govspeak 7.1.1 → 8.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8b23cb6b80ef9b9d71a55b5cf0c1ffa1d33c3127ebac6290e7ed57de253439bd
-  data.tar.gz: 5bbe38f1188c1159d7af520b22dc2fc011e95256c53be222170081220c11fa64
+  metadata.gz: 5e8536931b5ec2ad23bada1b0cc94dad05779dc3d9565bc8dbd6449a6161a7a2
+  data.tar.gz: a67ea45edba261236ce6974564a3704218e69dec860fea1e782d8d20af3922a4
 SHA512:
-  metadata.gz: 13e3cbc3237ad2b739ff8d984d35e040e1379e716791fb9ed7d789b4d4ca9ce6398a53cb8bf095df68af80257aa5d1e2659803857f88677073576685da65df60
-  data.tar.gz: 0f9dc64d2983ffa7c546d54f96c852500d92b2b01e2b48d163784b5d41a2a6e38202d8385665c264287b8035d0b8d96059a5fd0be7f065774d602b3caeefc84b
+  metadata.gz: b66013937116e786786f240b72c61dbbbcc1e09af0fa5bfdc4b83aeef73133eb46078565dfa5766d252a9558d0b10b2322673ca0720deef7fd69414ca2ad158c
+  data.tar.gz: dac0b4479fc4691e41356104409a93ec0802a698107c20ab17ab524042d6571d7da606111aa4b4635c4855ade81369fbfcd7db5dbb080205f3502b7423b6bfc5

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 8.0.1
+
+* Add margin-bottom to embedded attachments ([#281](https://github.com/alphagov/govspeak/pull/281))
+
+## 8.0.0
+
+* BREAKING: HTML style attribute and style element, which were never supposed to be available, are forbidden. [#279](https://github.com/alphagov/govspeak/pull/279)
+
 ## 7.1.1
 
 * Make image and attachment embedding syntax more consistent [#274](https://github.com/alphagov/govspeak/pull/274)

data/lib/govspeak/html_sanitizer.rb

@@ -17,31 +17,13 @@ class Govspeak::HtmlSanitizer
     end
   end
 
-  class TableCellTextAlignWhitelister
-    def call(sanitize_context)
-      return unless %w[td th].include?(sanitize_context[:node_name])
-
-      node = sanitize_context[:node]
-
-      # Kramdown uses text-align to allow table cells to be aligned
-      # http://kramdown.gettalong.org/quickref.html#tables
-      if invalid_style_attribute?(node["style"])
-        node.remove_attribute("style")
-      end
-    end
-
-    def invalid_style_attribute?(style)
-      style && !style.match(/^text-align:\s*(center|left|right)$/)
-    end
-  end
-
   def initialize(dirty_html, options = {})
     @dirty_html = dirty_html
     @allowed_image_hosts = options[:allowed_image_hosts]
   end
 
   def sanitize(allowed_elements: [])
-    transformers = [TableCellTextAlignWhitelister.new]
+    transformers = []
     if @allowed_image_hosts && @allowed_image_hosts.any?
       transformers << ImageSourceWhitelister.new(@allowed_image_hosts)
     end
@@ -60,21 +42,29 @@ class Govspeak::HtmlSanitizer
   end
 
   def sanitize_config(allowed_elements: [])
+    # We purposefully disable style elements which Sanitize::Config::RELAXED allows
+    elements = Sanitize::Config::RELAXED[:elements] - %w[style] +
+      %w[govspeak-embed-attachment govspeak-embed-attachment-link svg path].concat(allowed_elements)
+
     Sanitize::Config.merge(
       Sanitize::Config::RELAXED,
-      elements: Sanitize::Config::RELAXED[:elements] + %w[govspeak-embed-attachment govspeak-embed-attachment-link svg path].concat(allowed_elements),
+      elements: elements,
       attributes: {
-        :all => Sanitize::Config::RELAXED[:attributes][:all] + %w[role aria-label],
+        # We purposefully disable style attributes which Sanitize::Config::RELAXED allows
+        :all => Sanitize::Config::RELAXED[:attributes][:all] + %w[role aria-label] - %w[style],
         "a" => Sanitize::Config::RELAXED[:attributes]["a"] + [:data] + %w[draggable],
-        "svg" => Sanitize::Config::RELAXED[:attributes][:all] + %w[xmlns width height viewbox focusable],
-        "path" => Sanitize::Config::RELAXED[:attributes][:all] + %w[fill d],
+        "svg" => %w[xmlns width height viewbox focusable],
+        "path" => %w[fill d],
         "div" => [:data],
-        # @TODO  These style attributes can be removed once we've checked there
-        # isn't hardcoded HTML in documents that uses them
+        # The style attributes are permitted here just for the ones Kramdown for table alignment
+        # we replace them in a post processor.
         "th" => Sanitize::Config::RELAXED[:attributes]["th"] + %w[style],
         "td" => Sanitize::Config::RELAXED[:attributes]["td"] + %w[style],
         "govspeak-embed-attachment" => %w[content-id],
       },
+      # The only styling we permit is text-align on table cells (which is the CSS kramdown
+      # generates), we can therefore only allow this one CSS property
+      css: { properties: %w[text-align] },
     )
   end
 end

data/lib/govspeak/post_processor.rb

@@ -59,6 +59,7 @@ module Govspeak
         attachment_html = GovukPublishingComponents.render(
           "govuk_publishing_components/components/attachment",
           attachment: attachment,
+          margin_bottom: 6,
           locale: govspeak_document.locale,
         )
         el.swap(attachment_html)

data/lib/govspeak/version.rb

@@ -1,3 +1,3 @@
 module Govspeak
-  VERSION = "7.1.1".freeze
+  VERSION = "8.0.1".freeze
 end

data/test/govspeak_attachment_link_test.rb

@@ -35,4 +35,15 @@ class GovspeakAttachmentLinkTest < Minitest::Test
     assert(root.css("p").size, 0)
     assert_match(/Attachment Title\s*test/, root.text)
   end
+
+  test "allows spaces and special characters in the identifier" do
+    attachment = {
+      id: "This is the name of my &%$@€? attachment",
+      url: "http://example.com/attachment.pdf",
+      title: "Attachment Title",
+    }
+
+    rendered = render_govspeak("[AttachmentLink: This is the name of my &%$@€? attachment]", [attachment])
+    assert_match(/Attachment Title/, rendered)
+  end
 end

data/test/govspeak_attachment_test.rb

@@ -21,6 +21,18 @@ class GovspeakAttachmentTest < Minitest::Test
     assert_match(/Attachment Title/, rendered)
   end
 
+  test "allows spaces and special characters in the identifier" do
+    attachment = {
+      id: "This is the name of my &%$@€? attachment",
+      url: "http://example.com/attachment.pdf",
+      title: "Attachment Title",
+    }
+
+    rendered = render_govspeak("[Attachment: This is the name of my &%$@€? attachment]", [attachment])
+    assert_match(/<section class="gem-c-attachment/, rendered)
+    assert_match(/Attachment Title/, rendered)
+  end
+
   test "only renders attachment when markdown extension starts on a new line" do
     attachment = {
       id: "attachment.pdf",

data/test/govspeak_images_test.rb

@@ -72,6 +72,15 @@ class GovspeakImagesTest < Minitest::Test
     end
   end
 
+  test "allows spaces and special characters in the identifier" do
+    image = build_image(id: "This is the name of my &%$@€? image")
+    given_govspeak "[Image: This is the name of my &%$@€? image]", images: [image] do
+      assert_html_output(
+        "<figure class=\"image embedded\"><div class=\"img\"><img src=\"http://example.com/image.jpg\" alt=\"my alt\"></div></figure>",
+      )
+    end
+  end
+
   test "Image is not inserted when it does not start on a new line" do
     given_govspeak "some text [Image:image-id]", images: [build_image] do
       assert_html_output("<p>some text [Image:image-id]</p>")

data/test/{govspeak_table_with_headers_test.rb → govspeak_tables_test.rb}

@@ -1,7 +1,7 @@
 require "test_helper"
 
-class GovspeakTableWithHeadersTest < Minitest::Test
-  def expected_outcome
+class GovspeakTablesTest < Minitest::Test
+  def expected_outcome_for_headers
     %(
 <table>
   <thead>
@@ -248,30 +248,44 @@ class GovspeakTableWithHeadersTest < Minitest::Test
   end
 
   test "Cells with |# are headers" do
-    assert_equal document_body_with_hashes_for_all_headers.to_html, expected_outcome
+    assert_equal expected_outcome_for_headers, document_body_with_hashes_for_all_headers.to_html
   end
 
   test "Cells outside of thead with |# are th; thead still only contains th" do
-    assert_equal document_body_with_hashes_for_row_headers.to_html, expected_outcome
+    assert_equal expected_outcome_for_headers, document_body_with_hashes_for_row_headers.to_html
   end
 
   test "Cells are given classes to indicate alignment" do
-    assert_equal document_body_with_alignments.to_html, expected_outcome_for_table_with_alignments
+    assert_equal expected_outcome_for_table_with_alignments, document_body_with_alignments.to_html
+  end
+
+  test "Invalid alignment properties are dropped from cells" do
+    html = %(<table><tbody><tr><td style="text-align: middle">middle</td></tr></tbody></table>)
+    expected = "<table><tbody><tr><td>middle</td></tr></tbody></table>\n"
+
+    assert_equal expected, Govspeak::Document.new(html).to_html
+  end
+
+  test "Styles other than text-align are ignored on a table cell" do
+    html = %(<table><tbody><tr><td style="text-align: center; width: 100px;">middle</td></tr></tbody></table>)
+    expected = %(<table><tbody><tr><td class="cell-text-center">middle</td></tr></tbody></table>\n)
+
+    assert_equal expected, Govspeak::Document.new(html).to_html
   end
 
   test "Table headers with a scope of row are only in the first column of the table" do
-    assert_equal document_body_with_table_headers_in_the_wrong_place.to_html, expected_outcome_for_table_headers_in_the_wrong_place
+    assert_equal expected_outcome_for_table_headers_in_the_wrong_place, document_body_with_table_headers_in_the_wrong_place.to_html
   end
 
   test "Table headers with a scope of row can have embedded links" do
-    assert_equal document_body_with_table_headers_containing_links.to_html, expected_outcome_for_table_headers_containing_links
+    assert_equal expected_outcome_for_table_headers_containing_links, document_body_with_table_headers_containing_links.to_html
   end
 
   test "Table headers are not blank" do
-    assert_equal document_body_with_blank_table_headers.to_html, expected_outcome_for_table_with_blank_table_headers
+    assert_equal expected_outcome_for_table_with_blank_table_headers, document_body_with_blank_table_headers.to_html
   end
 
   test "Table header superscript should parse" do
-    assert_equal document_body_with_table_headers_containing_superscript.to_html, expected_outcome_for_table_with_table_headers_containing_superscript
+    assert_equal expected_outcome_for_table_with_table_headers_containing_superscript, document_body_with_table_headers_containing_superscript.to_html, expected_outcome_for_table_with_table_headers_containing_superscript
   end
 end

data/test/html_sanitizer_test.rb

@@ -17,6 +17,16 @@ class HtmlSanitizerTest < Minitest::Test
     assert_equal "<a href=\"/\">Link</a>", Govspeak::HtmlSanitizer.new(html).sanitize
   end
 
+  test "disallow style attributes" do
+    html = '<a href="/" style="font-weight:bold">Link</a>'
+    assert_equal '<a href="/">Link</a>', Govspeak::HtmlSanitizer.new(html).sanitize
+  end
+
+  test "disallow style elements" do
+    html = "<style>h1 { color: pink; }</style><h1>Hi</h1>"
+    assert_equal "<h1>Hi</h1>", Govspeak::HtmlSanitizer.new(html).sanitize
+  end
+
   test "allow non-JS HTML content" do
     html = "<a href='foo'>"
     assert_equal "<a href=\"foo\"></a>", Govspeak::HtmlSanitizer.new(html).sanitize
@@ -79,16 +89,16 @@ class HtmlSanitizerTest < Minitest::Test
     assert_equal "<table><tbody><tr><th>thing</th><td>thing</td></tr></tbody></table>", Govspeak::HtmlSanitizer.new(html).sanitize
   end
 
-  test "allows valid text-align properties on the style attribute for table cells and table headings" do
-    %w[left right center].each do |alignment|
-      html = "<table><thead><tr><th style=\"text-align: #{alignment}\">thing</th></tr></thead><tbody><tr><td style=\"text-align: #{alignment}\">thing</td></tr></tbody></table>"
-      assert_equal html, Govspeak::HtmlSanitizer.new(html).sanitize
-    end
+  test "allows text-align properties on the style attribute for table cells and table headings" do
+    html = "<table><thead><tr><th style=\"text-align: right\">thing</th></tr></thead><tbody><tr><td style=\"text-align: center\">thing</td></tr></tbody></table>"
+    assert_equal html, Govspeak::HtmlSanitizer.new(html).sanitize
+
+    input = "<table><thead><tr><th style=\"text-align: left;width: 100px;\">thing</th></tr></thead><tbody><tr><td style=\"text-align: center;background-color: blue;\">thing</td></tr></tbody></table>"
+    expected = "<table><thead><tr><th style=\"text-align: left;\">thing</th></tr></thead><tbody><tr><td style=\"text-align: center;\">thing</td></tr></tbody></table>"
+    assert_equal expected, Govspeak::HtmlSanitizer.new(input).sanitize
 
     [
       "width: 10000px",
-      "text-align: middle",
-      "text-align: left; width: 10px",
       "background-image: url(javascript:alert('XSS'))",
       "expression(alert('XSS'));",
     ].each do |style|

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: govspeak
 version: !ruby/object:Gem::Version
-  version: 7.1.1
+  version: 8.0.1
 platform: ruby
 authors:
 - GOV.UK Dev
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-05-19 00:00:00.000000000 Z
+date: 2023-07-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionview
@@ -190,14 +190,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.10.0
+        version: 4.11.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.10.0
+        version: 4.11.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -302,7 +302,7 @@ files:
 - test/govspeak_link_extractor_test.rb
 - test/govspeak_link_test.rb
 - test/govspeak_structured_headers_test.rb
-- test/govspeak_table_with_headers_test.rb
+- test/govspeak_tables_test.rb
 - test/govspeak_test.rb
 - test/govspeak_test_helper.rb
 - test/html_sanitizer_test.rb
@@ -327,7 +327,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.13
+rubygems_version: 3.4.16
 signing_key: 
 specification_version: 4
 summary: Markup language for single domain
@@ -346,7 +346,7 @@ test_files:
 - test/govspeak_link_extractor_test.rb
 - test/govspeak_link_test.rb
 - test/govspeak_structured_headers_test.rb
-- test/govspeak_table_with_headers_test.rb
+- test/govspeak_tables_test.rb
 - test/govspeak_test.rb
 - test/govspeak_test_helper.rb
 - test/html_sanitizer_test.rb