc, var, clamp, etc.
-  RE_FUNCTIONS = /
-    (
-      [a-z0-9-]+        # function name
-    )
-    (?>
-      \(                # opening parenthesis
-        (?:
-          ([^()]+)
-          |             # recursion via subexpression
-          \g<0>
-        )*
-      \)                # closing parenthesis
-    )
-  /imx.freeze
+  # Possessive quantifiers + recursion-first alternation avoid exponential
+  # backtracking on unclosed functions, the timeout is a backstop.
+  RE_FUNCTIONS = Regexp.new(
+    /
+      (
+        [a-z0-9-]+        # function name
+      )
+      (?>
+        \(                # opening parenthesis
+          (?:
+            \g<0>         # nested function
+            |
+            [^()a-z0-9]++
+            |
+            [a-z0-9-]++ (?!\()
+          )*
+        \)                # closing parenthesis
+      )
+    /imx,
+    timeout: 0.01
+  ).freeze
 
   # Patterns for specificity calculations
   NON_ID_ATTRIBUTES_AND_PSEUDO_CLASSES_RX_NC = /
@@ -259,8 +269,10 @@ module CssParser
     inherit
     currentColor
   ].freeze
-  RE_COLOUR_NUMERIC = /\b(hsl|rgb)\s*\(-?\s*-?\d+(\.\d+)?%?\s*%?,-?\s*-?\d+(\.\d+)?%?\s*%?,-?\s*-?\d+(\.\d+)?%?\s*%?\)/i.freeze
-  RE_COLOUR_NUMERIC_ALPHA = /\b(hsla|rgba)\s*\(-?\s*-?\d+(\.\d+)?%?\s*%?,-?\s*-?\d+(\.\d+)?%?\s*%?,-?\s*-?\d+(\.\d+)?%?\s*%?,-?\s*-?\d+(\.\d+)?%?\s*%?\)/i.freeze
+  # CSS <number> allows the integer part to be omitted (e.g. `.1`), per CSS Values & Units.
+  # `(?:\d*\.)?\d+` accepts `1`, `1.5`, and `.5` while still rejecting bare `1.`.
+  RE_COLOUR_NUMERIC = /\b(hsl|rgb)\s*\(-?\s*-?(?:\d*\.)?\d+%?\s*%?,-?\s*-?(?:\d*\.)?\d+%?\s*%?,-?\s*-?(?:\d*\.)?\d+%?\s*%?\)/i.freeze
+  RE_COLOUR_NUMERIC_ALPHA = /\b(hsla|rgba)\s*\(-?\s*-?(?:\d*\.)?\d+%?\s*%?,-?\s*-?(?:\d*\.)?\d+%?\s*%?,-?\s*-?(?:\d*\.)?\d+%?\s*%?,-?\s*-?(?:\d*\.)?\d+%?\s*%?\)/i.freeze
   RE_COLOUR_HEX = /\s*#([0-9a-fA-F]{6}|[0-9a-fA-F]{3})\b/.freeze
   RE_COLOUR_NAMED = /\s*\b(#{NAMED_COLOURS.join('|')})\b/i.freeze
   RE_COLOUR = Regexp.union(RE_COLOUR_NUMERIC, RE_COLOUR_NUMERIC_ALPHA, RE_COLOUR_HEX, RE_COLOUR_NAMED)

data/lib/css_parser/rule_set.rb

@@ -18,6 +18,11 @@ module CssParser
 
     NUMBER_OF_DIMENSIONS = 4
 
+    NORMALIZED_PROPERTY_RX = /\A[-a-z0-9_]+\z/.freeze
+    BLANK_VALUE_RX = /\A[\s\0]*\z/.freeze
+    SURROUNDING_WHITESPACE_RX = /\A[\s\0]|[\s\0]\z/.freeze
+    TRAILING_SEMICOLON_RX = /\s*;\s*\Z/.freeze
+
     DIMENSIONS = [
       ['margin', %w[margin-top margin-right margin-bottom margin-left]],
       ['padding', %w[padding-top padding-right padding-bottom padding-left]],
@@ -35,6 +40,8 @@ module CssParser
     RPAREN = ')'.freeze
     IMPORTANT = '!important'.freeze
     class Declarations
+      EMPTY_DECLARATIONS = {}.freeze
+
       class Value
         attr_reader :value
         attr_accessor :important
@@ -45,12 +52,17 @@ module CssParser
         end
 
         def value=(value)
-          value = value.to_s.sub(/\s*;\s*\Z/, '')
-          self.important = !value.slice!(CssParser::IMPORTANT_IN_PROPERTY_RX).nil?
-          value.strip!
+          # sub and strip always return a copy, and the caller's string must not be mutated:
+          # only copy when there is something to remove, so a clean value allocates nothing
+          value = value.to_s
+          value = value.sub(TRAILING_SEMICOLON_RX, '') if value.match?(TRAILING_SEMICOLON_RX)
+          self.important = value.match?(CssParser::IMPORTANT_IN_PROPERTY_RX)
+          value = value.sub(CssParser::IMPORTANT_IN_PROPERTY_RX, '') if important
+          value = value.strip if value.match?(SURROUNDING_WHITESPACE_RX)
           raise ArgumentError, 'value is empty' if value.empty?
 
-          @value = value.freeze
+          # value may still be the caller's string: -value freezes a copy instead of it
+          @value = -value
         end
 
         def to_s
@@ -68,7 +80,7 @@ module CssParser
 
       def_delegators :declarations, :each, :each_value
 
-      def initialize(declarations = {})
+      def initialize(declarations = EMPTY_DECLARATIONS)
         self.declarations = {}
         declarations.each { |property, value| add_declaration!(property, value) }
       end
@@ -89,17 +101,20 @@ module CssParser
       #   puts declarations['margin']
       #   => #<CssParser::RuleSet::Declarations::Value:0x00000000030c1838 @important=true, @order=2, @value="0px auto">
       #
-      # If the property already exists its value will be over-written.
+      # If the property already exists its value will be over-written unless it was !important and the new value
+      # is not !important.
       # If the value is empty - property will be deleted
       def []=(property, value)
         property = normalize_property(property)
+        currently_important = declarations[property]&.important
 
-        if value.is_a?(Value)
+        if value.is_a?(Value) && (!currently_important || value.important)
           declarations[property] = value
-        elsif value.to_s.strip.empty?
+        elsif value.to_s.match?(BLANK_VALUE_RX)
           delete property
         else
-          declarations[property] = Value.new(value)
+          value = Value.new(value)
+          declarations[property] = value if !currently_important || value.important
         end
       rescue ArgumentError => e
         raise e.exception, "#{property} #{e.message}"
@@ -159,18 +174,19 @@ module CssParser
 
         # We should preserve subsequent declarations of the same properties
         # and prior important ones if replacement one is not important
-        replacements = replacement_declarations.each.with_object({}) do |(key, replacement), result|
+        replacements = {}
+        replacement_declarations.declarations.each do |key, replacement|
           existing = declarations[key]
 
           # No existing -> set
           unless existing
-            result[key] = replacement
+            replacements[key] = replacement
             next
           end
 
           # Replacement more important than existing -> replace
           if replacement.important && !existing.important
-            result[key] = replacement
+            replacements[key] = replacement
             replaced_index = replacement_keys.index(key)
             replacement_keys.delete_at(replaced_index)
             replacement_values.delete_at(replaced_index)
@@ -183,7 +199,7 @@ module CssParser
 
           # Existing and replacement importance are the same,
           # value which is declared later wins
-          result[key] = replacement if property_index > replacement_keys.index(key)
+          replacements[key] = replacement if property_index > replacement_keys.index(key)
         end
 
         return if replacements.empty?
@@ -194,16 +210,17 @@ module CssParser
         replacement_values.delete_at(property_index)
         replacement_values.insert(property_index, *replacements.values)
 
-        self.declarations = replacement_keys.zip(replacement_values).to_h
+        self.declarations = {}
+        replacement_keys.each_with_index { |key, index| declarations[key] = replacement_values[index] }
       end
 
       def to_s(options = {})
-        str = declarations.reduce(+'') do |memo, (prop, value)|
+        str = +''
+        declarations.each do |prop, value|
           importance = options[:force_important] || value.important ? ' !important' : ''
-          memo << "#{prop}: #{value.value}#{importance}; "
+          str << prop << ': ' << value.value << importance << '; '
         end
-        # TODO: Clean-up regexp doesn't seem to work
-        str.gsub!(/^[\s^({)]+|[\n\r\f\t]*|\s+$/mx, '')
+        str.gsub!(/^[\s^({)]+|[\n\r\f\t]+/, '')
         str.strip!
         str
       end
@@ -223,7 +240,10 @@ module CssParser
       attr_writer :declarations
 
       def normalize_property(property)
-        property = property.to_s.downcase
+        property = property.to_s
+        return property if property.match?(NORMALIZED_PROPERTY_RX)
+
+        property = property.downcase
         property.strip!
         property
       end
@@ -396,14 +416,14 @@ module CssParser
       DIMENSIONS.each do |property, (top, right, bottom, left)|
         next unless (declaration = declarations[property])
 
-        value = declaration.value.dup
+        value = declaration.value
 
         # RGB and HSL values in borders are the only units that can have spaces (within params).
         # We cheat a bit here by stripping spaces after commas in RGB and HSL values so that we
         # can split easily on spaces.
         #
         # TODO: rgba, hsl, hsla
-        value.gsub!(RE_COLOUR) { |c| c.gsub(/(\s*,\s*)/, ',') }
+        value = value.gsub(RE_COLOUR) { |c| c.gsub(/(\s*,\s*)/, ',') } if value.include?(',')
 
         matches = split_value_preserving_function_whitespace(value)
 
@@ -421,7 +441,7 @@ module CssParser
           raise ArgumentError, "Cannot parse #{value}"
         end
 
-        replacement = [top, right, bottom, left].zip(values).to_h
+        replacement = {top => values[0], right => values[1], bottom => values[2], left => values[3]}
 
         declarations.replace_declaration!(property, replacement, preserve_importance: true)
       end
@@ -515,17 +535,13 @@ module CssParser
 
     # Combine several properties into a shorthand one
     def create_shorthand_properties!(properties, shorthand_property) # :nodoc:
-      values = []
-      properties_to_delete = []
-      properties.each do |property|
-        next unless (declaration = declarations[property])
-        next if declaration.important
-
-        values << declaration.value
-        properties_to_delete << property
+      properties_to_delete = properties.select do |property|
+        (declaration = declarations[property]) && !declaration.important
       end
 
-      return if values.length <= 1
+      return if properties_to_delete.length <= 1
+
+      values = properties_to_delete.map { |property| declarations[property].value }
 
       properties_to_delete.each do |property|
         declarations.delete(property)
@@ -581,14 +597,11 @@ module CssParser
       return if declarations.size < NUMBER_OF_DIMENSIONS
 
       DIMENSIONS.each do |property, dimensions|
-        values = DIMENSION_DIRECTIONS.each_with_index.with_object({}) do |(side, index), result|
-          next unless (declaration = declarations[dimensions[index]])
-
-          result[side] = declaration.value
-        end
-
         # All four dimensions must be present
-        next if values.size != dimensions.size
+        next unless dimensions.all? { |dimension| declarations.key?(dimension) }
+
+        top, right, bottom, left = dimensions.map { |dimension| declarations[dimension].value }
+        values = {top: top, right: right, bottom: bottom, left: left}
 
         new_value = values.values_at(*compute_dimensions_shorthand(values)).join(' ').strip
         declarations[property] = new_value unless new_value.empty?
@@ -638,7 +651,7 @@ module CssParser
 
     def compute_dimensions_shorthand(values)
       # All four sides are equal, returning single value
-      return [:top] if values.values.uniq.count == 1
+      return [:top] if values[:top] == values[:right] && values[:right] == values[:bottom] && values[:bottom] == values[:left]
 
       # `/* top | right | bottom | left */`
       return DIMENSION_DIRECTIONS if values[:left] != values[:right]
@@ -667,12 +680,13 @@ module CssParser
         next unless (colon = decs.index(COLON))
 
         property = decs[0, colon]
-        value = decs[(colon + 1)..]
+        value = decs[colon + 1, decs.length]
         property.strip!
         value.strip!
-        next if property.empty? || value.empty? || value.casecmp?(IMPORTANT)
+        # casecmp? case-folds both strings, allocating two of them per declaration
+        next if property.empty? || value.empty? || value.casecmp(IMPORTANT).zero?
 
-        add_declaration!(property, value)
+        add_declaration!(property, value.freeze)
         continuation = nil
       end
     end
@@ -685,7 +699,7 @@ module CssParser
     # TODO: way too simplistic
     #++
     def parse_selectors!(selectors) # :nodoc:
-      @selectors = selectors.split(',').map do |s|
+      @selectors = selectors.split(',').map! do |s|
         s.gsub!(/\s+/, ' ')
         s.strip!
         s
@@ -693,10 +707,16 @@ module CssParser
     end
 
     def split_value_preserving_function_whitespace(value)
-      split_value = value.gsub(RE_FUNCTIONS) do |c|
-        c.gsub!(/\s+/, WHITESPACE_REPLACEMENT)
-        c
-      end
+      # hostile values can still hit the regexp timeout, then split without protecting functions
+      split_value =
+        begin
+          value.gsub(RE_FUNCTIONS) do |c|
+            c.gsub!(/\s+/, WHITESPACE_REPLACEMENT)
+            c
+          end
+        rescue Regexp::TimeoutError
+          value
+        end
 
       matches = split_value.strip.split(/\s+/)
 

data/lib/css_parser/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module CssParser
-  VERSION = '1.21.0'.freeze
+  VERSION = '3.4.0'.freeze
 end

data/lib/css_parser.rb

@@ -4,8 +4,7 @@ require 'addressable/uri'
 require 'uri'
 require 'net/https'
 require 'digest/md5'
-require 'zlib'
-require 'stringio'
+require 'ssrf_filter'
 
 require 'css_parser/version'
 require 'css_parser/rule_set'
@@ -52,8 +51,6 @@ module CssParser
   # TODO: declaration_hashes should be able to contain a RuleSet
   #       this should be a Class method
   def self.merge(*rule_sets)
-    @folded_declaration_cache = {}
-
     # in case called like CssParser.merge([rule_set, rule_set])
     rule_sets.flatten! if rule_sets[0].is_a?(Array)
 
@@ -88,9 +85,10 @@ module CssParser
       end
     end
 
-    merged = properties.each_with_object(RuleSet.new(nil, nil)) do |(property, details), rule_set|
-      value = details[:value].strip
-      rule_set[property.strip] = details[:is_important] ? "#{value.gsub(/;\Z/, '')}!important" : value
+    merged = RuleSet.new(nil, nil)
+    properties.each do |property, details|
+      value = details[:value]
+      merged[property] = details[:is_important] ? "#{value.gsub(/;\Z/, '')}!important" : value
     end
 
     merged.create_shorthand!
@@ -110,7 +108,7 @@ module CssParser
   #++
   def self.calculate_specificity(selector)
     a = 0
-    b = selector.scan('#').length
+    b = selector.count('#')
     c = selector.scan(NON_ID_ATTRIBUTES_AND_PSEUDO_CLASSES_RX_NC).length
     d = selector.scan(ELEMENTS_AND_PSEUDO_ELEMENTS_RX_NC).length
 
@@ -150,6 +148,8 @@ module CssParser
   end
 
   def self.sanitize_media_query(raw)
+    return raw if raw.is_a?(Symbol) && !raw.match?(UNSANITIZED_MEDIA_QUERY_RX)
+
     mq = raw.to_s.gsub(/\s+/, ' ')
     mq.strip!
     mq = 'all' if mq.empty?

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: css_parser
 version: !ruby/object:Gem::Version
-  version: 1.21.0
+  version: 3.4.0
 platform: ruby
 authors:
 - Alex Dunae
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-12-13 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable
@@ -24,6 +23,34 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: ssrf_filter
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.5'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.5'
 description: A set of classes for parsing CSS in Ruby.
 email: code@dunae.ca
 executables: []
@@ -44,7 +71,6 @@ metadata:
   source_code_uri: https://github.com/premailer/css_parser
   bug_tracker_uri: https://github.com/premailer/css_parser/issues
   rubygems_mfa_required: 'true'
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -52,15 +78,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.0'
+      version: '3.3'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.19
-signing_key:
+rubygems_version: 4.0.3
 specification_version: 4
 summary: Ruby CSS parser.
 test_files: []