github-markup 1.0.1 → 1.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: c4c0ef742a30505af2fe74fdd3840e142e661d0f
-  data.tar.gz: 6dfd99c01002dd9f2fd979b941489ad5075cbba6
+  metadata.gz: d35584dcddd6c4d30a24ef157cb42369161b24af
+  data.tar.gz: 2b71a47126ef2dcbfdcf2779c4b892eabc22db53
 SHA512:
-  metadata.gz: 259e3c497d07b68b63cb4a3841a04079e2ee319d6bfa434f1384a617c912d66ef81803c61255953c4071af17b9d659db80c2cb1df70e394f0dd7e0cf5364f900
-  data.tar.gz: bda40a4f1d7116fefa6b644422bcd3fc5a5c7b6bca19e80df245f9e308d88f54643112080efc8d71f08303d08d7474f8c6723c204d97275075ca0ab20a901009
+  metadata.gz: ecb7a19c1bc478049846d7a7ca53f2d0c3a021f5e99a861de190ff5398e0fe66017bd721818ba70848d039eab2b09bef97dd3d61f9c1048f5fab662c02b6130d
+  data.tar.gz: 5904bb20ed5edf8a027f79468e42719c7220a37846f9fe8d22697535ec272c14c91f4f6474dd45441ad81cdc538d55f074a2b5b05ae5e470a17ac7c7fec2ea05

data/README.md

@@ -21,6 +21,30 @@ you wish to run the library. You can also run `script/bootstrap` to fetch them a
 * [.pod](http://search.cpan.org/dist/perl/pod/perlpod.pod) -- `Pod::Simple::HTML`
   comes with Perl >= 5.10. Lower versions should install Pod::Simple from CPAN.
 
+HTML sanitization
+-----------------
+
+HTML rendered by the various markup language processors gets passed through an [HTML sanitization filter](https://github.com/jch/html-pipeline/blob/master/lib/html/pipeline/sanitization_filter.rb) for security reasons. HTML elements not in the whitelist are removed. HTML attributes not in the whitelist are removed from the preserved elements.
+
+The following HTML elements, organized by category, are whitelisted:
+
+* Headings: h1, h2, h3, h4, h5, h6, h7, h8
+* Prose: p, div, blockquote
+* Preformatted: pre
+* Inline: b, i, strong, em, tt, code, ins, del, sup, sub, kbd, samp, q, var
+* Lists: ol, ul, li, dl, dt, dd
+* Tables: table, thead, tbody, tfoot, tr, td, th
+* Breaks: br, hr
+* Ruby (East Asian): ruby, rt, rp
+
+The following attributes, organized by element, are whitelisted:
+
+* a: href (http://, https://, mailto://, github-windows:// and github-mac:// URI schemes and relative paths only)
+* img: src (http:// and https::// URI schemes and relative paths only)
+* div: itemscope, itemtype
+* all: abbr, accept, accept-charset, accesskey, action, align, alt, axis, border, cellpadding, cellspacing, char, charoff, charset, checked, cite, clear, cols, colspan, color, compact, coords, datetime, dir, disabled, enctype, for, frame, headers, height, hreflang, hspace, ismap, label, lang, longdesc, maxlength, media, method, multiple, name, nohref, noshade, nowrap, prompt, readonly, rel, rev, rows, rowspan, rules, scope, selected, shape, size, span, start, summary, tabindex, target, title, type, usemap, valign, value, vspace, width, itemprop
+
+Note that the id attribute is *not* whitelisted.
 
 Contributing
 ------------

data/github-markup.gemspec

@@ -16,7 +16,7 @@ Gem::Specification.new do |s|
   ## the sub! line in the Rakefile
   s.name              = 'github-markup'
   s.version           = GitHub::Markup::VERSION
-  s.date              = '2014-01-28'
+  s.date              = '2014-02-14'
   s.executables       = ['github-markup']
 
   ## Make sure your summary is short. The description may be as long

data/lib/github-markup.rb

@@ -1,6 +1,6 @@
 module GitHub
   module Markup
-    VERSION = '1.0.1'
+    VERSION = '1.0.2'
     Version = VERSION
   end
 end

data/lib/github/commands/rest2html

@@ -8,6 +8,7 @@ Brandon Keepers <bkeepers@github.com>
 Bryan Veloso <bryan@revyver.com>
 Chris Wanstrath <chris@ozmm.org>
 Dave Abrahams <dave@boostpro.com>
+Garen Torikian <garen@github.com>
 Gasper Zejn <zejn@kiberpipa.org>
 Michael Jones <m.pricejones@gmail.com>
 Sam Whited <sam@samwhited.com>
@@ -50,6 +51,21 @@ SETTINGS = {
 }
 
 class GitHubHTMLTranslator(HTMLTranslator):
+    # removes the <div class="document"> tag wrapped around docs
+    # see also: http://bit.ly/1exfq2h (warning! sourceforge link.)
+    def depart_document(self, node):
+        HTMLTranslator.depart_document(self, node)
+        self.html_body.pop(0)
+        self.html_body.pop()
+
+    # technique for visiting sections, without generating additional divs
+    # see also: http://bit.ly/NHtyRx
+    def visit_section(self, node):
+        self.section_level += 1
+
+    def depart_section(self, node):
+        self.section_level -= 1
+
     def visit_literal_block(self, node):
         classes = node.attributes['classes']
         if len(classes) >= 2 and classes[0] == 'code':

data/test/markups/README.rst.html

@@ -1,8 +1,5 @@
-<div class="document">
-<div class="section" id="header-1">
 <h1>Header 1</h1>
 <p>Example text.</p>
-<div class="section" id="header-2">
 <h2>Header 2</h2>
 <ol class="arabic simple">
 <li>Blah blah <tt class="docutils literal">code</tt> blah</li>
@@ -32,6 +29,3 @@
 </tr>
 </tbody>
 </table>
-</div>
-</div>
-</div>

data/test/markups/README.rst.txt.html

@@ -1,14 +1,7 @@
-<div class="document">
-<div class="section" id="header-1">
 <h1>Header 1</h1>
 <p>Example text.</p>
-<div class="section" id="header-2">
 <h2>Header 2</h2>
 <ol class="arabic simple">
 <li>Blah blah <tt class="docutils literal">code</tt> blah</li>
 <li>More <tt class="docutils literal">code</tt>, hooray</li>
 </ol>
-</div>
-</div>
-</div>
-

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: github-markup
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.0.2
 platform: ruby
 authors:
 - Chris Wanstrath
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-01-28 00:00:00.000000000 Z
+date: 2014-02-14 00:00:00.000000000 Z
 dependencies: []
 description: |2
     This gem is used by GitHub to render any fancy markup such as
@@ -73,22 +73,22 @@ licenses: []
 metadata: {}
 post_install_message: 
 rdoc_options:
-- --charset=UTF-8
+- "--charset=UTF-8"
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.0.3
+rubygems_version: 2.2.0
 signing_key: 
 specification_version: 2
 summary: The code GitHub uses to render README.markup