devcenter-parser 2.2.0 → 2.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: f2f8e036f620a0e3ac39aa533bebd4df0ba6dd83
-  data.tar.gz: 22ab56166bc5b1cff3e544edd51811327b6e77a4
+  metadata.gz: 33d985f26f470aa8726d4bde43b7e8b2bf189ff1
+  data.tar.gz: 8a85de0f3826a51f796ec72e42e398822432a419
 SHA512:
-  metadata.gz: e00495906e58f897e4159bdb1bd417430f7be40ec5e3aea5c3ef049ac514d6b80f9307dcc9169a9c7403c3eaa9bf7b1295a19e7fac127e749ddbaad5da82815d
-  data.tar.gz: aff646f4472e5141643fc210cdf31f89e8b3ba2deffa385148be6b0c99af7c861d72066491e5d9da3e702688a09109e78a6e310afbde8ed8b04085981556dc64
+  metadata.gz: fd8aa1323f3abd4587612013659b7a08e3ddc90293fcf73703202d8544ec01d053bfeefcfb6e99c5a61aa87c4543b62b748bc34e9a8adb710efd361e2b2b88b5
+  data.tar.gz: 44ece71a5cabf78624735e5e0baaf7d085fa3afeeb0002eb8b9faebcea198cea7920aa8d19209ba8c77479d097230abb9652fad10d09d8de82bb51b61599696d

data/.gitignore

@@ -0,0 +1 @@
+pkg/

data/lib/devcenter-parser.rb

@@ -86,7 +86,7 @@ module DevcenterParser
     # custom
     config[:elements] += %w{ toolbelt }
 
-    config[:transformers] = Array(config[:transformers]).push(iframe_sanitizer)
+    config[:transformers] = Array(config[:transformers]).push(sanitize_node_with_invalid_src)
 
     @@sanitize_config = config.merge({remove_contents: true, allow_comments: true})
   end
@@ -112,11 +112,21 @@ module DevcenterParser
     broken_html.nil? ? "Contains broken raw HTML." : "This raw HTML is invalid: #{CGI.unescapeHTML(broken_html)}"
   end
 
-  def self.iframe_sanitizer
+  def self.sanitize_node_with_invalid_src
     lambda do |env|
       return unless env[:node].attributes['src']
+      # disallow javascript in src for all attributes
+      env[:node].unlink if env[:node].attributes['src'].value =~ /\Ajavascript:/i
       # allow iframes if they have src that is from vimeo
-      env[:node].unlink unless env[:node].attributes['src'].value =~ /\Ahttps:\/\/player.vimeo.com\//i
+      env[:node].unlink if iframe?(env[:node]) && iframe_has_invalid_src?(env[:node])
     end
   end
+
+  def self.iframe_has_invalid_src?(node)
+    node.attributes['src'].value !~ /\Ahttps:\/\/player.vimeo.com\//i
+  end
+
+  def self.iframe?(node)
+    node.name == 'iframe'
+  end
 end

data/lib/devcenter-parser/version.rb

@@ -1,3 +1,3 @@
 module DevcenterParser
-  VERSION = '2.2.0'.freeze
+  VERSION = '2.2.1'.freeze
 end

data/test/devcenter-parser_test.rb

@@ -47,6 +47,11 @@ describe 'DevcenterParser' do
       assert_parsing_result src, src
     end
 
+    it 'allows images' do
+      src = '<p><img src="http://nav.heroku.com/images/logos/logo.png" alt="image"></p>'
+      assert_parsing_result src, src
+    end
+
     describe 'github markdown' do
       it 'leaves HTML comments' do
         md = '<!-- c1 -->'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: devcenter-parser
 version: !ruby/object:Gem::Version
-  version: 2.2.0
+  version: 2.2.1
 platform: ruby
 authors:
 - Heroku
@@ -87,6 +87,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".gitignore"
 - Gemfile
 - LICENSE
 - README.md