devcenter-parser 2.1.2 → 2.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: b01d9f34400a51f943f040525996d6e674436631
-  data.tar.gz: 0fe36dd152d0d96092d6874a7e01a43c2291e4ff
+  metadata.gz: f2f8e036f620a0e3ac39aa533bebd4df0ba6dd83
+  data.tar.gz: 22ab56166bc5b1cff3e544edd51811327b6e77a4
 SHA512:
-  metadata.gz: 53cf30e7a354202b4e679f018e807494081d27d2de0ebef1aab0be6f88d3b312203696c76bbbd13546f0b5d4b2849a83ca80014f0c1810fe79e5947262be2d18
-  data.tar.gz: 5233abeaa204e0b36f1db64bc3cf9f1e229493f0bc942d9d653ad589a44bb5a9f914287bef3e9eac3b3ccdad0315300fbc16f0fc009154e5b78b1d10f1df723d
+  metadata.gz: e00495906e58f897e4159bdb1bd417430f7be40ec5e3aea5c3ef049ac514d6b80f9307dcc9169a9c7403c3eaa9bf7b1295a19e7fac127e749ddbaad5da82815d
+  data.tar.gz: aff646f4472e5141643fc210cdf31f89e8b3ba2deffa385148be6b0c99af7c861d72066491e5d9da3e702688a09109e78a6e310afbde8ed8b04085981556dc64

data/README.md

@@ -23,5 +23,12 @@ $ bundle exec rake
 ## License
 See the LICENSE file included in the distribution.
 
+## Release a new version
+1. Update the `lib/version.rb` file and commit
+2. Ensure you that you are an owner on [the gem's RubyGems
+   page](https://rubygems.org/gems/devcenter-parser)
+3. `rake release`
+4. Profit
+
 ## Copyright
 Copyright (C) 2013 Heroku <raul@heroku.com>.

data/Rakefile

@@ -1,3 +1,5 @@
+require 'bundler/gem_tasks'
+require 'rubygems'
 require 'rake/testtask'
 
 Rake::TestTask.new do |t|

data/lib/devcenter-parser/header_id_generator.rb

@@ -68,7 +68,7 @@ class HeaderIdGenerator
   end
 
   def conflicts(hash)
-    hash.select{ |node1, id1| hash.select{ |node1, id2| id1 == id2 }.size > 1 }
+    hash.select{ |node1, id1| hash.select{ |_node1, id2| id1 == id2 }.size > 1 }
   end
 
   def add_default_ids

data/lib/devcenter-parser/version.rb

@@ -1,3 +1,3 @@
 module DevcenterParser
-  VERSION = '2.1.2'
+  VERSION = '2.2.0'.freeze
 end

data/lib/devcenter-parser.rb

@@ -58,7 +58,7 @@ module DevcenterParser
   end
 
   def self.remove_tags_inside_html_comments(markdown)
-    markdown.gsub /<!--((.|\s)*?)-->/ do
+    markdown.gsub(/<!--((.|\s)*?)-->/) do
       inner = $1
       inner.gsub!(/\[|\]|\(|\)|\<|\>/,'')
       "<!--#{inner}-->"
@@ -115,7 +115,8 @@ module DevcenterParser
   def self.iframe_sanitizer
     lambda do |env|
       return unless env[:node].attributes['src']
-      env[:node].unlink if env[:node].attributes['src'].value =~ /\Ajavascript:/i
+      # allow iframes if they have src that is from vimeo
+      env[:node].unlink unless env[:node].attributes['src'].value =~ /\Ahttps:\/\/player.vimeo.com\//i
     end
   end
 end

data/test/devcenter-parser_test.rb

@@ -30,6 +30,12 @@ describe 'DevcenterParser' do
       assert_parsing_result 'foo_bar_baz', '<p>foo_bar_baz</p>'
     end
 
+    it 'removes iframes with script tags in the src' do
+      md = '<iframe src="data:text/html,<script>alert(document.domain)</script>"></iframe>'
+      html = ''
+      assert_parsing_result md, html
+    end
+
     it 'removes script tags and their content' do
       md = '<strong>clean<script>alert("hack!")</script></strong>'
       html = '<p><strong>clean</strong></p>'
@@ -37,9 +43,7 @@ describe 'DevcenterParser' do
     end
 
     it 'allows embedding vimeo videos' do
-      src = <<-SRC
-<iframe src=\"https://player.vimeo.com/video/61044807?title=0&amp;byline=0&amp;portrait=0&amp;color=a086ee\" width=\"500\" height=\"281\" frameborder=\"0\" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe>
-SRC
+      src = '<iframe src="https://player.vimeo.com/video/61044807?title=0&amp;byline=0&amp;portrait=0&amp;color=a086ee" width="50" height="281" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe>'
       assert_parsing_result src, src
     end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devcenter-parser
 version: !ruby/object:Gem::Version
-  version: 2.1.2
+  version: 2.2.0
 platform: ruby
 authors:
 - Heroku
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-07-27 00:00:00.000000000 Z
+date: 2017-02-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri
@@ -117,7 +117,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.1
+rubygems_version: 2.6.8
 signing_key: 
 specification_version: 4
 summary: Parser for Heroku Dev Center's content