govspeak 6.5.11 → 6.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a45a14e5a726d918753171dc957cc1ed29e50d4505685ff19271da6cad41945d
-  data.tar.gz: 27d874bc05f80a2c37edae5010a326b426cbcf1663d5bfcc1bedc9d6852e1e02
+  metadata.gz: 6369a640dd1ca0303f548954b3cd69f176707200d83d460408eadbb7c7b35158
+  data.tar.gz: fb487bd7275c39da3b3ff34fb4bbb016c77e4666a778c42dd8098c0ef50b3ea5
 SHA512:
-  metadata.gz: 5a01955112fab442c130f71c93e4c2a743c1c9d7a16797d5a2ef406bc7ad591f8380b90f03574d373cf8a519d40e4828b880a9a45d1e36b8c5128f423ac1e20f
-  data.tar.gz: 7ae23223d912b5753eefc4568190fd74e36968a6697e6ef5eeefeff65d88d63f0ec763122b716a4a6179b1c188121c349bb8f9fb6c74ccd346906084cdf7e184
+  metadata.gz: 85fe44ebb3c921918bb22148c4d53394d3e5921b1c5b778815bb09120832e7820805555aa68756799a257a05c4fb5efdeb5df53a453009b2333db528fafa5f29
+  data.tar.gz: 82dc434b862384862420ea07e45d00e2020b5ea20fd7a52ee5196bb5a6786d4c3facd15e64917c0bfd700ac0a1c3aaaa7e761c6970640c60b118f40ca5a1f0e8

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 6.6.0
+
+* Allow passed elements to be relaxed from sanitization [#203](https://github.com/alphagov/govspeak/pull/203)
+
 ## 6.5.11
 
 * Fix issue rendering $CTA blocks before $C (PR#202)

data/lib/govspeak.rb

@@ -53,6 +53,7 @@ module Govspeak
       @source = source ? source.dup : ""
 
       @images = options.delete(:images) || []
+      @allowed_elements = options.delete(:allowed_elements) || []
       @attachments = Array.wrap(options.delete(:attachments))
       @links = Array.wrap(options.delete(:links))
       @contacts = Array.wrap(options.delete(:contacts))
@@ -66,7 +67,7 @@ module Govspeak
     def to_html
       @to_html ||= begin
                      html = if @options[:sanitize]
-                              HtmlSanitizer.new(kramdown_doc.to_html).sanitize
+                              HtmlSanitizer.new(kramdown_doc.to_html).sanitize(allowed_elements: @allowed_elements)
                             else
                               kramdown_doc.to_html
                             end

data/lib/govspeak/html_sanitizer.rb

@@ -40,18 +40,19 @@ class Govspeak::HtmlSanitizer
     @allowed_image_hosts = options[:allowed_image_hosts]
   end
 
-  def sanitize
+  def sanitize(allowed_elements: [])
     transformers = [TableCellTextAlignWhitelister.new]
     if @allowed_image_hosts && @allowed_image_hosts.any?
       transformers << ImageSourceWhitelister.new(@allowed_image_hosts)
     end
-    Sanitize.clean(@dirty_html, Sanitize::Config.merge(sanitize_config, transformers: transformers))
+
+    Sanitize.clean(@dirty_html, Sanitize::Config.merge(sanitize_config(allowed_elements: allowed_elements), transformers: transformers))
   end
 
-  def sanitize_config
+  def sanitize_config(allowed_elements: [])
     Sanitize::Config.merge(
       Sanitize::Config::RELAXED,
-      elements: Sanitize::Config::RELAXED[:elements] + %w[govspeak-embed-attachment govspeak-embed-attachment-link svg path],
+      elements: Sanitize::Config::RELAXED[:elements] + %w[govspeak-embed-attachment govspeak-embed-attachment-link svg path].concat(allowed_elements),
       attributes: {
         :all => Sanitize::Config::RELAXED[:attributes][:all] + %w[role aria-label],
         "a" => Sanitize::Config::RELAXED[:attributes]["a"] + [:data],

data/lib/govspeak/version.rb

@@ -1,3 +1,3 @@
 module Govspeak
-  VERSION = "6.5.11".freeze
+  VERSION = "6.6.0".freeze
 end

data/test/govspeak_test.rb

@@ -666,6 +666,11 @@ Teston
     assert_equal "<script>doGoodThings();</script>", document.to_html.strip
   end
 
+  test "it can exclude stipulated elements from sanitization" do
+    document = Govspeak::Document.new("<uncommon-element>some content</uncommon-element>", allowed_elements: %w[uncommon-element])
+    assert_equal "<uncommon-element>some content</uncommon-element>", document.to_html.strip
+  end
+
   test "identifies a Govspeak document containing malicious HTML as invalid" do
     document = Govspeak::Document.new("<script>doBadThings();</script>")
     refute document.valid?

data/test/html_sanitizer_test.rb

@@ -96,4 +96,10 @@ class HtmlSanitizerTest < Minitest::Test
       assert_equal "<table><thead><tr><th>thing</th></tr></thead><tbody><tr><td>thing</td></tr></tbody></table>", Govspeak::HtmlSanitizer.new(html).sanitize
     end
   end
+
+  test "excludes specified elements from sanitization" do
+    html = "<custom-allowed-element><p>text</p></custom-allowed-element>"
+    assert_equal "<p>text</p>", Govspeak::HtmlSanitizer.new(html).sanitize
+    assert_equal html, Govspeak::HtmlSanitizer.new(html).sanitize(allowed_elements: %w[custom-allowed-element])
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: govspeak
 version: !ruby/object:Gem::Version
-  version: 6.5.11
+  version: 6.6.0
 platform: ruby
 authors:
 - GOV.UK Dev
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-12-30 00:00:00.000000000 Z
+date: 2021-01-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionview
@@ -372,24 +372,24 @@ signing_key:
 specification_version: 4
 summary: Markup language for single domain
 test_files:
+- test/test_helper.rb
+- test/blockquote_extra_quote_remover_test.rb
 - test/govspeak_images_bang_test.rb
-- test/govspeak_attachment_test.rb
+- test/govspeak_contacts_test.rb
+- test/govspeak_table_with_headers_test.rb
 - test/govspeak_link_extractor_test.rb
-- test/govspeak_attachments_inline_test.rb
-- test/govspeak_button_test.rb
-- test/govspeak_structured_headers_test.rb
 - test/govspeak_attachments_image_test.rb
-- test/govspeak_attachment_link_test.rb
+- test/html_validator_test.rb
+- test/govspeak_button_test.rb
 - test/govspeak_extract_contact_content_ids_test.rb
-- test/presenters/h_card_presenter_test.rb
-- test/govspeak_test.rb
-- test/html_sanitizer_test.rb
+- test/govspeak_test_helper.rb
 - test/govspeak_footnote_test.rb
-- test/blockquote_extra_quote_remover_test.rb
-- test/test_helper.rb
-- test/govspeak_table_with_headers_test.rb
-- test/govspeak_images_test.rb
 - test/govspeak_link_test.rb
-- test/html_validator_test.rb
-- test/govspeak_contacts_test.rb
-- test/govspeak_test_helper.rb
+- test/govspeak_structured_headers_test.rb
+- test/html_sanitizer_test.rb
+- test/govspeak_images_test.rb
+- test/govspeak_test.rb
+- test/govspeak_attachment_link_test.rb
+- test/govspeak_attachment_test.rb
+- test/presenters/h_card_presenter_test.rb
+- test/govspeak_attachments_inline_test.rb