jekyll-client-search 0.3.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ed1c7a635cc419d9fb130411ced8e64a473c016e8188e36ddd98ea6922a098f7
-  data.tar.gz: f320844ded59274df991b1aa3d56fb22560e818105c5a0e682ea6e6a0c67df88
+  metadata.gz: 1d3574c3adc2e2e00dd76ef5b5011358fcb9abfe3ed0cfbd372dffee00f913fc
+  data.tar.gz: 76f691ec62695d6e99677bc952fe85ae07c477df563f83b29f063a58f5b0d8c0
 SHA512:
-  metadata.gz: a12fb0052f9a727baf957735cd23fc9759f46fe7b54977acd16ed63edb14b0d63e2594d3c2bee936c9317541f8810a654acf7a5369746c9d11c39699457cf351
-  data.tar.gz: 46986b4c1a0107821f6932d8538c1aff0fcc386ddb9e9f787a4890da5f8af3ccd30a8c0b6b9257d928d3b52aa6fe625806136812cfbf781763a0f3a391cf9aa6
+  metadata.gz: 23b5534d2c60626e5ee068687f2c4313f6e7494f1e382b89928f37b3eaf50fad3f979808e696c6a2bf3d17a5a00764674667b9f8f4041b4fc6f73a71953fcee7
+  data.tar.gz: 9403f90fd84ee7798fa07281001faf534028247e2f99aea46a9a305b8c3ac57191ae0059cb49ca8eb377b1ba7633b5960f3c481bc24e0cc6de872d30132b3521

data/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## Unreleased
 
+## 0.3.1 — 2026-09-09
+
+### Fixed
+- Fix CodeQL `rb/bad-tag-filter` (high) in `DocumentBuilder#clean` — closing tag regex `</script\s*>` only matched whitespace before `>`, missing browser-accepted tags like `</script\t\n bar>`; changed to `</script[^>]*>` and `</style[^>]*>` to match any non-`>` content
+- Fix CodeQL `rb/polynomial-redos` (high) in `RelatedTag` — `\s*` patterns between optional groups in SYNTAX regex caused O(n²) backtracking on input with many spaces; replaced single regex with token-split parser that validates each token individually
+
+### Changed
+- Update `simplecov` 1.1.1 → 1.2.0
+- Update `google-protobuf` 4.36.0 → 4.36.1 (transitive)
+- Update `sass-embedded` 1.103.1 → 1.104.0 (transitive)
+- Update `eslint` 10.9.1 → 10.10.0 (dev)
+- Update `globals` 17.11.0 → 17.12.0 (dev)
+
 ## 0.3.0 — 2026-09-02
 
 ### Added

data/lib/jekyll/client_search/document_builder.rb

@@ -67,8 +67,8 @@ module Jekyll
 
       def clean(value)
         cleaned = value.to_s
-                       .gsub(%r{<script\b[^>]*>.*?</script\s*>}mi, " ")
-                       .gsub(%r{<style\b[^>]*>.*?</style\s*>}mi, " ")
+                       .gsub(%r{<script\b[^>]*>.*?</script[^>]*>}mi, " ")
+                       .gsub(%r{<style\b[^>]*>.*?</style[^>]*>}mi, " ")
                        .gsub(/\{%.*?%\}/m, " ")
                        .gsub(/\{\{.*?\}\}/m, " ")
                        .gsub(/!\[[^\]]*\]\([^)]*\)/, " ")

data/lib/jekyll/client_search/related_tag.rb

@@ -14,23 +14,39 @@ module Jekyll
     # When +related.enabled+ is false the tag renders nothing, so it is safe
     # to leave in a layout even when the feature is off.
     class RelatedTag < Liquid::Tag
-      SYNTAX = /\A(sort:(\w+))?\s*(max:(\d+))?\s*(no_scripts)?\z/
+      TOKEN_SYNTAX = /\A(sort:\w+|max:\d+|no_scripts)\z/
 
       def initialize(tag_name, markup, tokens)
         super
         @markup = markup.to_s.strip
-        unless (match = @markup.match(SYNTAX))
-          raise Liquid::SyntaxError,
-                "related_articles: invalid syntax. Use {% related_articles %}, " \
-                "{% related_articles sort:date %}, {% related_articles max:3 %}, " \
-                "or {% related_articles no_scripts %}"
-        end
+        parse_tokens(@markup)
+      end
+
+      def parse_tokens(markup)
+        @sort = nil
+        @max_items = nil
+        @include_scripts = true
+        return if markup.empty?
+
+        markup.split(/\s+/).each { |token| apply_token(token) }
+      end
+
+      def apply_token(token)
+        raise Liquid::SyntaxError, syntax_error_msg unless token.match(TOKEN_SYNTAX)
 
-        @sort = match[2] if match[2]
-        @max_items = match[4].to_i if match[4]
-        raise Liquid::SyntaxError, "related_articles: max must be greater than zero" if @max_items && @max_items < 1
+        case token
+        when /\Asort:(\w+)\z/ then @sort = Regexp.last_match(1)
+        when /\Amax:(\d+)\z/
+          @max_items = Regexp.last_match(1).to_i
+          raise Liquid::SyntaxError, "related_articles: max must be greater than zero" if @max_items < 1
+        when "no_scripts" then @include_scripts = false
+        end
+      end
 
-        @include_scripts = match[5].nil?
+      def syntax_error_msg
+        "related_articles: invalid syntax. Use {% related_articles %}, " \
+          "{% related_articles sort:date %}, {% related_articles max:3 %}, " \
+          "or {% related_articles no_scripts %}"
       end
 
       def render(context)

data/lib/jekyll/client_search/version.rb

@@ -2,6 +2,6 @@
 
 module Jekyll
   module ClientSearch
-    VERSION = "0.3.0"
+    VERSION = "0.3.1"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jekyll-client-search
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Svend Gundestrup