gollum-lib 5.2.2 → 5.2.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 39710261c63c5c6a12402b640c5fb71a5c302c18f39df575e2127b5eebb67be3
-  data.tar.gz: 8f7f128aeeb398dc199130c2f0dad1e5006d9fedf59c772225a41f1287c65552
+  metadata.gz: 89665fc53e8dac8e1787645fde43c827410639049a789503b7e2859ce5fadb5f
+  data.tar.gz: cc9aac74db4af15d4943663ec1b3ab02dd451c77a728db20dcd87b4580736d39
 SHA512:
-  metadata.gz: 3618878e7eabe6955e9fa83e968dac8087b9990ba5566f263c4d89dbd2d0b44689fe8abc145aa6286c654e531d6df2ee6b6d984f3c738663bb58ab19e75a3047
-  data.tar.gz: 4c34de87bd2b06d653c0e2dfea5bd013602c2c6b24e95611eff479e848ba389ef501c9bd44e860ea7b1c06cd262dbe974e132f85b86e742eb23e1d316d5433df
+  metadata.gz: 4a19c6ecd939a79ec62de95e06508e97ef962abdcf945a73da5b5aeed97149cee79b6fce2532aa8ca21e701f9b4251746aa69b2456a5f5276e40b0541814bd22
+  data.tar.gz: '029d5f5f42f759e8827871cc80ccb4d3308f794dd3d7bffe5c0c7286d1acd3fc40f6c644c57ca975c49c63d7085bfb14a5bef0887599db5bafc78978434ea622'

data/HISTORY.md

@@ -1,3 +1,14 @@
+# 5.2.3 / 2023-03-13
+
+* Bugfix release: update adapter dependencies for Ruby 3.2 support.
+
+
+
+# 5.2.2 / 2023-01-18
+
+* Bugfix release: set Nokogiri default XHTML conversion options more relaibly. See https://github.com/sparklemotion/nokogiri/issues/2761
+
+
 # 5.2.1 / 2022-09-13
 
 * Fixed: 'controls' attribute in audio and video tags should not be sanitized. #430 (@dometto)

data/LATEST_CHANGES.md

@@ -0,0 +1,3 @@
+# 5.2.4 / 2023-03-22
+
+* Bugfix release: address XSS vulnerability ( @6661620a, @dometto)

data/README.md

@@ -3,7 +3,7 @@ gollum lib -- A wiki built on top of Git
 
 [![Gem Version](https://badge.fury.io/rb/gollum-lib.svg)](http://badge.fury.io/rb/gollum-lib)
 [![Ruby Build](https://github.com/gollum/gollum-lib/actions/workflows/test.yaml/badge.svg)](https://github.com/gollum/gollum-lib/actions/workflows/test.yaml)
-[![Cutting Edge Dependency Status](https://dometto-cuttingedge.herokuapp.com/github/gollum/gollum-lib/svg 'Cutting Edge Dependency Status')](https://dometto-cuttingedge.herokuapp.com/github/gollum/gollum-lib/info)
+[![Cutting Edge Dependency Status](https://cuttingedge.onrender.com/github/gollum/gollum-lib/svg 'Cutting Edge Dependency Status')](https://cuttingedge.onrender.com/github/gollum/gollum-lib/info)
 
 ## DESCRIPTION
 

data/Rakefile

@@ -126,7 +126,7 @@ task :release => :build do
   Rake::Task[:changelog].execute
   sh "git commit --allow-empty -a -m 'Release #{version}'"
   sh "git pull --rebase origin master"
-  sh "git tag -n v#{version}"
+  sh "git tag v#{version} -m 'Release v#{version}'"
   sh "git push origin master"
   sh "git push origin v#{version}"
   sh "gem push pkg/#{name}-#{version}.gem"
@@ -189,7 +189,7 @@ end
 desc 'Build changlog'
 task :changelog do
   [latest_changes_file, history_file].each do |f|
-    unless File.exists?(f)
+    unless File.exist?(f)
       puts "#{f} does not exist but is required to build a new release."
       exit!
     end

data/gemspec.rb

@@ -56,6 +56,7 @@ def specification(version, default_adapter, platform = nil)
     Gemfile
     Guardfile
     HISTORY.md
+    LATEST_CHANGES.md
     LICENSE
     README.md
     Rakefile

data/gollum-lib.gemspec

@@ -3,8 +3,8 @@ require File.join(File.dirname(__FILE__), 'lib', 'gollum-lib', 'version.rb')
 # This file needs to conditionally define the default adapter for MRI and Java, because this is the file that is included from the Gemfile.
 # In addition, the default Java adapter needs to be defined in gollum-lib_java.gemspec beause that file is used to *build* the Java gem.
 if RUBY_PLATFORM == 'java' then
-  default_adapter = ['gollum-rjgit_adapter', '~> 0.6']
+  default_adapter = ['gollum-rjgit_adapter', '~> 1.0']
 else
-  default_adapter = ['gollum-rugged_adapter', '~> 1.0']
+  default_adapter = ['gollum-rugged_adapter', '~> 2.0']
 end
 Gem::Specification.new &specification(Gollum::Lib::VERSION, default_adapter)

data/lib/gollum-lib/filter/toc.rb

@@ -157,7 +157,7 @@ class Gollum::Filter::TOC < Gollum::Filter
     end
 
     # % -> %25 so anchors work on Firefox. See issue #475
-    @tail.add_child(%Q{<a href="##{name}">#{header.content}</a>})
+    @tail.add_child(%Q{<a href="##{name}">#{CGI.escapeHTML(header.content)}</a>})
   end
 
   # Increments the number of anchors with the given name

data/lib/gollum-lib/macro/video.rb

@@ -1,8 +1,10 @@
 module Gollum
   class Macro
     class Video < Gollum::Macro
-      def render (fname)
-        "<video width=\"100%\" height=\"100%\" src=\"#{CGI::escapeHTML(fname)}\" controls=\"true\"> HTML5 video is not supported on this Browser.</video>"
+      def render(fname, auto=false)
+        escaped_fname = CGI.escapeHTML(fname)
+        properties = auto ? "autoplay='true' playsinline='true' muted='true' loop='true'" : "controls='true'"
+        "<video width='100%' height='100%' src='#{escaped_fname}' #{properties}>HTML5 video is not supported on this browser.</video>"
       end
     end
   end

data/lib/gollum-lib/sanitization.rb

@@ -1,5 +1,5 @@
 ::Loofah::HTML5::SafeList::ACCEPTABLE_PROTOCOLS.add('apt')
-::Loofah::HTML5::SafeList::ALLOWED_ATTRIBUTES.add('controls')
+::Loofah::HTML5::SafeList::ALLOWED_ATTRIBUTES.merge(%w[controls loop muted playsinline autoplay])
 
 module Gollum
   class Sanitization

data/lib/gollum-lib/version.rb

@@ -1,5 +1,5 @@
 module Gollum
   module Lib
-    VERSION = '5.2.2'
+    VERSION = '5.2.4'
   end
 end

data/lib/gollum-lib/wiki.rb

@@ -152,7 +152,7 @@ module Gollum
       @per_page_uploads     = options.fetch :per_page_uploads, false
       @metadata             = options.fetch :metadata, {}
       @filter_chain         = options.fetch :filter_chain,
-                                            [:YAML, :BibTeX, :PlainText, :CriticMarkup, :TOC, :RemoteCode, :Code, :Macro, :Emoji, :Sanitize, :PlantUML, :Tags, :PandocBib, :Render]
+                                            [:YAML, :BibTeX, :PlainText, :CriticMarkup, :TOC, :Sanitize, :RemoteCode, :Code, :Macro, :Emoji, :PlantUML, :Tags, :PandocBib, :Render]
       @filter_chain.delete(:Emoji) unless options.fetch :emoji, false
       @filter_chain.delete(:PandocBib) unless ::Gollum::MarkupRegisterUtils.using_pandoc?
       @filter_chain.delete(:CriticMarkup) unless options.fetch :critic_markup, false

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gollum-lib
 version: !ruby/object:Gem::Version
-  version: 5.2.2
+  version: 5.2.4
 platform: ruby
 authors:
 - Tom Preston-Werner
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-01-18 00:00:00.000000000 Z
+date: 2023-03-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: gollum-rugged_adapter
@@ -17,14 +17,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '2.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: rouge
   requirement: !ruby/object:Gem::Requirement
@@ -400,6 +400,7 @@ files:
 - Gemfile
 - Guardfile
 - HISTORY.md
+- LATEST_CHANGES.md
 - LICENSE
 - README.md
 - Rakefile
@@ -469,7 +470,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.32
+rubygems_version: 3.2.3
 signing_key:
 specification_version: 4
 summary: A simple, Git-powered wiki.