inkmark 0.1.2 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aec483333178a847396130007073b25d4c6ca453bbbc5b3338d2314a4b1dc161
-  data.tar.gz: aa8fe81268c5cd018708744cec3098733410f2f057ab1e21593f3ca2d5d7a5d8
+  metadata.gz: 75b9caec914a5e3b191911f77c83be71f81b729dc156461c30066de77c2e0f13
+  data.tar.gz: 8ff22a0d8e12d2ae300d450edbdb0546de506993c9df47612a5c852018e9a8f9
 SHA512:
-  metadata.gz: 21233618a533d15f8529ed9e7739e34d81344d3c5439c25648e0ecf69173b4c79a23cd5a6f1548e5a7a488d46c968311e2d79058c12b69b98b3f45130a241e9e
-  data.tar.gz: 5cc63dd2c016d6446e35123d06f6e696816217ea0c6a9204d4eefecc846de46439ce16fdb3832e021441922bf467dc009e883df48ade1a3be61233420ab471d2
+  metadata.gz: '0709173de6887ccee58ace68ea2dca6b42fc1c6e44f4ac5b2510f37501bb876652e7cfb60d5dd6d35025d43a1769fa49ebfd95fbd9d873c1669c5dd8ce31db65'
+  data.tar.gz: d8abaf48a2172226c0e39390989210dcb4f51df1d7ae627d99a72e65f2f6731cc85a99a1993827f0480f8da07da57d2a598c32c3272d8b4672cda0a1c5d6697e

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+## [0.1.4] - 2026-06-25
+
+- Fix `frontmatter: true` leaking the frontmatter block into `to_markdown`, `chunks_by_heading`, and `chunks_by_size` output. Bug report by @freesteph [#3]
+
+## [0.1.3] - 2026-06-21
+
+- Fix possible XSS via unescaped language tag in syntax-highlighted code blocks.
+
 ## [0.1.2] - 2026-06-21
 
 - Fix `Inkmark.truncate_markdown` raising `TypeError` when called without explicit `options:`.

data/Cargo.lock

@@ -331,7 +331,7 @@ dependencies = [
 
 [[package]]
 name = "inkmark"
-version = "0.1.2"
+version = "0.1.4"
 dependencies = [
  "deunicode",
  "emojis",

data/ext/inkmark/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "inkmark"
-version = "0.1.2"
+version = "0.1.4"
 edition = "2021"
 authors = ["Yaroslav Markin <yaroslav@markin.net>"]
 license = "MIT"

data/ext/inkmark/src/chunks_by_heading.rs

@@ -19,7 +19,7 @@ use magnus::{Error, RArray, RHash, Ruby};
 use pulldown_cmark::{Event, HeadingLevel, Parser, Tag, TagEnd};
 use unicode_segmentation::UnicodeSegmentation;
 
-use crate::document::apply_filters;
+use crate::document::{apply_filters, content_events};
 use crate::heading::{self, SlugDeduplicator};
 use crate::options::build_options;
 use crate::toc;
@@ -43,7 +43,8 @@ pub fn native_chunks_by_heading(
     let (cm_opts, flags) = build_options(ruby, opts_hash)?;
 
     // Parse + run the full filter pipeline, same as `to_markdown`.
-    let events: Vec<Event> = Parser::new_ext(&source, cm_opts).collect();
+    // `content_events` drops frontmatter so it never becomes a section.
+    let events: Vec<Event> = content_events(&source, cm_opts).collect();
     let events = apply_filters(events, &flags);
 
     let boundaries = find_heading_boundaries(&events);

data/ext/inkmark/src/chunks_by_size.rs

@@ -18,10 +18,10 @@
 //! adjacent chunks share context.
 
 use magnus::{Error, RArray, RHash, Ruby};
-use pulldown_cmark::{Event, Parser};
+use pulldown_cmark::Event;
 use unicode_segmentation::UnicodeSegmentation;
 
-use crate::document::apply_filters;
+use crate::document::{apply_filters, content_events};
 use crate::options::build_options;
 
 #[derive(Clone, Copy, PartialEq, Eq)]
@@ -45,7 +45,7 @@ pub fn native_chunks_by_size(
     let params = parse_params(ruby, &opts_hash)?;
     let (cm_opts, flags) = build_options(ruby, opts_hash)?;
 
-    let events: Vec<Event> = Parser::new_ext(&source, cm_opts).collect();
+    let events: Vec<Event> = content_events(&source, cm_opts).collect();
     let events = apply_filters(events, &flags);
 
     let windows = match params.at {

data/ext/inkmark/src/document.rs

@@ -1,5 +1,5 @@
 use magnus::{Error, RHash, Ruby};
-use pulldown_cmark::{html, Event, Options, Parser};
+use pulldown_cmark::{html, Event, Options, Parser, Tag, TagEnd};
 
 use crate::autolink;
 use crate::emoji;
@@ -115,6 +115,44 @@ fn hard_wrap(event: Event) -> Event {
     }
 }
 
+/// Parse `source` into the content event stream that renderers and chunkers
+/// consume.
+///
+/// YAML frontmatter is removed at this boundary: it is document *metadata*
+/// (surfaced via {Inkmark#frontmatter}), never content. pulldown-cmark's HTML
+/// renderer ignores metadata blocks and our plain-text writer discards them,
+/// but the Markdown serializer (`pulldown-cmark-to-cmark`) faithfully
+/// re-emits them as `---\n...\n---`. Rather than re-stripping after the fact
+/// in every Markdown/chunk path, we never hand those consumers the events in
+/// the first place—so `to_markdown`, `chunks_by_heading`, and
+/// `chunks_by_size` are frontmatter-free by construction, with no separate
+/// pass and no special-casing of the streaming fast path.
+///
+/// Frontmatter extraction walks the *raw* parser (see `stats::collect`), so
+/// dropping the events here does not affect the `frontmatter` accessor.
+pub fn content_events(source: &str, cm_opts: Options) -> impl Iterator<Item = Event<'_>> {
+    drop_metadata(Parser::new_ext(source, cm_opts))
+}
+
+/// Iterator adapter that filters out `Start(MetadataBlock) … End(MetadataBlock)`
+/// runs, including the raw YAML `Text` between the markers. Stateful but
+/// composes with both the streaming fast path and the buffered `.collect()`
+/// path, so a single definition serves every content consumer.
+fn drop_metadata<'a>(events: impl Iterator<Item = Event<'a>>) -> impl Iterator<Item = Event<'a>> {
+    let mut in_metadata = false;
+    events.filter(move |event| match event {
+        Event::Start(Tag::MetadataBlock(_)) => {
+            in_metadata = true;
+            false
+        }
+        Event::End(TagEnd::MetadataBlock(_)) => {
+            in_metadata = false;
+            false
+        }
+        _ => !in_metadata,
+    })
+}
+
 /// Full render: parse once, collect stats + TOC from original events,
 /// apply filters, render HTML. Returns a Ruby Hash:
 ///
@@ -219,14 +257,18 @@ fn render(source: &str, cm_opts: pulldown_cmark::Options, flags: Flags) -> Strin
 
 fn render_to_markdown(source: &str, cm_opts: pulldown_cmark::Options, flags: Flags) -> String {
     let mut buf = String::with_capacity(source.len());
-    let parser = Parser::new_ext(source, cm_opts);
 
+    // `content_events` strips frontmatter, so the cmark serializer never sees
+    // a metadata block to re-emit—on either the streaming or buffered path.
     if !needs_buffer(&flags) {
-        cmark_write(parser.map(stream_filter(&flags)), &mut buf);
+        cmark_write(
+            content_events(source, cm_opts).map(stream_filter(&flags)),
+            &mut buf,
+        );
         return buf;
     }
 
-    let events = apply_filters(parser.collect(), &flags);
+    let events = apply_filters(content_events(source, cm_opts).collect(), &flags);
     cmark_write(events.into_iter(), &mut buf);
     buf
 }

data/ext/inkmark/src/highlight.rs

@@ -15,6 +15,7 @@ use std::sync::OnceLock;
 
 use magnus::{Error, Ruby};
 use pulldown_cmark::{CodeBlockKind, CowStr, Event, Tag, TagEnd};
+use pulldown_cmark_escape::escape_html;
 use syntect::highlighting::ThemeSet;
 use syntect::html::{css_for_theme_with_class_style, ClassStyle, ClassedHTMLGenerator};
 use syntect::parsing::SyntaxSet;
@@ -87,7 +88,15 @@ fn highlight_code(code: &str, lang: &str, ss: &SyntaxSet) -> String {
 
     // Wrap each line in <span class="line"> so CSS can add line numbers
     // via counter()/::before, highlight specific lines on hover, etc.
-    let mut buf = format!("<pre><code class=\"language-{lang}\">");
+    //
+    // `lang` is the fenced code block's info string—attacker-controlled
+    // markdown. HTML-escape it before it enters the class attribute so a
+    // crafted language tag like `x"><img onerror=...>` can't break out of
+    // the attribute and inject markup (this Html event bypasses
+    // suppress_raw_html, so escaping here is the only defense).
+    let mut buf = String::from("<pre><code class=\"language-");
+    let _ = escape_html(&mut buf, lang);
+    buf.push_str("\">");
     for line in highlighted.split('\n') {
         if !line.is_empty() {
             buf.push_str("<span class=\"line\">");
@@ -149,6 +158,22 @@ mod tests {
         assert!(html.contains("<pre><code"));
     }
 
+    #[test]
+    fn escapes_malicious_language_tag_in_class_attribute() {
+        // The info string is attacker-controlled markdown. A crafted
+        // language tag must not break out of the class attribute.
+        let payload = "x\"><img src=a onerror=alert(1)>";
+        let html = highlight_code("let v = 1;\n", payload, syntax_set());
+        assert!(
+            !html.contains("\"><img src=a onerror="),
+            "language tag must be escaped, got: {html}"
+        );
+        assert!(
+            html.contains("language-x&quot;&gt;&lt;img"),
+            "expected escaped class attribute, got: {html}"
+        );
+    }
+
     #[test]
     fn unknown_language_falls_back_to_plain_text() {
         let html = highlight_code("hello\n", "nonexistent-lang-xyz", syntax_set());

data/ext/inkmark/src/truncate.rs

@@ -7,10 +7,10 @@
 //! input, context-window budgeting, and chunk normalization.
 
 use magnus::{Error, RHash, Ruby};
-use pulldown_cmark::{Event, Parser};
+use pulldown_cmark::Event;
 use unicode_segmentation::UnicodeSegmentation;
 
-use crate::document::apply_filters;
+use crate::document::{apply_filters, content_events};
 use crate::options::{build_options, Flags};
 
 /// What kind of boundary to cut at.
@@ -44,7 +44,7 @@ pub fn truncate_source(
     flags: &Flags,
     params: &TruncateParams,
 ) -> String {
-    let events: Vec<Event> = Parser::new_ext(source, cm_opts).collect();
+    let events: Vec<Event> = content_events(source, cm_opts).collect();
     let events = apply_filters(events, flags);
     truncate_events(&events, params)
 }

data/lib/inkmark/version.rb

@@ -2,5 +2,5 @@
 
 class Inkmark
   # Current gem version.
-  VERSION = "0.1.2"
+  VERSION = "0.1.4"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: inkmark
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.4
 platform: ruby
 authors:
 - Yaroslav Markin