css_parser 3.0.0 → 3.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7286523850595059190f244936748ce609fc7d22de85ef56d5c5c229bd9a4ba4
-  data.tar.gz: 64fe512e21e1687c4221be94793eedbf603bd5723ef32a804177f70ba96e41b7
+  metadata.gz: b1b890ee0d537d338ae0a218c68424271242859ba814a52c27fcd05ffefe1acd
+  data.tar.gz: 147e41dae4da802d96124fc07b488b122967a44c0ff79bfe623291c1795e0d9b
 SHA512:
-  metadata.gz: 63fa1631ae27fb97c375eb50d2e2b29f99e029872be0ad82191834818ad989470517c7d52cb77291a6a2a58fd920c3d1aa10a6250b5b569641016c77862b57cc
-  data.tar.gz: e6c24be4780b12aff38d866e5f0bc6b2b17deb78a94d2bb5072ec23bd82fcd70e1bcab63e4e02e915d2796e09dcaf9f5a239614c5c792d33003bb8ef0ca89d00
+  metadata.gz: 76728b4b816f4b620f28198b6fd5f92f005733bec3afba0df5707d8daf99ab650fd0a0143a6222fc53c5453c32c3a13a76eb4877f3c06f5dc903a559a18d200f
+  data.tar.gz: a5b5a901312932dd9d3c50fa9a6cd4ea549180f57a7e4d85d700d5c3ec58f458927be66c2eb7169165333e153d58061dbdfa98c75c0e6ffb6a81181bc78fdd6f

data/lib/css_parser/parser.rb

@@ -1,11 +1,16 @@
 # frozen_string_literal: true
 
 require 'strscan'
+require 'digest'
+require 'base64'
 
 module CssParser
   # Exception class used for any errors encountered while downloading remote files.
   class RemoteFileError < IOError; end
 
+  # Exception class used when a fetched remote file fails Subresource Integrity verification.
+  class IntegrityError < RemoteFileError; end
+
   # Exception class used if a request is made to load a CSS file more than once.
   class CircularReferenceError < StandardError; end
 
@@ -37,6 +42,15 @@ module CssParser
     # was GHSA-9pmc-p236-855h.
     REMOTE_ALLOWED_SCHEMES = %w[http https].freeze
 
+    # Subresource Integrity hash algorithms this library can verify, strongest first.
+    # Mirrors the SRI spec's "agility" rule (https://www.w3.org/TR/SRI/#agility):
+    #   if `integrity` lists multiple algorithms, only the strongest is checked.
+    INTEGRITY_ALGORITHMS = {
+      'sha512' => Digest::SHA512,
+      'sha384' => Digest::SHA384,
+      'sha256' => Digest::SHA256
+    }.freeze
+
     # Array of CSS files that have been loaded.
     attr_reader :loaded_uris
 
@@ -159,6 +173,21 @@ module CssParser
             load_uri!(import_uri, import_options)
           elsif options[:base_dir]
             import_options[:base_dir] = options[:base_dir]
+            # The import path comes from (potentially untrusted) CSS
+            # content, not from the caller. Flag this load so load_file!
+            # keeps it contained within the import root and refuses
+            # absolute paths / `..` traversal that escape it -- otherwise
+            # @import turns into arbitrary local file disclosure. This is
+            # the base_dir sibling of the file://-via-base_uri hole closed
+            # in GHSA-9pmc-p236-855h, which left this arm untouched.
+            #
+            # import_root is the top-level base_dir, threaded through
+            # nested imports so containment is always checked against it.
+            # That still allows legitimate `../` imports that stay inside
+            # the tree (e.g. subdir/import2.css -> ../simple.css) while
+            # rejecting anything that leaves it.
+            import_options[:from_import] = true
+            import_options[:import_root] = options[:import_root] || options[:base_dir]
             load_file!(import_path, import_options)
           end
         end
@@ -492,9 +521,7 @@ module CssParser
     #
     # You can also pass in file://test.css
     #
-    # See add_block! for options.
-    #
-    # Deprecated: originally accepted three params: `uri`, `base_uri` and `media_types`
+    # See add_block! for options and integrity_matches? for integrity
     def load_uri!(uri, options = {}, deprecated = nil)
       uri = Addressable::URI.parse(uri) unless uri.respond_to? :scheme
 
@@ -502,7 +529,7 @@ module CssParser
 
       if options.is_a? Hash
         opts.merge!(options)
-      else
+      else # TODO: start raising
         warn '[DEPRECATION] `load_uri!` with positional arguments is deprecated. ' \
              'Please use keyword arguments instead.', uplevel: 1
         opts[:base_uri] = options if options.is_a? String
@@ -538,7 +565,7 @@ module CssParser
               end
               read_local_file(uri)
             else
-              src_and_charset, = read_remote_file(uri) # skip charset
+              src_and_charset, = read_remote_file(uri, integrity: opts[:integrity]) # skip charset
               src_and_charset
             end
 
@@ -546,8 +573,18 @@ module CssParser
     end
 
     # Load a local CSS file.
+    #
+    # +from_import+ (internal) marks a load whose +file_name+ originates
+    # from an @import rule in parsed CSS rather than from the caller. Such
+    # a path is attacker-influenced, so it is contained within the import
+    # root (+import_root+, the top-level +base_dir+): absolute paths and
+    # `..` traversal that escape the root are refused (raising
+    # RemoteFileError when io_exceptions are on, otherwise a silent no-op).
+    # Direct callers (the default, +from_import: false+) are unaffected --
+    # load_file! remains the explicit, trusted local-file API and may load
+    # any readable path.
     def load_file!(file_name, options = {}, deprecated = nil)
-      opts = {base_dir: nil, media_types: :all}
+      opts = {base_dir: nil, media_types: :all, from_import: false, import_root: nil}
 
       if options.is_a? Hash
         opts.merge!(options)
@@ -558,7 +595,29 @@ module CssParser
         opts[:media_types] = deprecated if deprecated
       end
 
+      # Pin the containment root to the first base_dir seen in the chain.
+      # load_file! resets base_dir to each file's own directory as it
+      # recurses, so without this a file loaded from a subdirectory would
+      # shrink the sandbox and reject a legitimate `..` back toward the
+      # caller's original base_dir.
+      opts[:import_root] ||= opts[:base_dir]
+
       file_name = File.expand_path(file_name, opts[:base_dir])
+
+      # Containment check for @import-sourced paths: the resolved file must
+      # stay inside the import root. Rejects both `@import "/etc/passwd"`
+      # (absolute) and `@import "../../secret"` (traversal escaping the
+      # tree) from untrusted CSS, while leaving direct load_file! callers
+      # untouched and still permitting `..` that stays within the root.
+      if opts[:from_import] && (opts[:import_root] || opts[:base_dir])
+        root = File.expand_path((opts[:import_root] || opts[:base_dir]).to_s)
+        unless file_name == root || file_name.start_with?(root + File::SEPARATOR)
+          raise RemoteFileError, file_name if @options[:io_exceptions]
+
+          return
+        end
+      end
+
       return unless File.readable?(file_name)
       return unless circular_reference_check(file_name)
 
@@ -677,10 +736,14 @@ module CssParser
     # is still validated on every redirect hop, so cross-scheme
     # redirect to `file://` (the original GHSA-9pmc-p236-855h sink)
     # remains closed even on this opt-in path.
+    #
+    # `integrity:`, when given, is verified against the raw response body
+    # (before charset decoding, matching Subresource Integrity semantics)
+    # -- see `integrity_matches?` and `load_uri!`'s documentation.
     #--
     # TODO: add option to fail silently or throw and exception on a 404
     #++
-    def read_remote_file(uri) # :nodoc:
+    def read_remote_file(uri, integrity: nil) # :nodoc:
       uri = Addressable::URI.parse(uri.to_s)
 
       unless circular_reference_check(uri.to_s)
@@ -711,11 +774,19 @@ module CssParser
           return '', nil
         end
 
+        if integrity && !integrity_matches?(res.body, integrity)
+          raise IntegrityError, uri.to_s if @options[:io_exceptions]
+
+          return nil, nil
+        end
+
         charset = res.respond_to?(:charset) ? res.encoding : 'utf-8'
         src = res.body
         src.encode!('UTF-8', charset) if charset
 
         [src, charset]
+      rescue IntegrityError # already is a RemoteFileError
+        raise
       rescue
         raise RemoteFileError, uri.to_s if @options[:io_exceptions]
 
@@ -723,6 +794,28 @@ module CssParser
       end
     end
 
+    # Verifies +body+ (raw response bytes, not yet charset-decoded) against a
+    # Subresource Integrity value -- a `<algorithm>-<base64 digest>` token, or
+    # several whitespace-separated tokens (https://www.w3.org/TR/SRI/#the-integrity-attribute).
+    #
+    # - Tokens using an algorithm this library doesn't recognize are ignored
+    # - Multiple recognized algorithms only check the strongest one is checked
+    # - Value containing no recognized algorithm is treated as unverifiable and matches by default
+    def integrity_matches?(body, integrity) # :nodoc:
+      candidates = integrity.to_s.split.filter_map do |token|
+        algorithm, value = token.split('-', 2)
+        [algorithm, value] if algorithm && value && INTEGRITY_ALGORITHMS.key?(algorithm)
+      end
+      return true if candidates.empty?
+
+      algorithms_present = candidates.map(&:first)
+      algorithm = INTEGRITY_ALGORITHMS.each_key.find { |a| algorithms_present.include?(a) }
+      expected_values = candidates.select { |a, _v| a == algorithm }.map { |_a, v| v }
+      digest_class = INTEGRITY_ALGORITHMS.fetch(algorithm)
+
+      expected_values.include?(Base64.strict_encode64(digest_class.digest(body)))
+    end
+
     # Net::HTTP path used only when `allow_local_network: true`. Validates
     # the URI scheme on every redirect hop so a `Location: file://...`
     # cannot be followed even on this opt-in code path.

data/lib/css_parser/regexps.rb

@@ -61,20 +61,27 @@ module CssParser
   RE_BORDER_UNITS = Regexp.union(BOX_MODEL_UNITS_RX, /(thin|medium|thick)/i)
 
   # Functions like calc, var, clamp, etc.
-  RE_FUNCTIONS = /
-    (
-      [a-z0-9-]+        # function name
-    )
-    (?>
-      \(                # opening parenthesis
-        (?:
-          ([^()]+)
-          |             # recursion via subexpression
-          \g<0>
-        )*
-      \)                # closing parenthesis
-    )
-  /imx.freeze
+  # Possessive quantifiers + recursion-first alternation avoid exponential
+  # backtracking on unclosed functions, the timeout is a backstop.
+  RE_FUNCTIONS = Regexp.new(
+    /
+      (
+        [a-z0-9-]+        # function name
+      )
+      (?>
+        \(                # opening parenthesis
+          (?:
+            \g<0>         # nested function
+            |
+            [^()a-z0-9]++
+            |
+            [a-z0-9-]++ (?!\()
+          )*
+        \)                # closing parenthesis
+      )
+    /imx,
+    timeout: 0.01
+  ).freeze
 
   # Patterns for specificity calculations
   NON_ID_ATTRIBUTES_AND_PSEUDO_CLASSES_RX_NC = /

data/lib/css_parser/rule_set.rb

@@ -696,10 +696,16 @@ module CssParser
     end
 
     def split_value_preserving_function_whitespace(value)
-      split_value = value.gsub(RE_FUNCTIONS) do |c|
-        c.gsub!(/\s+/, WHITESPACE_REPLACEMENT)
-        c
-      end
+      # hostile values can still hit the regexp timeout, then split without protecting functions
+      split_value =
+        begin
+          value.gsub(RE_FUNCTIONS) do |c|
+            c.gsub!(/\s+/, WHITESPACE_REPLACEMENT)
+            c
+          end
+        rescue Regexp::TimeoutError
+          value
+        end
 
       matches = split_value.strip.split(/\s+/)
 

data/lib/css_parser/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module CssParser
-  VERSION = '3.0.0'.freeze
+  VERSION = '3.3.0'.freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: css_parser
 version: !ruby/object:Gem::Version
-  version: 3.0.0
+  version: 3.3.0
 platform: ruby
 authors:
 - Alex Dunae
@@ -23,6 +23,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: ssrf_filter
   requirement: !ruby/object:Gem::Requirement