css_parser 3.0.0 → 3.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7286523850595059190f244936748ce609fc7d22de85ef56d5c5c229bd9a4ba4
-  data.tar.gz: 64fe512e21e1687c4221be94793eedbf603bd5723ef32a804177f70ba96e41b7
+  metadata.gz: 7c675c0d95c9efce004a49e17cf09c880c44c4c11375f754c50586052c03202d
+  data.tar.gz: 2d729de7e39e045d1e2594e4c847c495ef7765d34c37b76f53ef9348de0e1f96
 SHA512:
-  metadata.gz: 63fa1631ae27fb97c375eb50d2e2b29f99e029872be0ad82191834818ad989470517c7d52cb77291a6a2a58fd920c3d1aa10a6250b5b569641016c77862b57cc
-  data.tar.gz: e6c24be4780b12aff38d866e5f0bc6b2b17deb78a94d2bb5072ec23bd82fcd70e1bcab63e4e02e915d2796e09dcaf9f5a239614c5c792d33003bb8ef0ca89d00
+  metadata.gz: ab3178e90c357ad4ede9c90ac70526bbe4b90a475690afa60551d4acfc2bb41a70db125bdda040a1bbcfa8f4e3dfa454401116aec745e639af9244c71c3f7c6a
+  data.tar.gz: 15838f208ef82d6a2d5adbddcb5486ad5b13b0d88f32e3923b6f7bd064fbbe08dc4f6dc4af0a299a517ff7c4faec3010a044b59209b809248e58622b08a29c4a

data/lib/css_parser/parser.rb

@@ -1,11 +1,16 @@
 # frozen_string_literal: true
 
 require 'strscan'
+require 'digest'
+require 'base64'
 
 module CssParser
   # Exception class used for any errors encountered while downloading remote files.
   class RemoteFileError < IOError; end
 
+  # Exception class used when a fetched remote file fails Subresource Integrity verification.
+  class IntegrityError < RemoteFileError; end
+
   # Exception class used if a request is made to load a CSS file more than once.
   class CircularReferenceError < StandardError; end
 
@@ -37,6 +42,15 @@ module CssParser
     # was GHSA-9pmc-p236-855h.
     REMOTE_ALLOWED_SCHEMES = %w[http https].freeze
 
+    # Subresource Integrity hash algorithms this library can verify, strongest first.
+    # Mirrors the SRI spec's "agility" rule (https://www.w3.org/TR/SRI/#agility):
+    #   if `integrity` lists multiple algorithms, only the strongest is checked.
+    INTEGRITY_ALGORITHMS = {
+      'sha512' => Digest::SHA512,
+      'sha384' => Digest::SHA384,
+      'sha256' => Digest::SHA256
+    }.freeze
+
     # Array of CSS files that have been loaded.
     attr_reader :loaded_uris
 
@@ -492,9 +506,7 @@ module CssParser
     #
     # You can also pass in file://test.css
     #
-    # See add_block! for options.
-    #
-    # Deprecated: originally accepted three params: `uri`, `base_uri` and `media_types`
+    # See add_block! for options and integrity_matches? for integrity
     def load_uri!(uri, options = {}, deprecated = nil)
       uri = Addressable::URI.parse(uri) unless uri.respond_to? :scheme
 
@@ -502,7 +514,7 @@ module CssParser
 
       if options.is_a? Hash
         opts.merge!(options)
-      else
+      else # TODO: start raising
         warn '[DEPRECATION] `load_uri!` with positional arguments is deprecated. ' \
              'Please use keyword arguments instead.', uplevel: 1
         opts[:base_uri] = options if options.is_a? String
@@ -538,7 +550,7 @@ module CssParser
               end
               read_local_file(uri)
             else
-              src_and_charset, = read_remote_file(uri) # skip charset
+              src_and_charset, = read_remote_file(uri, integrity: opts[:integrity]) # skip charset
               src_and_charset
             end
 
@@ -677,10 +689,14 @@ module CssParser
     # is still validated on every redirect hop, so cross-scheme
     # redirect to `file://` (the original GHSA-9pmc-p236-855h sink)
     # remains closed even on this opt-in path.
+    #
+    # `integrity:`, when given, is verified against the raw response body
+    # (before charset decoding, matching Subresource Integrity semantics)
+    # -- see `integrity_matches?` and `load_uri!`'s documentation.
     #--
     # TODO: add option to fail silently or throw and exception on a 404
     #++
-    def read_remote_file(uri) # :nodoc:
+    def read_remote_file(uri, integrity: nil) # :nodoc:
       uri = Addressable::URI.parse(uri.to_s)
 
       unless circular_reference_check(uri.to_s)
@@ -711,11 +727,19 @@ module CssParser
           return '', nil
         end
 
+        if integrity && !integrity_matches?(res.body, integrity)
+          raise IntegrityError, uri.to_s if @options[:io_exceptions]
+
+          return nil, nil
+        end
+
         charset = res.respond_to?(:charset) ? res.encoding : 'utf-8'
         src = res.body
         src.encode!('UTF-8', charset) if charset
 
         [src, charset]
+      rescue IntegrityError # already is a RemoteFileError
+        raise
       rescue
         raise RemoteFileError, uri.to_s if @options[:io_exceptions]
 
@@ -723,6 +747,28 @@ module CssParser
       end
     end
 
+    # Verifies +body+ (raw response bytes, not yet charset-decoded) against a
+    # Subresource Integrity value -- a `<algorithm>-<base64 digest>` token, or
+    # several whitespace-separated tokens (https://www.w3.org/TR/SRI/#the-integrity-attribute).
+    #
+    # - Tokens using an algorithm this library doesn't recognize are ignored
+    # - Multiple recognized algorithms only check the strongest one is checked
+    # - Value containing no recognized algorithm is treated as unverifiable and matches by default
+    def integrity_matches?(body, integrity) # :nodoc:
+      candidates = integrity.to_s.split.filter_map do |token|
+        algorithm, value = token.split('-', 2)
+        [algorithm, value] if algorithm && value && INTEGRITY_ALGORITHMS.key?(algorithm)
+      end
+      return true if candidates.empty?
+
+      algorithms_present = candidates.map(&:first)
+      algorithm = INTEGRITY_ALGORITHMS.each_key.find { |a| algorithms_present.include?(a) }
+      expected_values = candidates.select { |a, _v| a == algorithm }.map { |_a, v| v }
+      digest_class = INTEGRITY_ALGORITHMS.fetch(algorithm)
+
+      expected_values.include?(Base64.strict_encode64(digest_class.digest(body)))
+    end
+
     # Net::HTTP path used only when `allow_local_network: true`. Validates
     # the URI scheme on every redirect hop so a `Location: file://...`
     # cannot be followed even on this opt-in code path.

data/lib/css_parser/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module CssParser
-  VERSION = '3.0.0'.freeze
+  VERSION = '3.1.0'.freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: css_parser
 version: !ruby/object:Gem::Version
-  version: 3.0.0
+  version: 3.1.0
 platform: ruby
 authors:
 - Alex Dunae
@@ -23,6 +23,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: ssrf_filter
   requirement: !ruby/object:Gem::Requirement