gollum-lib 5.2.3-java → 5.2.4-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2cd6be4129fb109662b857e85f0b0a3a9729f78a79e3374315f3404ef7fe5ba0
-  data.tar.gz: 284c5b50a77ae36787c90cf73bf212ff4e3dcea2dd4fa2a0fd91299eae751249
+  metadata.gz: 48b93e28c86be16f0f22a60841419bf01cca94c4bb965063aa0c60af3fe34d68
+  data.tar.gz: cc9aac74db4af15d4943663ec1b3ab02dd451c77a728db20dcd87b4580736d39
 SHA512:
-  metadata.gz: e4e93ac2deb03a47831678420ba464eca8934ddf01de8db243d5ec9eb6594b1ca16e97d4bb6175f7329fc4329f0276d3eff367bd402ed4772bcdbc82b19e4da2
-  data.tar.gz: f49373c97c8201aec93ebff699e6e5706d203cdda3ba2a5f860a547ad930a3d0672981dace71ccbb25e81e9717ad2b0b858dbf8bf32838983981aa91c270795d
+  metadata.gz: b186da0a8c8af4e1b0306025f2634b3d07437b36a4e2afa0db5f5bed4f2a4f76eb6dc8af91de8e4790a3e0d18602426834d3226d87e5cf911c4cef940f06a924
+  data.tar.gz: '029d5f5f42f759e8827871cc80ccb4d3308f794dd3d7bffe5c0c7286d1acd3fc40f6c644c57ca975c49c63d7085bfb14a5bef0887599db5bafc78978434ea622'

data/HISTORY.md

@@ -1,3 +1,9 @@
+# 5.2.3 / 2023-03-13
+
+* Bugfix release: update adapter dependencies for Ruby 3.2 support.
+
+
+
 # 5.2.2 / 2023-01-18
 
 * Bugfix release: set Nokogiri default XHTML conversion options more relaibly. See https://github.com/sparklemotion/nokogiri/issues/2761

data/LATEST_CHANGES.md

@@ -1,4 +1,3 @@
-# 5.2.3 / 2023-03-13
-
-* Bugfix release: update adapter dependencies for Ruby 3.2 support.
+# 5.2.4 / 2023-03-22
 
+* Bugfix release: address XSS vulnerability ( @6661620a, @dometto)

data/lib/gollum-lib/filter/toc.rb

@@ -157,7 +157,7 @@ class Gollum::Filter::TOC < Gollum::Filter
     end
 
     # % -> %25 so anchors work on Firefox. See issue #475
-    @tail.add_child(%Q{<a href="##{name}">#{header.content}</a>})
+    @tail.add_child(%Q{<a href="##{name}">#{CGI.escapeHTML(header.content)}</a>})
   end
 
   # Increments the number of anchors with the given name

data/lib/gollum-lib/macro/video.rb

@@ -1,8 +1,10 @@
 module Gollum
   class Macro
     class Video < Gollum::Macro
-      def render (fname)
-        "<video width=\"100%\" height=\"100%\" src=\"#{CGI::escapeHTML(fname)}\" controls=\"true\"> HTML5 video is not supported on this Browser.</video>"
+      def render(fname, auto=false)
+        escaped_fname = CGI.escapeHTML(fname)
+        properties = auto ? "autoplay='true' playsinline='true' muted='true' loop='true'" : "controls='true'"
+        "<video width='100%' height='100%' src='#{escaped_fname}' #{properties}>HTML5 video is not supported on this browser.</video>"
       end
     end
   end

data/lib/gollum-lib/sanitization.rb

@@ -1,5 +1,5 @@
 ::Loofah::HTML5::SafeList::ACCEPTABLE_PROTOCOLS.add('apt')
-::Loofah::HTML5::SafeList::ALLOWED_ATTRIBUTES.add('controls')
+::Loofah::HTML5::SafeList::ALLOWED_ATTRIBUTES.merge(%w[controls loop muted playsinline autoplay])
 
 module Gollum
   class Sanitization

data/lib/gollum-lib/version.rb

@@ -1,5 +1,5 @@
 module Gollum
   module Lib
-    VERSION = '5.2.3'
+    VERSION = '5.2.4'
   end
 end

data/lib/gollum-lib/wiki.rb

@@ -152,7 +152,7 @@ module Gollum
       @per_page_uploads     = options.fetch :per_page_uploads, false
       @metadata             = options.fetch :metadata, {}
       @filter_chain         = options.fetch :filter_chain,
-                                            [:YAML, :BibTeX, :PlainText, :CriticMarkup, :TOC, :RemoteCode, :Code, :Macro, :Emoji, :Sanitize, :PlantUML, :Tags, :PandocBib, :Render]
+                                            [:YAML, :BibTeX, :PlainText, :CriticMarkup, :TOC, :Sanitize, :RemoteCode, :Code, :Macro, :Emoji, :PlantUML, :Tags, :PandocBib, :Render]
       @filter_chain.delete(:Emoji) unless options.fetch :emoji, false
       @filter_chain.delete(:PandocBib) unless ::Gollum::MarkupRegisterUtils.using_pandoc?
       @filter_chain.delete(:CriticMarkup) unless options.fetch :critic_markup, false

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gollum-lib
 version: !ruby/object:Gem::Version
-  version: 5.2.3
+  version: 5.2.4
 platform: java
 authors:
 - Tom Preston-Werner
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-03-13 00:00:00.000000000 Z
+date: 2023-03-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: gollum-rjgit_adapter
@@ -470,7 +470,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.6
+rubygems_version: 3.2.3
 signing_key:
 specification_version: 4
 summary: A simple, Git-powered wiki.