gollum-lib 5.2.2-java → 5.2.4-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b143e2df33dc9dc9b02d92e03157ffb7e95a04e2ee642e4fc96d504252fc8666
-  data.tar.gz: 8f7f128aeeb398dc199130c2f0dad1e5006d9fedf59c772225a41f1287c65552
+  metadata.gz: 48b93e28c86be16f0f22a60841419bf01cca94c4bb965063aa0c60af3fe34d68
+  data.tar.gz: cc9aac74db4af15d4943663ec1b3ab02dd451c77a728db20dcd87b4580736d39
 SHA512:
-  metadata.gz: cf52a1dcfc52a2fc8aaf20b3234920e017decc049a5ca1af3a3990771191a4389655d8ac3e0a3e424f8a6a427b214a527cffba399eb479b6a2633e7fe81488d3
-  data.tar.gz: 4c34de87bd2b06d653c0e2dfea5bd013602c2c6b24e95611eff479e848ba389ef501c9bd44e860ea7b1c06cd262dbe974e132f85b86e742eb23e1d316d5433df
+  metadata.gz: b186da0a8c8af4e1b0306025f2634b3d07437b36a4e2afa0db5f5bed4f2a4f76eb6dc8af91de8e4790a3e0d18602426834d3226d87e5cf911c4cef940f06a924
+  data.tar.gz: '029d5f5f42f759e8827871cc80ccb4d3308f794dd3d7bffe5c0c7286d1acd3fc40f6c644c57ca975c49c63d7085bfb14a5bef0887599db5bafc78978434ea622'

data/HISTORY.md

@@ -1,3 +1,14 @@
+# 5.2.3 / 2023-03-13
+
+* Bugfix release: update adapter dependencies for Ruby 3.2 support.
+
+
+
+# 5.2.2 / 2023-01-18
+
+* Bugfix release: set Nokogiri default XHTML conversion options more relaibly. See https://github.com/sparklemotion/nokogiri/issues/2761
+
+
 # 5.2.1 / 2022-09-13
 
 * Fixed: 'controls' attribute in audio and video tags should not be sanitized. #430 (@dometto)

data/LATEST_CHANGES.md

@@ -0,0 +1,3 @@
+# 5.2.4 / 2023-03-22
+
+* Bugfix release: address XSS vulnerability ( @6661620a, @dometto)

data/README.md

@@ -3,7 +3,7 @@ gollum lib -- A wiki built on top of Git
 
 [![Gem Version](https://badge.fury.io/rb/gollum-lib.svg)](http://badge.fury.io/rb/gollum-lib)
 [![Ruby Build](https://github.com/gollum/gollum-lib/actions/workflows/test.yaml/badge.svg)](https://github.com/gollum/gollum-lib/actions/workflows/test.yaml)
-[![Cutting Edge Dependency Status](https://dometto-cuttingedge.herokuapp.com/github/gollum/gollum-lib/svg 'Cutting Edge Dependency Status')](https://dometto-cuttingedge.herokuapp.com/github/gollum/gollum-lib/info)
+[![Cutting Edge Dependency Status](https://cuttingedge.onrender.com/github/gollum/gollum-lib/svg 'Cutting Edge Dependency Status')](https://cuttingedge.onrender.com/github/gollum/gollum-lib/info)
 
 ## DESCRIPTION
 

data/Rakefile

@@ -126,7 +126,7 @@ task :release => :build do
   Rake::Task[:changelog].execute
   sh "git commit --allow-empty -a -m 'Release #{version}'"
   sh "git pull --rebase origin master"
-  sh "git tag -n v#{version}"
+  sh "git tag v#{version} -m 'Release v#{version}'"
   sh "git push origin master"
   sh "git push origin v#{version}"
   sh "gem push pkg/#{name}-#{version}.gem"
@@ -189,7 +189,7 @@ end
 desc 'Build changlog'
 task :changelog do
   [latest_changes_file, history_file].each do |f|
-    unless File.exists?(f)
+    unless File.exist?(f)
       puts "#{f} does not exist but is required to build a new release."
       exit!
     end

data/gemspec.rb

@@ -56,6 +56,7 @@ def specification(version, default_adapter, platform = nil)
     Gemfile
     Guardfile
     HISTORY.md
+    LATEST_CHANGES.md
     LICENSE
     README.md
     Rakefile

data/gollum-lib.gemspec

@@ -3,8 +3,8 @@ require File.join(File.dirname(__FILE__), 'lib', 'gollum-lib', 'version.rb')
 # This file needs to conditionally define the default adapter for MRI and Java, because this is the file that is included from the Gemfile.
 # In addition, the default Java adapter needs to be defined in gollum-lib_java.gemspec beause that file is used to *build* the Java gem.
 if RUBY_PLATFORM == 'java' then
-  default_adapter = ['gollum-rjgit_adapter', '~> 0.6']
+  default_adapter = ['gollum-rjgit_adapter', '~> 1.0']
 else
-  default_adapter = ['gollum-rugged_adapter', '~> 1.0']
+  default_adapter = ['gollum-rugged_adapter', '~> 2.0']
 end
 Gem::Specification.new &specification(Gollum::Lib::VERSION, default_adapter)

data/lib/gollum-lib/filter/toc.rb

@@ -157,7 +157,7 @@ class Gollum::Filter::TOC < Gollum::Filter
     end
 
     # % -> %25 so anchors work on Firefox. See issue #475
-    @tail.add_child(%Q{<a href="##{name}">#{header.content}</a>})
+    @tail.add_child(%Q{<a href="##{name}">#{CGI.escapeHTML(header.content)}</a>})
   end
 
   # Increments the number of anchors with the given name

data/lib/gollum-lib/macro/video.rb

@@ -1,8 +1,10 @@
 module Gollum
   class Macro
     class Video < Gollum::Macro
-      def render (fname)
-        "<video width=\"100%\" height=\"100%\" src=\"#{CGI::escapeHTML(fname)}\" controls=\"true\"> HTML5 video is not supported on this Browser.</video>"
+      def render(fname, auto=false)
+        escaped_fname = CGI.escapeHTML(fname)
+        properties = auto ? "autoplay='true' playsinline='true' muted='true' loop='true'" : "controls='true'"
+        "<video width='100%' height='100%' src='#{escaped_fname}' #{properties}>HTML5 video is not supported on this browser.</video>"
       end
     end
   end

data/lib/gollum-lib/sanitization.rb

@@ -1,5 +1,5 @@
 ::Loofah::HTML5::SafeList::ACCEPTABLE_PROTOCOLS.add('apt')
-::Loofah::HTML5::SafeList::ALLOWED_ATTRIBUTES.add('controls')
+::Loofah::HTML5::SafeList::ALLOWED_ATTRIBUTES.merge(%w[controls loop muted playsinline autoplay])
 
 module Gollum
   class Sanitization

data/lib/gollum-lib/version.rb

@@ -1,5 +1,5 @@
 module Gollum
   module Lib
-    VERSION = '5.2.2'
+    VERSION = '5.2.4'
   end
 end

data/lib/gollum-lib/wiki.rb

@@ -152,7 +152,7 @@ module Gollum
       @per_page_uploads     = options.fetch :per_page_uploads, false
       @metadata             = options.fetch :metadata, {}
       @filter_chain         = options.fetch :filter_chain,
-                                            [:YAML, :BibTeX, :PlainText, :CriticMarkup, :TOC, :RemoteCode, :Code, :Macro, :Emoji, :Sanitize, :PlantUML, :Tags, :PandocBib, :Render]
+                                            [:YAML, :BibTeX, :PlainText, :CriticMarkup, :TOC, :Sanitize, :RemoteCode, :Code, :Macro, :Emoji, :PlantUML, :Tags, :PandocBib, :Render]
       @filter_chain.delete(:Emoji) unless options.fetch :emoji, false
       @filter_chain.delete(:PandocBib) unless ::Gollum::MarkupRegisterUtils.using_pandoc?
       @filter_chain.delete(:CriticMarkup) unless options.fetch :critic_markup, false

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gollum-lib
 version: !ruby/object:Gem::Version
-  version: 5.2.2
+  version: 5.2.4
 platform: java
 authors:
 - Tom Preston-Werner
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-01-18 00:00:00.000000000 Z
+date: 2023-03-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: gollum-rjgit_adapter
@@ -400,6 +400,7 @@ files:
 - Gemfile
 - Guardfile
 - HISTORY.md
+- LATEST_CHANGES.md
 - LICENSE
 - README.md
 - Rakefile
@@ -469,7 +470,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.32
+rubygems_version: 3.2.3
 signing_key:
 specification_version: 4
 summary: A simple, Git-powered wiki.