inkmark 0.1.2 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aec483333178a847396130007073b25d4c6ca453bbbc5b3338d2314a4b1dc161
-  data.tar.gz: aa8fe81268c5cd018708744cec3098733410f2f057ab1e21593f3ca2d5d7a5d8
+  metadata.gz: defe040ab5efe3959229a885dcfd613bcd7bec9a264a7eb5bd6a441221af3e36
+  data.tar.gz: a3bd5205a96103fb12392155e548014824f90af1e91a130c52d96715abc63295
 SHA512:
-  metadata.gz: 21233618a533d15f8529ed9e7739e34d81344d3c5439c25648e0ecf69173b4c79a23cd5a6f1548e5a7a488d46c968311e2d79058c12b69b98b3f45130a241e9e
-  data.tar.gz: 5cc63dd2c016d6446e35123d06f6e696816217ea0c6a9204d4eefecc846de46439ce16fdb3832e021441922bf467dc009e883df48ade1a3be61233420ab471d2
+  metadata.gz: 21536bdb30970d9f7bb58b002d35965a0ea6961a307f579229bc4eb34c5dabffd0a9b625aba12202e820166fb2efc5a35797e7714a7bcaf68be6f52afe14bef1
+  data.tar.gz: 022bfcb26faa0b74031f6984fffe894ff3038ea65195572aac17026fa6566d25a18bfbb766631b4e5d39b05fad65dcbbf4dbf932ac20c424127f36dc31b3e9f3

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## [0.1.3] - 2026-06-21
+
+- Fix possible XSS via unescaped language tag in syntax-highlighted code blocks.
+
 ## [0.1.2] - 2026-06-21
 
 - Fix `Inkmark.truncate_markdown` raising `TypeError` when called without explicit `options:`.

data/Cargo.lock

@@ -331,7 +331,7 @@ dependencies = [
 
 [[package]]
 name = "inkmark"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
  "deunicode",
  "emojis",

data/ext/inkmark/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "inkmark"
-version = "0.1.2"
+version = "0.1.3"
 edition = "2021"
 authors = ["Yaroslav Markin <yaroslav@markin.net>"]
 license = "MIT"

data/ext/inkmark/src/highlight.rs

@@ -15,6 +15,7 @@ use std::sync::OnceLock;
 
 use magnus::{Error, Ruby};
 use pulldown_cmark::{CodeBlockKind, CowStr, Event, Tag, TagEnd};
+use pulldown_cmark_escape::escape_html;
 use syntect::highlighting::ThemeSet;
 use syntect::html::{css_for_theme_with_class_style, ClassStyle, ClassedHTMLGenerator};
 use syntect::parsing::SyntaxSet;
@@ -87,7 +88,15 @@ fn highlight_code(code: &str, lang: &str, ss: &SyntaxSet) -> String {
 
     // Wrap each line in <span class="line"> so CSS can add line numbers
     // via counter()/::before, highlight specific lines on hover, etc.
-    let mut buf = format!("<pre><code class=\"language-{lang}\">");
+    //
+    // `lang` is the fenced code block's info string—attacker-controlled
+    // markdown. HTML-escape it before it enters the class attribute so a
+    // crafted language tag like `x"><img onerror=...>` can't break out of
+    // the attribute and inject markup (this Html event bypasses
+    // suppress_raw_html, so escaping here is the only defense).
+    let mut buf = String::from("<pre><code class=\"language-");
+    let _ = escape_html(&mut buf, lang);
+    buf.push_str("\">");
     for line in highlighted.split('\n') {
         if !line.is_empty() {
             buf.push_str("<span class=\"line\">");
@@ -149,6 +158,22 @@ mod tests {
         assert!(html.contains("<pre><code"));
     }
 
+    #[test]
+    fn escapes_malicious_language_tag_in_class_attribute() {
+        // The info string is attacker-controlled markdown. A crafted
+        // language tag must not break out of the class attribute.
+        let payload = "x\"><img src=a onerror=alert(1)>";
+        let html = highlight_code("let v = 1;\n", payload, syntax_set());
+        assert!(
+            !html.contains("\"><img src=a onerror="),
+            "language tag must be escaped, got: {html}"
+        );
+        assert!(
+            html.contains("language-x&quot;&gt;&lt;img"),
+            "expected escaped class attribute, got: {html}"
+        );
+    }
+
     #[test]
     fn unknown_language_falls_back_to_plain_text() {
         let html = highlight_code("hello\n", "nonexistent-lang-xyz", syntax_set());

data/lib/inkmark/version.rb

@@ -2,5 +2,5 @@
 
 class Inkmark
   # Current gem version.
-  VERSION = "0.1.2"
+  VERSION = "0.1.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: inkmark
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.3
 platform: ruby
 authors:
 - Yaroslav Markin