loofah 2.20.0 → 2.21.0.rc1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (23) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +32 -0
  3. data/README.md +97 -106
  4. data/lib/loofah/concerns.rb +207 -0
  5. data/lib/loofah/elements.rb +78 -76
  6. data/lib/loofah/helpers.rb +21 -15
  7. data/lib/loofah/{html → html4}/document.rb +5 -7
  8. data/lib/loofah/html4/document_fragment.rb +15 -0
  9. data/lib/loofah/html5/document.rb +17 -0
  10. data/lib/loofah/html5/document_fragment.rb +15 -0
  11. data/lib/loofah/html5/libxml2_workarounds.rb +7 -6
  12. data/lib/loofah/html5/safelist.rb +937 -936
  13. data/lib/loofah/html5/scrub.rb +31 -31
  14. data/lib/loofah/metahelpers.rb +10 -6
  15. data/lib/loofah/scrubber.rb +10 -8
  16. data/lib/loofah/scrubbers.rb +52 -43
  17. data/lib/loofah/version.rb +2 -1
  18. data/lib/loofah/xml/document.rb +1 -0
  19. data/lib/loofah/xml/document_fragment.rb +2 -6
  20. data/lib/loofah.rb +119 -43
  21. metadata +15 -103
  22. data/lib/loofah/html/document_fragment.rb +0 -42
  23. data/lib/loofah/instance_methods.rb +0 -133
data/lib/loofah/elements.rb CHANGED
@@ -1,88 +1,90 @@
1
1
  # frozen_string_literal: true
2
+
2
3
  require "set"
3
4
 
4
5
  module Loofah
5
6
  module Elements
6
- STRICT_BLOCK_LEVEL_HTML4 = Set.new %w[
7
- address
8
- blockquote
9
- center
10
- dir
11
- div
12
- dl
13
- fieldset
14
- form
15
- h1
16
- h2
17
- h3
18
- h4
19
- h5
20
- h6
21
- hr
22
- isindex
23
- menu
24
- noframes
25
- noscript
26
- ol
27
- p
28
- pre
29
- table
30
- ul
31
- ]
7
+ STRICT_BLOCK_LEVEL_HTML4 = Set.new([
8
+ "address",
9
+ "blockquote",
10
+ "center",
11
+ "dir",
12
+ "div",
13
+ "dl",
14
+ "fieldset",
15
+ "form",
16
+ "h1",
17
+ "h2",
18
+ "h3",
19
+ "h4",
20
+ "h5",
21
+ "h6",
22
+ "hr",
23
+ "isindex",
24
+ "menu",
25
+ "noframes",
26
+ "noscript",
27
+ "ol",
28
+ "p",
29
+ "pre",
30
+ "table",
31
+ "ul",
32
+ ])
32
33
 
33
34
  # https://developer.mozilla.org/en-US/docs/Web/HTML/Block-level_elements
34
- STRICT_BLOCK_LEVEL_HTML5 = Set.new %w[
35
- address
36
- article
37
- aside
38
- blockquote
39
- canvas
40
- dd
41
- div
42
- dl
43
- dt
44
- fieldset
45
- figcaption
46
- figure
47
- footer
48
- form
49
- h1
50
- h2
51
- h3
52
- h4
53
- h5
54
- h6
55
- header
56
- hgroup
57
- hr
58
- li
59
- main
60
- nav
61
- noscript
62
- ol
63
- output
64
- p
65
- pre
66
- section
67
- table
68
- tfoot
69
- ul
70
- video
71
- ]
35
+ STRICT_BLOCK_LEVEL_HTML5 = Set.new([
36
+ "address",
37
+ "article",
38
+ "aside",
39
+ "blockquote",
40
+ "canvas",
41
+ "dd",
42
+ "div",
43
+ "dl",
44
+ "dt",
45
+ "fieldset",
46
+ "figcaption",
47
+ "figure",
48
+ "footer",
49
+ "form",
50
+ "h1",
51
+ "h2",
52
+ "h3",
53
+ "h4",
54
+ "h5",
55
+ "h6",
56
+ "header",
57
+ "hgroup",
58
+ "hr",
59
+ "li",
60
+ "main",
61
+ "nav",
62
+ "noscript",
63
+ "ol",
64
+ "output",
65
+ "p",
66
+ "pre",
67
+ "section",
68
+ "table",
69
+ "tfoot",
70
+ "ul",
71
+ "video",
72
+ ])
72
73
 
73
74
  # The following elements may also be considered block-level
74
75
  # elements since they may contain block-level elements
75
- LOOSE_BLOCK_LEVEL = Set.new %w[dd
76
- dt
77
- frameset
78
- li
79
- tbody
80
- td
81
- tfoot
82
- th
83
- thead
84
- tr
85
- ]
76
+ LOOSE_BLOCK_LEVEL = Set.new([
77
+ "dd",
78
+ "dt",
79
+ "frameset",
80
+ "li",
81
+ "tbody",
82
+ "td",
83
+ "tfoot",
84
+ "th",
85
+ "thead",
86
+ "tr",
87
+ ])
86
88
 
87
89
  # Elements that aren't block but should generate a newline in #to_text
88
90
  INLINE_LINE_BREAK = Set.new(["br"])
@@ -92,5 +94,5 @@ module Loofah
92
94
  LINEBREAKERS = BLOCK_LEVEL + INLINE_LINE_BREAK
93
95
  end
94
96
 
95
- ::Loofah::MetaHelpers.add_downcased_set_members_to_all_set_constants ::Loofah::Elements
97
+ ::Loofah::MetaHelpers.add_downcased_set_members_to_all_set_constants(::Loofah::Elements)
96
98
  end
data/lib/loofah/helpers.rb CHANGED
@@ -1,43 +1,47 @@
1
1
  # frozen_string_literal: true
2
+
2
3
  module Loofah
3
4
  module Helpers
4
5
  class << self
5
6
  #
6
7
  # A replacement for Rails's built-in +strip_tags+ helper.
7
8
  #
8
- # Loofah::Helpers.strip_tags("<div>Hello <b>there</b></div>") # => "Hello there"
9
+ # Loofah::Helpers.strip_tags("<div>Hello <b>there</b></div>") # => "Hello there"
9
10
  #
10
11
  def strip_tags(string_or_io)
11
- Loofah.fragment(string_or_io).text
12
+ Loofah.html4_fragment(string_or_io).text
12
13
  end
13
14
 
14
15
  #
15
16
  # A replacement for Rails's built-in +sanitize+ helper.
16
17
  #
17
- # Loofah::Helpers.sanitize("<script src=http://ha.ckers.org/xss.js></script>") # => "&lt;script src=\"http://ha.ckers.org/xss.js\"&gt;&lt;/script&gt;"
18
+ # Loofah::Helpers.sanitize("<script src=http://ha.ckers.org/xss.js></script>")
19
+ # # => "&lt;script src=\"http://ha.ckers.org/xss.js\"&gt;&lt;/script&gt;"
18
20
  #
19
21
  def sanitize(string_or_io)
20
- loofah_fragment = Loofah.fragment(string_or_io)
22
+ loofah_fragment = Loofah.html4_fragment(string_or_io)
21
23
  loofah_fragment.scrub!(:strip)
22
- loofah_fragment.xpath("./form").each { |form| form.remove }
24
+ loofah_fragment.xpath("./form").each(&:remove)
23
25
  loofah_fragment.to_s
24
26
  end
25
27
 
26
28
  #
27
29
  # A replacement for Rails's built-in +sanitize_css+ helper.
28
30
  #
29
- # Loofah::Helpers.sanitize_css("display:block;background-image:url(http://www.ragingplatypus.com/i/cam-full.jpg)") # => "display: block;"
31
+ # Loofah::Helpers.sanitize_css("display:block;background-image:url(http://example.com/foo.jpg)")
32
+ # # => "display: block;"
30
33
  #
31
34
  def sanitize_css(style_string)
32
- ::Loofah::HTML5::Scrub.scrub_css style_string
35
+ ::Loofah::HTML5::Scrub.scrub_css(style_string)
33
36
  end
34
37
 
35
38
  #
36
- # A helper to remove extraneous whitespace from text-ified HTML
39
+ # A helper to remove extraneous whitespace from text-ified HTML.
40
+ #
37
41
  # TODO: remove this in a future major-point-release.
38
42
  #
39
43
  def remove_extraneous_whitespace(string)
40
- Loofah.remove_extraneous_whitespace string
44
+ Loofah.remove_extraneous_whitespace(string)
41
45
  end
42
46
  end
43
47
 
@@ -52,7 +56,7 @@ module Loofah
52
56
  end
53
57
 
54
58
  def white_list_sanitizer
55
- warn "warning: white_list_sanitizer is deprecated, please use safe_list_sanitizer instead."
59
+ warn("warning: white_list_sanitizer is deprecated, please use safe_list_sanitizer instead.")
56
60
  safe_list_sanitizer
57
61
  end
58
62
  end
@@ -62,7 +66,8 @@ module Loofah
62
66
  #
63
67
  # To use by default, call this in an application initializer:
64
68
  #
65
- # ActionView::Helpers::SanitizeHelper.full_sanitizer = ::Loofah::Helpers::ActionView::FullSanitizer.new
69
+ # ActionView::Helpers::SanitizeHelper.full_sanitizer = \
70
+ # Loofah::Helpers::ActionView::FullSanitizer.new
66
71
  #
67
72
  # Or, to generally opt-in to Loofah's view sanitizers:
68
73
  #
@@ -70,7 +75,7 @@ module Loofah
70
75
  #
71
76
  class FullSanitizer
72
77
  def sanitize(html, *args)
73
- Loofah::Helpers.strip_tags html
78
+ Loofah::Helpers.strip_tags(html)
74
79
  end
75
80
  end
76
81
 
@@ -79,7 +84,8 @@ module Loofah
79
84
  #
80
85
  # To use by default, call this in an application initializer:
81
86
  #
82
- # ActionView::Helpers::SanitizeHelper.safe_list_sanitizer = ::Loofah::Helpers::ActionView::SafeListSanitizer.new
87
+ # ActionView::Helpers::SanitizeHelper.safe_list_sanitizer = \
88
+ # Loofah::Helpers::ActionView::SafeListSanitizer.new
83
89
  #
84
90
  # Or, to generally opt-in to Loofah's view sanitizers:
85
91
  #
@@ -87,11 +93,11 @@ module Loofah
87
93
  #
88
94
  class SafeListSanitizer
89
95
  def sanitize(html, *args)
90
- Loofah::Helpers.sanitize html
96
+ Loofah::Helpers.sanitize(html)
91
97
  end
92
98
 
93
99
  def sanitize_css(style_string, *args)
94
- Loofah::Helpers.sanitize_css style_string
100
+ Loofah::Helpers.sanitize_css(style_string)
95
101
  end
96
102
  end
97
103
 
data/lib/loofah/{html → html4}/document.rb RENAMED
@@ -1,19 +1,17 @@
1
1
  # frozen_string_literal: true
2
+
2
3
  module Loofah
3
- module HTML # :nodoc:
4
+ module HTML4 # :nodoc:
4
5
  #
5
- # Subclass of Nokogiri::HTML::Document.
6
+ # Subclass of Nokogiri::HTML4::Document.
6
7
  #
7
8
  # See Loofah::ScrubBehavior and Loofah::TextBehavior for additional methods.
8
9
  #
9
- class Document < Nokogiri::HTML::Document
10
+ class Document < Nokogiri::HTML4::Document
10
11
  include Loofah::ScrubBehavior::Node
11
12
  include Loofah::DocumentDecorator
12
13
  include Loofah::TextBehavior
13
-
14
- def serialize_root
15
- at_xpath("/html/body")
16
- end
14
+ include Loofah::HtmlDocumentBehavior
17
15
  end
18
16
  end
19
17
  end
data/lib/loofah/html4/document_fragment.rb ADDED
@@ -0,0 +1,15 @@
1
+ # frozen_string_literal: true
2
+
3
+ module Loofah
4
+ module HTML4 # :nodoc:
5
+ #
6
+ # Subclass of Nokogiri::HTML4::DocumentFragment.
7
+ #
8
+ # See Loofah::ScrubBehavior and Loofah::TextBehavior for additional methods.
9
+ #
10
+ class DocumentFragment < Nokogiri::HTML4::DocumentFragment
11
+ include Loofah::TextBehavior
12
+ include Loofah::HtmlFragmentBehavior
13
+ end
14
+ end
15
+ end
data/lib/loofah/html5/document.rb ADDED
@@ -0,0 +1,17 @@
1
+ # frozen_string_literal: true
2
+
3
+ module Loofah
4
+ module HTML5 # :nodoc:
5
+ #
6
+ # Subclass of Nokogiri::HTML5::Document.
7
+ #
8
+ # See Loofah::ScrubBehavior and Loofah::TextBehavior for additional methods.
9
+ #
10
+ class Document < Nokogiri::HTML5::Document
11
+ include Loofah::ScrubBehavior::Node
12
+ include Loofah::DocumentDecorator
13
+ include Loofah::TextBehavior
14
+ include Loofah::HtmlDocumentBehavior
15
+ end
16
+ end
17
+ end
data/lib/loofah/html5/document_fragment.rb ADDED
@@ -0,0 +1,15 @@
1
+ # frozen_string_literal: true
2
+
3
+ module Loofah
4
+ module HTML5 # :nodoc:
5
+ #
6
+ # Subclass of Nokogiri::HTML5::DocumentFragment.
7
+ #
8
+ # See Loofah::ScrubBehavior and Loofah::TextBehavior for additional methods.
9
+ #
10
+ class DocumentFragment < Nokogiri::HTML5::DocumentFragment
11
+ include Loofah::TextBehavior
12
+ include Loofah::HtmlFragmentBehavior
13
+ end
14
+ end
15
+ end
data/lib/loofah/html5/libxml2_workarounds.rb CHANGED
@@ -1,5 +1,6 @@
1
1
  # coding: utf-8
2
2
  # frozen_string_literal: true
3
+
3
4
  require "set"
4
5
 
5
6
  module Loofah
@@ -16,12 +17,12 @@ module Loofah
16
17
  #
17
18
  # see comments about CVE-2018-8048 within the tests for more information
18
19
  #
19
- BROKEN_ESCAPING_ATTRIBUTES = Set.new %w[
20
- href
21
- action
22
- src
23
- name
24
- ]
20
+ BROKEN_ESCAPING_ATTRIBUTES = Set.new([
21
+ "href",
22
+ "action",
23
+ "src",
24
+ "name",
25
+ ])
25
26
  BROKEN_ESCAPING_ATTRIBUTES_QUALIFYING_TAG = { "name" => "a" }
26
27
  end
27
28
  end