gollum-lib 5.1.1-java → 5.1.2-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 86522ff24f9e9b09250954b5c3ffd0438e0a36b754c991de5b7d8804d76821b9
-  data.tar.gz: cda628f38b4fdfc54af5abaa10576717c09a439c9b7d634db523e2c11fdd31b2
+  metadata.gz: 91549ba42cbf448b02f7d79cfb4257c02b549fe7ed4c32ce12910009f817bd2c
+  data.tar.gz: 4e9c0079c2298d216cc9c4022bea79ed395f7704b33630bf319299dd14b4a96c
 SHA512:
-  metadata.gz: 220d93def416381e2077d55eb3894fa48722e37344a77b69137e4c7ecb949a632b30b838f43d4c7c97bd33e19339f5b2fa051c61b7320f8b78cfb48b71c7d2b8
-  data.tar.gz: 6ae767089ea2efc4d7de8187ae8020163d5fe5f1dd9777a0b78d9877387fda79b67663e9537649cfb7330ba7e786e2aa4a164083ab98e94640e4b5dad61e123b
+  metadata.gz: eb855c6b2e316a76060460b406aa4118350034fbdbf41d6afe4bdb7a12e25367c9a6d88d64cf0fac03230090868b1063f01b98102a71430c5e2c0cb09a347361
+  data.tar.gz: 4fb53f05829c6e4d4b889bb1d61573b0ec47a1d8119ee3621244386a12d570251184349c38ebc43c8683e02107c62993c89ea0363c94be08d66162c453130e28

data/HISTORY.md

@@ -1,6 +1,10 @@
+# v5.1.2
+
+* SECURITY UPDATE: sanitize HTML generated by Macros.
+
 # v5.0.1
 
-Bugfix release: fix emoji when using base path. Thanks to @heavywatal.
+* Bugfix release: fix emoji when using base path. Thanks to @heavywatal.
 
 # v5.0
 

data/gemspec.rb

@@ -8,7 +8,7 @@ def specification(version, default_adapter, platform = nil)
     s.name              = 'gollum-lib'
     s.version           = version
     s.platform          = platform if platform
-    s.date              = '2021-06-28'
+    s.date              = '2021-07-10'
     s.date              = '2017-04-13'
     s.rubyforge_project = 'gollum-lib'
     s.license           = 'MIT'

data/lib/gollum-lib/filter/macro.rb

@@ -55,6 +55,6 @@ class Gollum::Filter::Macro < Gollum::Filter
       end
     end
 
-    data
+    sanitize(data)
   end
 end

data/lib/gollum-lib/macro/all_pages.rb

@@ -3,7 +3,7 @@ module Gollum
     class AllPages < Gollum::Macro
       def render
         if @wiki.pages.size > 0
-          '<ul id="pages">' + @wiki.pages.map { |p| "<li>#{p.name}</li>" }.join + '</ul>'
+          '<ul id="pages">' + @wiki.pages.map { |p| "<li>#{CGI::escapeHTML(p.name)}</li>" }.join + '</ul>'
         end
       end
     end

data/lib/gollum-lib/macro/audio.rb

@@ -2,7 +2,7 @@ module Gollum
   class Macro
     class Audio < Gollum::Macro
       def render (fname)
-        "<audio width=\"100%\" height=\"100%\" src=\"#{fname}\" controls=\"\"> HTML5 audio is not supported on this Browser.</audio>"
+        "<audio width=\"100%\" height=\"100%\" src=\"#{CGI::escapeHTML(fname)}\" controls=\"\"> HTML5 audio is not supported on this Browser.</audio>"
       end
     end
   end

data/lib/gollum-lib/macro/global_toc.rb

@@ -4,9 +4,9 @@ module Gollum
       def render(title = "Global Table of Contents")
         if @wiki.pages.size > 0
           prepath = @wiki.base_path.sub(/\/$/, '')
-          result  = '<ul>' + @wiki.pages.map { |p| "<li><a href=\"#{prepath}/#{p.escaped_url_path}\">#{p.url_path}</a></li>" }.join + '</ul>'
+          result  = '<ul>' + @wiki.pages.map { |p| "<li><a href=\"#{CGI::escapeHTML(prepath + "/" + p.escaped_url_path)}\">#{CGI::escapeHTML(p.url_path)}</a></li>" }.join + '</ul>'
         end
-        "<div class=\"toc\"><div class=\"toc-title\">#{title}</div>#{result}</div>"
+        "<div class=\"toc\"><div class=\"toc-title\">#{CGI::escapeHTML(title)}</div>#{result}</div>"
       end
     end
   end

data/lib/gollum-lib/macro/navigation.rb

@@ -9,12 +9,12 @@ module Gollum
           list_items = pages.map do |page|
             if toc_root_path == '.' || page.url_path =~ /^#{toc_root_path}\//
               path_display = (full_path || toc_root_path == '.') ? page.url_path  : page.url_path.sub(/^#{toc_root_path}\//,"").sub(/^\//,'')
-              "<li><a href=\"#{prepath}/#{page.escaped_url_path}\">#{path_display}</a></li>"
+              "<li><a href=\"#{CGI::escapeHTML(prepath + "/" + page.escaped_url_path)}\">#{CGI::escapeHTML(path_display)}</a></li>"
             end
           end
           result = "<ul>#{list_items.join}</ul>"
         end
-        "<div class=\"toc\"><div class=\"toc-title\">#{title}</div>#{result}</div>"
+        "<div class=\"toc\"><div class=\"toc-title\">#{CGI::escapeHTML(title)}</div>#{result}</div>"
       end
 
     end

data/lib/gollum-lib/macro/note.rb

@@ -12,7 +12,7 @@ module Gollum
           icon.options[:class] << ' mr-2'
           icon = icon.to_svg
         end
-        "<div class='flash'>#{icon}#{notice}</div>"
+        "<div class='flash'>#{icon}#{CGI::escapeHTML(notice)}</div>"
       end
     end
   end

data/lib/gollum-lib/macro/series.rb

@@ -8,8 +8,8 @@ module Gollum
       end
 
       def render_links(previous_page, next_page)
-      	result = "Previous: <a href=\"#{::File.join(@wiki.base_path,previous_page.escaped_url_path)}\">#{previous_page.name}</a>" if previous_page
-      	result = "#{result}#{result ? ' | ' : ''}Next: <a href=\"#{::File.join(@wiki.base_path,next_page.escaped_url_path)}\">#{next_page.name}</a>" if next_page
+      	result = "Previous: <a href=\"#{CGI::escapeHTML(::File.join(@wiki.base_path,previous_page.escaped_url_path))}\">#{CGI::escapeHTML(previous_page.name)}</a>" if previous_page
+      	result = "#{result}#{result ? ' | ' : ''}Next: <a href=\"#{CGI::escapeHTML(::File.join(@wiki.base_path,next_page.escaped_url_path))}\">#{CGI::escapeHTML(next_page.name)}</a>" if next_page
       	wrap_result(result)
       end
 
@@ -32,14 +32,14 @@ module Gollum
 
     class SeriesStart < Gollum::Macro::Series
       def render_links(previous_page, next_page)
-        result = "Next: <a href=\"#{::File.join(@wiki.base_path,next_page.escaped_url_path)}\">#{next_page.name}</a>" if next_page
+        result = "Next: <a href=\"#{CGI::escapeHTML(::File.join(@wiki.base_path,next_page.escaped_url_path))}\">#{CGI::escapeHTML(next_page.name)}</a>" if next_page
         wrap_result(result)
       end
     end
 
     class SeriesEnd < Gollum::Macro::Series
       def render_links(previous_page, next_page)
-        result = "Previous: <a href=\"#{::File.join(@wiki.base_path,previous_page.escaped_url_path)}\">#{previous_page.name}</a>" if previous_page
+        result = "Previous: <a href=\"#{CGI::escapeHTML(::File.join(@wiki.base_path,previous_page.escaped_url_path))}\">#{CGI::escapeHTML(previous_page.name)}</a>" if previous_page
         wrap_result(result)
       end
     end

data/lib/gollum-lib/macro/video.rb

@@ -2,7 +2,7 @@ module Gollum
   class Macro
     class Video < Gollum::Macro
       def render (fname)
-        "<video width=\"100%\" height=\"100%\" src=\"#{fname}\" controls=\"\"> HTML5 video is not supported on this Browser.</video>"
+        "<video width=\"100%\" height=\"100%\" src=\"#{CGI::escapeHTML(fname)}\" controls=\"\"> HTML5 video is not supported on this Browser.</video>"
       end
     end
   end

data/lib/gollum-lib/macro/warn.rb

@@ -4,7 +4,7 @@ module Gollum
       def render(warning)
         icon = Octicons::Octicon.new('alert', {width: 24, height: 24})
         icon.options[:class] << ' mr-2'
-        "<div class='flash flash-warn'>#{icon.to_svg}#{warning}</div>"
+        "<div class='flash flash-warn'>#{icon.to_svg}#{CGI::escapeHTML(warning)}</div>"
       end
     end
   end

data/lib/gollum-lib/version.rb

@@ -1,5 +1,5 @@
 module Gollum
   module Lib
-    VERSION = '5.1.1'
+    VERSION = '5.1.2'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gollum-lib
 version: !ruby/object:Gem::Version
-  version: 5.1.1
+  version: 5.1.2
 platform: java
 authors:
 - Tom Preston-Werner