govspeak 3.5.2 → 3.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 62bbf045a81a14edccdebbc6f9bfe8b16053fe83
-  data.tar.gz: 51b63bd95386ba9a1409b8aeab3f9fed85dc169f
+  metadata.gz: 88204b81285c071614cae4cdbc7933647c408ec7
+  data.tar.gz: 4927a7e014000868d29574ef257eda8d3fadd012
 SHA512:
-  metadata.gz: 144b044eaac74204158ab084b8aa65faa911b0f1f37aee17037950a3a6f89b0da67f2813e448bbeb435429db02fe15db0c087c9ad114d396643ea030ad7e98df
-  data.tar.gz: 2bbad23f71d71361666a73fb59a93eea150134c5e3239c93ed9726e1c6894de96184ae88a2628b9f3201440d98411bc13486d4ddb298eb5a4510da74f1e1e1c6
+  metadata.gz: 220d392cd52c2ee77f44e3ba65af87a143b14706339c99ec13bbd32063c1933e3079f82512f2941a6720923a9e0449a100fd31ddf624fd2b2b6d30edbcdda3ed
+  data.tar.gz: 76327a9e3df12548d9edeafe83646102374044757dec3d98b1805dba514b897e0bbb56ab0a3fb992888936f05b6393da263ba6f0f8cc11fedd40ec348713e413

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 3.6.0
+
+* Update minimum Kramdown version from 1.5.0 to 1.10.0 ([changelog](https://github.com/gettalong/kramdown/tree/2cd02dfacda041d3108a039e085f804645a9d538/doc/news))
+* Allow table columns to be left, right or centre aligned using the [standard markdown pattern](http://kramdown.gettalong.org/quickref.html#tables) provided by Kramdown
+
 ## 3.5.2
 
 * Fix a couple of issues with the [header_extractor](https://github.com/alphagov/govspeak/blob/master/lib/govspeak/header_extractor.rb). The method now picks up headers nested inside `blocks`, and when ID's are [explicitly set](http://kramdown.gettalong.org/syntax.html#specifying-a-header-id). See [https://github.com/alphagov/govspeak/pull/66](https://github.com/alphagov/govspeak/pull/66) for more.

data/lib/govspeak/html_sanitizer.rb

@@ -21,13 +21,26 @@ class Govspeak::HtmlSanitizer
     end
   end
 
+  class TableCellTextAlignWhitelister
+    def call(sanitize_context)
+      return unless ["td", "th"].include?(sanitize_context[:node_name])
+      node = sanitize_context[:node]
+
+      # Kramdown uses text-align to allow table cells to be aligned
+      # http://kramdown.gettalong.org/quickref.html#tables
+      unless node['style'].match(/^text-align:\s*(center|left|right)$/)
+        node.remove_attribute('style')
+      end
+    end
+  end
+
   def initialize(dirty_html, options = {})
     @dirty_html = dirty_html
     @allowed_image_hosts = options[:allowed_image_hosts]
   end
 
   def sanitize
-    transformers = []
+    transformers = [TableCellTextAlignWhitelister.new]
     if @allowed_image_hosts && @allowed_image_hosts.any?
       transformers << ImageSourceWhitelister.new(@allowed_image_hosts)
     end
@@ -45,6 +58,8 @@ class Govspeak::HtmlSanitizer
       attributes: {
         :all => Sanitize::Config::RELAXED[:attributes][:all] + [ "id", "class", "role", "aria-label" ],
         "a"  => Sanitize::Config::RELAXED[:attributes]["a"] + [ "rel" ],
+        "th"  => Sanitize::Config::RELAXED[:attributes]["th"] + [ "style" ],
+        "td"  => Sanitize::Config::RELAXED[:attributes]["td"] + [ "style" ],
       },
       elements: Sanitize::Config::RELAXED[:elements] + [ "div", "span", "aside" ],
     })

data/lib/govspeak/version.rb

@@ -1,3 +1,3 @@
 module Govspeak
-  VERSION = "3.5.2"
+  VERSION = "3.6.0"
 end

data/test/govspeak_test.rb

@@ -20,17 +20,17 @@ class GovspeakTest < Minitest::Test
 
   test "simple block extension" do
     rendered =  Govspeak::Document.new("this \n{::reverse}\n*is*\n{:/reverse}\n markdown").to_html
-    assert_equal "<p>this </p>\n\n<p><em>si</em></p>\n\n<p>markdown</p>\n", rendered
+    assert_equal "<p>this</p>\n\n<p><em>si</em></p>\n\n<p>markdown</p>\n", rendered
   end
 
   test "highlight-answer block extension" do
     rendered =  Govspeak::Document.new("this \n{::highlight-answer}Lead in to *BIG TEXT*\n{:/highlight-answer}").to_html
-    assert_equal %Q{<p>this </p>\n\n<div class="highlight-answer">\n<p>Lead in to <em>BIG TEXT</em></p>\n</div>\n}, rendered
+    assert_equal %Q{<p>this</p>\n\n<div class="highlight-answer">\n<p>Lead in to <em>BIG TEXT</em></p>\n</div>\n}, rendered
   end
 
   test "stat-headline block extension" do
     rendered =  Govspeak::Document.new("this \n{stat-headline}*13.8bn* Age of the universe in years{/stat-headline}").to_html
-    assert_equal %Q{<p>this </p>\n\n<aside class="stat-headline">\n<p><em>13.8bn</em> Age of the universe in years</p>\n</aside>\n}, rendered
+    assert_equal %Q{<p>this</p>\n\n<aside class="stat-headline">\n<p><em>13.8bn</em> Age of the universe in years</p>\n</aside>\n}, rendered
   end
 
   test "extracts headers with text, level and generated id" do

data/test/html_sanitizer_test.rb

@@ -43,4 +43,22 @@ class HtmlSanitizerTest < Minitest::Test
     html = "<img src='http://example.com/image.jgp'>"
     assert_equal "", Govspeak::HtmlSanitizer.new(html).sanitize_without_images
   end
+
+  test "allows valid text-align properties on the style attribute for table cells and table headings" do
+    ["left", "right", "center"].each do |alignment|
+      html = "<td style=\"text-align: #{alignment}\">thing</td>"
+      assert_equal html, Govspeak::HtmlSanitizer.new(html).sanitize
+    end
+
+    [
+      "width: 10000px",
+      "text-align: middle",
+      "text-align: left; width: 10px",
+      "background-image: url(javascript:alert('XSS'))",
+      "expression(alert('XSS'));"
+    ].each do |style|
+      html = "<td style=\"#{style}\">thing</td>"
+      assert_equal '<td>thing</td>', Govspeak::HtmlSanitizer.new(html).sanitize
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: govspeak
 version: !ruby/object:Gem::Version
-  version: 3.5.2
+  version: 3.6.0
 platform: ruby
 authors:
 - Ben Griffiths
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-01-12 00:00:00.000000000 Z
+date: 2016-05-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: kramdown
@@ -17,14 +17,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.5.0
+        version: 1.10.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.5.0
+        version: 1.10.0
 - !ruby/object:Gem::Dependency
   name: htmlentities
   requirement: !ruby/object:Gem::Requirement