loofah 2.23.1 → 2.25.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9817bf69ee1ad2d7e93edad53209db1347c9ec360076520532cdf60ad158a8f6
-  data.tar.gz: 3381ac563f4b70c4ccca49301ba369f22716da405dd7641af535209e6817258b
+  metadata.gz: 4a721138b6b152897d72edddfb80cdb0f35200c39a8f37a2024b503e6cfacc95
+  data.tar.gz: b342436a5a4e544b504d3e4234935ecd09dd87eddb55be893a1105cfd6a627f6
 SHA512:
-  metadata.gz: 482eeac3b61aba7e1b517aaab8a6d010ae44bd5b99b749cdabb5381936b4b9e8f97c62d99a60bdf1fbf64c2dba8c33062b676083f4e82d7e07f33e7666fe148f
-  data.tar.gz: 69234fb9c4d7d55eb63a18008d035df1117bb6ea10f0f15b57bacc5152103fc0830a53a8d98a63e817360332975e257dbeda223ed43e42813724ce30a3b8d7e6
+  metadata.gz: e8ffd17d4b47d19bbff8070fcfe0d111530e7f146abc3501deaed1eb3198481f5ae16ee597e2a0d033eeea8bda27a038d1832c7237e24067a36e724e037e06a9
+  data.tar.gz: 71f741d1fbcf65fc137b25906c183cf767c091b203210e06d59dbb8e209c12274c77415b03406b021eb16dd149e2f9822f70124cec0947494f955d3fd1e458ee

data/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## 2.25.2 / 2026-07-15
+
+### Security
+
+* Ensure `Loofah::HTML5::Scrub.allowed_uri?` recognizes numeric character references without semicolons (e.g. `javascript&#58alert(1)`), which browsers decode and execute, and rejects schemes split by them. See [GHSA-5qhf-9phg-95m2](https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2). @flavorjones
+* Ensure `Loofah::HTML5::Scrub.allowed_uri?` recognizes the named character references `	` and `
`, which `CGI.unescapeHTML` does not decode and browsers strip from URIs, and rejects schemes split by them (e.g. `java	script:alert(1)`). See [GHSA-8whx-365g-h9vv](https://github.com/flavorjones/loofah/security/advisories/GHSA-8whx-365g-h9vv). @flavorjones
+* Ensure that both `href` and `xlink:href` attributes on SVG elements like `use` are restricted to local (same-document) references. Previously only `xlink:href` was restricted, allowing the SVG 2 `href` attribute to reference external documents. See [GHSA-9wjq-cp2p-hrgf](https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf). @flavorjones
+
+### Improved
+
+* Harden `data:` URI mediatype parsing in `Loofah::HTML5::Scrub.allowed_uri?`. The mediatype is now parsed following the [WHATWG data: URL spec](https://fetch.spec.whatwg.org/#data-urls) and [RFC 2397](https://www.rfc-editor.org/rfc/rfc2397) instead of simply being split on a colon. A `data:` URI with an omitted or malformed mediatype is now treated as `text/plain` and allowed, and one without the required comma is now rejected. #305 @flavorjones
+* Remove `feed` from the default set of allowed protocols. The [feed URI scheme](https://en.wikipedia.org/wiki/Feed_URI_scheme) was never accepted as a standard protocol, and no major browser supports it. Removing it reduces the attack surface particularly for non-browser contexts. #304 @flavorjones
+* Remove a vestigial `&#x70` alternative from `Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR`. This appears to be an ancient typo dating back to pre-extraction Rails circa 2007. #305 @flavorjones
+
+
+## 2.25.1 / 2026-03-17
+
+* Ensure `Loofah::HTML5::Scrub.allowed_uri?` recognizes unescaped whitespace entities and rejects schemas containing them. See [GHSA-46fp-8f5p-pf2m](https://github.com/flavorjones/loofah/security/advisories/GHSA-46fp-8f5p-pf2m). #302 @flavorjones
+
+## 2.25.0 / 2025-12-15
+
+* Extract `Loofah::HTML5::Scrub.allowed_uri?` which operates on a string. Previously this logic was coupled to the parsed tree in `.scrub_uri_attribute`. #300 @flavorjones
+* Tightened up how entities and control characters are handled when detecting allowed URIs. #301 @flavorjones
+
+
+## 2.24.1 / 2025-05-12
+
+### Ruby support
+
+* Import only what's needed from `cgi` for support for Ruby 3.5 #296 @Earlopain
+
+
+## 2.24.0 / 2024-12-24
+
+### Added
+
+* Built-in scrubber `:double_breakpoint` which sees `<br><br>` and wraps the surrounding content in `<p>` tags. #279, #284 @josecolella @torihuang
+
+### Improved
+
+* Built-in scrubber `:targetblank` now skips `a` tags whose `href` attribute is an anchor link. Previously, all `a` tags were modified to have `target='_blank'`. #291 @fnando
+
+
 ## 2.23.1 / 2024-10-25
 
 ### Added

data/README.md

@@ -31,6 +31,8 @@ Active Record extensions for HTML sanitization are available in the [`loofah-act
   * Add the _nofollow_ attribute to all hyperlinks.
   * Add the _target=\_blank_ attribute to all hyperlinks.
   * Remove _unprintable_ characters from text nodes.
+* Some specialized HTML transformations are also built-in:
+  * Where `<br><br>` exists inside a `p` tag, close the `p` and open a new one.
 * Format markup as plain text, with (or without) sensible whitespace handling around block elements.
 * Replace Rails's `strip_tags` and `sanitize` view helper methods.
 
@@ -227,14 +229,15 @@ doc.scrub!(:whitewash)   #  removes unknown/unsafe/namespaced tags and their chi
                          #          and strips all node attributes
 ```
 
-Loofah also comes with some common transformation tasks:
+Loofah also comes with built-in scrubers for some common transformation tasks:
 
 ``` ruby
-doc.scrub!(:nofollow)    #  adds rel="nofollow" attribute to links
-doc.scrub!(:noopener)    #  adds rel="noopener" attribute to links
-doc.scrub!(:noreferrer)  #  adds rel="noreferrer" attribute to links
-doc.scrub!(:unprintable) #  removes unprintable characters from text nodes
-doc.scrub!(:targetblank) #     adds target="_blank" attribute to links
+doc.scrub!(:nofollow)          # adds rel="nofollow" attribute to links
+doc.scrub!(:noopener)          # adds rel="noopener" attribute to links
+doc.scrub!(:noreferrer)        # adds rel="noreferrer" attribute to links
+doc.scrub!(:unprintable)       # removes unprintable characters from text nodes
+doc.scrub!(:targetblank)       # adds target="_blank" attribute to links
+doc.scrub!(:double_breakpoint) # where `<br><br>` appears in a `p` tag, close the `p` and open a new one
 ```
 
 See `Loofah::Scrubbers` for more details and example usage.

data/SECURITY.md

@@ -2,7 +2,7 @@
 
 The Loofah core contributors take security very seriously and investigate all reported vulnerabilities.
 
-If you would like to report a vulnerablity or have a security concern regarding Loofah, please [report it via HackerOne](https://hackerone.com/loofah/reports/new).
+If you would like to report a vulnerablity or have a security concern regarding Loofah, please [report it via Github](https://github.com/flavorjones/loofah/security).
 
 Your report will be acknowledged within 24 hours, and you'll receive a more detailed response within 72 hours indicating next steps in handling your report.
 

data/lib/loofah/html5/safelist.rb

@@ -605,6 +605,11 @@ module Loofah
         "stroke",
       ])
 
+      SVG_HREF_ATTRIBUTES = Set.new([
+        "xlink:href",
+        "href",
+      ])
+
       SVG_ALLOW_LOCAL_HREF = Set.new([
         "altGlyph",
         "animate",
@@ -978,7 +983,7 @@ module Loofah
         "stroke-opacity",
       ])
 
-      PROTOCOL_SEPARATOR = /:|(&#0*58)|(&#x70)|(&#x0*3a)|(%|%)3A/i
+      PROTOCOL_SEPARATOR = /:|(&#0*58)|(&#x0*3a)|(%|%)3A/i
 
       ACCEPTABLE_PROTOCOLS = Set.new([
         "afs",
@@ -987,7 +992,6 @@ module Loofah
         "data",
         "ed2k",
         "fax",
-        "feed",
         "ftp",
         "gopher",
         "http",

data/lib/loofah/html5/scrub.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
-require "cgi"
+require "cgi/escape"
+require "cgi/util" if RUBY_VERSION < "3.5"
 require "crass"
 
 module Loofah
@@ -14,6 +15,43 @@ module Loofah
       CSS_PROPERTY_STRING_WITHOUT_EMBEDDED_QUOTES = /\A(["'])?[^"']+\1\z/
       DATA_ATTRIBUTE_NAME = /\Adata-[\w-]+\z/
 
+      # Decimal (`&#58`) or hexadecimal (`&#x3a`) form, with or without the trailing semicolon that
+      # CGI.unescapeHTML requires but browsers do not.
+      NUMERIC_CHARACTER_REFERENCE = /&#(x[0-9a-f]+|[0-9]+);?/i
+
+      # A scheme (RFC 3986) followed by a protocol separator. The separator must recognize the same
+      # encoded-colon forms as PROTOCOL_SEPARATOR, otherwise a scheme split by an encoded colon (for
+      # example "javascript&#58alert(1)") would not be recognized as having a scheme and would skip
+      # protocol validation.
+      URI_PROTOCOL_REGEX = /\A[a-z][a-z0-9+\-.]*#{SafeList::PROTOCOL_SEPARATOR}/
+
+      # Matches a valid MIME type "essence" (type "/" subtype, no parameters), used to
+      # decide whether a data: URI mediatype is well-formed; a non-match is not a valid
+      # MIME type, which the data: URL processor treats as text/plain. Specs:
+      #
+      #   https://mimesniff.spec.whatwg.org/#valid-mime-type
+      #   https://mimesniff.spec.whatwg.org/#mime-type-essence
+      #   https://mimesniff.spec.whatwg.org/#http-token-code-point
+      #
+      # The character class below is the HTTP token set (tchar) from RFC 9110 section
+      # 5.6.2, https://www.rfc-editor.org/rfc/rfc9110#name-tokens :
+      #
+      #   tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." / "^"
+      #         / "_" / "`" / "|" / "~" / DIGIT / ALPHA
+      #
+      # ALPHA is written a-z, not a-zA-Z, because allowed_uri? downcases the input first.
+      DATA_URI_MEDIATYPE = %r{
+        \A
+        [a-z0-9!\#$%&'*+\-.^_`|~]+   # type:    1*tchar
+        /                            # "/" is not a tchar, so it is the sole delimiter
+        [a-z0-9!\#$%&'*+\-.^_`|~]+   # subtype: 1*tchar
+        \z
+      }x
+
+      # HTML5 named character references for whitespace that browsers strip from
+      # URIs. CGI.unescapeHTML does not decode these, so they are handled explicitly.
+      WHITESPACE_CHARACTER_REFERENCES = /&(Tab|NewLine);/
+
       class << self
         def allowed_element?(element_name)
           ::Loofah::HTML5::SafeList::ALLOWED_ELEMENTS_WITH_LIBXML2.include?(element_name)
@@ -46,7 +84,7 @@ module Loofah
             end
 
             next unless SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) &&
-              attr_name == "xlink:href" &&
+              SafeList::SVG_HREF_ATTRIBUTES.include?(attr_name) &&
               attr_node.value =~ /^\s*[^#\s].*/m
 
             attr_node.remove
@@ -139,23 +177,59 @@ module Loofah
           attr_node.value = values.join(" ")
         end
 
+        # Returns true if the given URI string is safe, false otherwise. This method can be used to
+        # validate URI attribute values without requiring a Nokogiri DOM node.
+        def allowed_uri?(uri_string)
+          # CGI.unescapeHTML decodes numeric references only when they carry a trailing semicolon, so
+          # also decode the semicolon-less ones, which browsers still decode and execute. Normalizing
+          # more aggressively than a browser only rejects more, which is safe. Control characters are
+          # stripped both before and after decoding, since decoding can produce them. That strip must
+          # precede WHITESPACE_CHARACTER_REFERENCES: removing a control character can reveal a named
+          # whitespace reference.
+          uri_string = decode_numeric_character_references(CGI.unescapeHTML(uri_string.gsub(CONTROL_CHARACTERS, "")))
+          uri_string.gsub!(CONTROL_CHARACTERS, "")
+          uri_string.gsub!(WHITESPACE_CHARACTER_REFERENCES, "")
+          uri_string.gsub!("&colon;", ":")
+          uri_string.downcase!
+          if URI_PROTOCOL_REGEX.match?(uri_string)
+            protocol = uri_string.split(SafeList::PROTOCOL_SEPARATOR)[0]
+            return false unless SafeList::ALLOWED_PROTOCOLS.include?(protocol)
+
+            if protocol == "data"
+              # permit only allowed data mediatypes
+              return false unless SafeList::ALLOWED_URI_DATA_MEDIATYPES.include?(data_uri_mediatype(uri_string))
+            end
+          end
+          true
+        end
+
+        def decode_numeric_character_references(string)
+          string.gsub(NUMERIC_CHARACTER_REFERENCE) do |reference|
+            digits = ::Regexp.last_match(1)
+            hexadecimal = digits.start_with?("x", "X")
+            digits = digits[1..-1] if hexadecimal
+            significant_digits = digits.sub(/\A0+/, "")
+
+            # The largest code point is U+10FFFF: 7 decimal or 6 hexadecimal significant digits.
+            # Anything longer is out of range; skip it without building a large integer from it.
+            next reference if significant_digits.length > (hexadecimal ? 6 : 7)
+
+            codepoint = significant_digits.to_i(hexadecimal ? 16 : 10)
+            begin
+              codepoint.chr(Encoding::UTF_8)
+            rescue RangeError
+              reference
+            end
+          end
+        end
+
         def scrub_uri_attribute(attr_node)
-          # this block lifted nearly verbatim from HTML5 sanitization
-          val_unescaped = CGI.unescapeHTML(attr_node.value).gsub(CONTROL_CHARACTERS, "").downcase
-          if val_unescaped =~ /^[a-z0-9][-+.a-z0-9]*:/ &&
-              !SafeList::ALLOWED_PROTOCOLS.include?(val_unescaped.split(SafeList::PROTOCOL_SEPARATOR)[0])
+          if allowed_uri?(attr_node.value)
+            false
+          else
             attr_node.remove
-            return true
-          elsif val_unescaped.split(SafeList::PROTOCOL_SEPARATOR)[0] == "data"
-            # permit only allowed data mediatypes
-            mediatype = val_unescaped.split(SafeList::PROTOCOL_SEPARATOR)[1]
-            mediatype, _ = mediatype.split(";")[0..1] if mediatype
-            if mediatype && !SafeList::ALLOWED_URI_DATA_MEDIATYPES.include?(mediatype)
-              attr_node.remove
-              return true
-            end
+            true
           end
-          false
         end
 
         #
@@ -223,6 +297,20 @@ module Loofah
             string
           end
         end
+
+        private
+
+        # Returns the mediatype of a data: URI per RFC 2397, or nil when the
+        # required comma is absent. allowed_uri? entity-decodes, downcases, and
+        # strips control characters before calling this. An omitted or malformed
+        # mediatype resolves to "text/plain", matching the WHATWG data: URL processor.
+        def data_uri_mediatype(uri_string)
+          metadata, comma, _data = uri_string.delete_prefix("data:").partition(",")
+          return nil if comma.empty?
+
+          mediatype = metadata.delete_suffix(";base64").split(";", 2).first.to_s.strip
+          mediatype.match?(DATA_URI_MEDIATYPE) ? mediatype : "text/plain"
+        end
       end
     end
   end

data/lib/loofah/scrubbers.rb

@@ -251,7 +251,9 @@ module Loofah
       def scrub(node)
         return CONTINUE unless (node.type == Nokogiri::XML::Node::ELEMENT_NODE) && (node.name == "a")
 
-        node.set_attribute("target", "_blank")
+        href = node["href"]
+
+        node.set_attribute("target", "_blank") if href && href[0] != "#"
 
         STOP
       end
@@ -348,6 +350,57 @@ module Loofah
       end
     end
 
+    #
+    #  === scrub!(:double_breakpoint)
+    #
+    #  +:double_breakpoint+ replaces double-break tags with closing/opening paragraph tags.
+    #
+    #     markup = "<p>Some text here in a logical paragraph.<br><br>Some more text, apparently a second paragraph.</p>"
+    #     Loofah.html5_fragment(markup).scrub!(:double_breakpoint)
+    #     => "<p>Some text here in a logical paragraph.</p><p>Some more text, apparently a second paragraph.</p>"
+    #
+    class DoubleBreakpoint < Scrubber
+      def initialize # rubocop:disable Lint/MissingSuper
+        @direction = :top_down
+      end
+
+      def scrub(node)
+        return CONTINUE unless (node.type == Nokogiri::XML::Node::ELEMENT_NODE) && (node.name == "p")
+
+        paragraph_with_break_point_nodes = node.xpath("//p[br[following-sibling::br]]")
+
+        paragraph_with_break_point_nodes.each do |paragraph_node|
+          new_paragraph = paragraph_node.add_previous_sibling("<p>").first
+
+          paragraph_node.children.each do |child|
+            remove_blank_text_nodes(child)
+          end
+
+          paragraph_node.children.each do |child|
+            # already unlinked
+            next if child.parent.nil?
+
+            if child.name == "br" && child.next_sibling.name == "br"
+              new_paragraph = paragraph_node.add_previous_sibling("<p>").first
+              child.next_sibling.unlink
+              child.unlink
+            else
+              child.parent = new_paragraph
+            end
+          end
+
+          paragraph_node.unlink
+        end
+
+        CONTINUE
+      end
+
+      private
+
+      def remove_blank_text_nodes(node)
+        node.unlink if node.text? && node.blank?
+      end
+    end
     #
     #  A hash that maps a symbol (like +:prune+) to the appropriate Scrubber (Loofah::Scrubbers::Prune).
     #
@@ -362,6 +415,7 @@ module Loofah
       targetblank: TargetBlank,
       newline_block_elements: NewlineBlockElements,
       unprintable: Unprintable,
+      double_breakpoint: DoubleBreakpoint,
     }
 
     class << self

data/lib/loofah/version.rb

@@ -2,5 +2,5 @@
 
 module Loofah
   # The version of Loofah you are using
-  VERSION = "2.23.1"
+  VERSION = "2.25.2"
 end

metadata

@@ -1,15 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: loofah
 version: !ruby/object:Gem::Version
-  version: 2.23.1
+  version: 2.25.2
 platform: ruby
 authors:
 - Mike Dalessio
 - Bryan Helmkamp
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-10-25 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: crass
@@ -82,7 +81,7 @@ metadata:
   bug_tracker_uri: https://github.com/flavorjones/loofah/issues
   changelog_uri: https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md
   documentation_uri: https://www.rubydoc.info/gems/loofah/
-post_install_message:
+  funding_uri: https://github.com/sponsors/flavorjones
 rdoc_options: []
 require_paths:
 - lib
@@ -97,8 +96,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.22
-signing_key:
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Loofah is a general library for manipulating and transforming HTML/XML documents
   and fragments, built on top of Nokogiri.