devcenter-parser 2.0.2 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: e9ee5923d033c90c44a0a059d27650d111cb54ee
-  data.tar.gz: a46dcae3dc64af31c594ce6bfcf195ed5f75dc84
+  metadata.gz: 4d95a94b7c9105e23060c78ab4615837110ed790
+  data.tar.gz: 388710bb2e60085a1585deec9aaf2d0b91ab3a90
 SHA512:
-  metadata.gz: 297348d24ed92f6657583779f9c6fe41d80beecf2c74c15f6402a3312674566eb5edf7667ad4a883b0112ca777ebb8984000cf21417a83db972ed31b9fcb13af
-  data.tar.gz: b0791de31c6228d364e85728dc150f82dde76ee29800e542b767d68a6c4673829eafc99da09b0973792c8dbc26763950bbfcc9d3d1f861cabe05fecb0d3b7a40
+  metadata.gz: afa310e5adb4c2f160a0196144a8588d6a8c284e8e6115bdba8e9844e761fcdfa7aae4e9438f3a4a518872573b715a80f394dc21576bc1e5483a73678d16f35d
+  data.tar.gz: 2918139f9658bff3f9ec1746405f70eef5e3681a9e07c7243fafac67126961446a45cc60efc04efe05a2d8807944805c0150fadca772bd5bc9bca796d67c1f7f

data/lib/devcenter-parser.rb

@@ -86,6 +86,8 @@ module DevcenterParser
     # custom
     config[:elements] += %w{ toolbelt }
 
+    config[:transformers] = Array(config[:transformers]).push(iframe_sanitizer)
+
     @@sanitize_config = config.merge({remove_contents: true, allow_comments: true})
   end
 
@@ -109,4 +111,11 @@ module DevcenterParser
     broken_html = html.match(/REXML could not parse this XML\/HTML\:(.+)<\/pre>/m)[1].strip rescue nil
     broken_html.nil? ? "Contains broken raw HTML." : "This raw HTML is invalid: #{CGI.unescapeHTML(broken_html)}"
   end
+
+  def self.iframe_sanitizer
+    lambda do |env|
+      return unless env[:node].attributes['src']
+      env[:node].unlink if env[:node].attributes['src'].value =~ /\Ajavascript:/
+    end
+  end
 end

data/lib/devcenter-parser/version.rb

@@ -1,3 +1,3 @@
 module DevcenterParser
-  VERSION = '2.0.2'
+  VERSION = '2.1.0'
 end

data/test/devcenter-parser_test.rb

@@ -421,6 +421,15 @@ HTML
 
       assert_parsing_result md, html
     end
+
+    it 'removes elements with src="javascript:"' do
+      md = <<-MARKDOWN
+<iframe src="javascript:">alert("foo");</iframe>
+<img src="javascript:" />
+      MARKDOWN
+
+      assert_parsing_result md, "<p></p>"
+    end
   end
 
 

metadata

@@ -1,27 +1,27 @@
 --- !ruby/object:Gem::Specification
 name: devcenter-parser
 version: !ruby/object:Gem::Version
-  version: 2.0.2
+  version: 2.1.0
 platform: ruby
 authors:
 - Heroku
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-12-22 00:00:00.000000000 Z
+date: 2016-06-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.4.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.4.4
 - !ruby/object:Gem::Dependency
@@ -56,28 +56,28 @@ dependencies:
   name: minitest
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>'
+    - - ">"
       - !ruby/object:Gem::Version
         version: '2.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>'
+    - - ">"
       - !ruby/object:Gem::Version
         version: '2.0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 description: Parser for Heroku Dev Center's content
@@ -107,17 +107,17 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.0.14
+rubygems_version: 2.4.5.1
 signing_key: 
 specification_version: 4
 summary: Parser for Heroku Dev Center's content