loofah 2.24.0 → 2.25.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e003942bbd3be7a5d576d4b48002964664c844b3aa66aa24a6b55e536ecd0662
-  data.tar.gz: f959fadbc762a26167cc46563d92e8be0d085372467b774dcbb3f18dabc6d8c8
+  metadata.gz: 6494f909053083504e78578fee2ee3eea7ea3779f56dcc190f55bf2e0944a534
+  data.tar.gz: c8eb417d4a46efcffb41256ff928d51bd7503f20356450c27853c9c1b1d06539
 SHA512:
-  metadata.gz: 254caef30657885b063ae85c0ac01ba386aa387571a7f5587dfee57f4e803047f56579d11425bb01a6aa50209b3b1755d7e2c613412f4783f3ce5e6d4fd70b70
-  data.tar.gz: 4a531c380c0ce45a9c3e9ea1a87c08da487331bf56db20e6bf42b903ca1e1f3e043f72ddfc1ad82076fffcad6bd08055131952b62c40f0b6067fcac3a552cfd7
+  metadata.gz: 89fafc68ced95a9dfa715e52a0033804e67e1935fbf0a7b4ec74708d6d1b975b1498507d2eb43cbba481562e9817db5f4d80bd797ba8470099ab7754dc0a8ef6
+  data.tar.gz: 6ef9cec163006ad1d7c995828cb7036ec8b7923611737c3ee2b1a98f69d2cb973847b8a39eb6b198039e258c0d10644bc5c817946524643b12c4d31e37b4e4e3

data/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 2.25.0 / 2025-12-15
+
+* Extract `Loofah::HTML5::Scrub.allowed_uri?` which operates on a string. Previously this logic was coupled to the parsed tree in `.scrub_uri_attribute`. #300 @flavorjones
+* Tightened up how entities and control characters are handled when detecting allowed URIs. #301 @flavorjones
+
+
+## 2.24.1 / 2025-05-12
+
+### Ruby support
+
+* Import only what's needed from `cgi` for support for Ruby 3.5 #296 @Earlopain
+
+
 ## 2.24.0 / 2024-12-24
 
 ### Added

data/lib/loofah/html5/scrub.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
-require "cgi"
+require "cgi/escape"
+require "cgi/util" if RUBY_VERSION < "3.5"
 require "crass"
 
 module Loofah
@@ -13,6 +14,7 @@ module Loofah
       CSS_WHITESPACE = " "
       CSS_PROPERTY_STRING_WITHOUT_EMBEDDED_QUOTES = /\A(["'])?[^"']+\1\z/
       DATA_ATTRIBUTE_NAME = /\Adata-[\w-]+\z/
+      URI_PROTOCOL_REGEX = /\A[a-z][a-z0-9+\-.]*:/ # RFC 3986
 
       class << self
         def allowed_element?(element_name)
@@ -139,23 +141,33 @@ module Loofah
           attr_node.value = values.join(" ")
         end
 
+        # Returns true if the given URI string is safe, false otherwise.
+        # This method can be used to validate URI attribute values without
+        # requiring a Nokogiri DOM node.
+        def allowed_uri?(uri_string)
+          # this logic lifted nearly verbatim from HTML5 sanitization
+          val_unescaped = CGI.unescapeHTML(uri_string.gsub(CONTROL_CHARACTERS, "")).gsub("&colon;", ":").downcase
+          if URI_PROTOCOL_REGEX.match?(val_unescaped)
+            protocol = val_unescaped.split(SafeList::PROTOCOL_SEPARATOR)[0]
+            return false unless SafeList::ALLOWED_PROTOCOLS.include?(protocol)
+
+            if protocol == "data"
+              # permit only allowed data mediatypes
+              mediatype = val_unescaped.split(SafeList::PROTOCOL_SEPARATOR)[1]
+              mediatype, _ = mediatype.split(/[;,]/)[0..1] if mediatype
+              return false if mediatype && !SafeList::ALLOWED_URI_DATA_MEDIATYPES.include?(mediatype)
+            end
+          end
+          true
+        end
+
         def scrub_uri_attribute(attr_node)
-          # this block lifted nearly verbatim from HTML5 sanitization
-          val_unescaped = CGI.unescapeHTML(attr_node.value).gsub(CONTROL_CHARACTERS, "").downcase
-          if val_unescaped =~ /^[a-z0-9][-+.a-z0-9]*:/ &&
-              !SafeList::ALLOWED_PROTOCOLS.include?(val_unescaped.split(SafeList::PROTOCOL_SEPARATOR)[0])
+          if allowed_uri?(attr_node.value)
+            false
+          else
             attr_node.remove
-            return true
-          elsif val_unescaped.split(SafeList::PROTOCOL_SEPARATOR)[0] == "data"
-            # permit only allowed data mediatypes
-            mediatype = val_unescaped.split(SafeList::PROTOCOL_SEPARATOR)[1]
-            mediatype, _ = mediatype.split(";")[0..1] if mediatype
-            if mediatype && !SafeList::ALLOWED_URI_DATA_MEDIATYPES.include?(mediatype)
-              attr_node.remove
-              return true
-            end
+            true
           end
-          false
         end
 
         #

data/lib/loofah/version.rb

@@ -2,5 +2,5 @@
 
 module Loofah
   # The version of Loofah you are using
-  VERSION = "2.24.0"
+  VERSION = "2.25.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: loofah
 version: !ruby/object:Gem::Version
-  version: 2.24.0
+  version: 2.25.0
 platform: ruby
 authors:
 - Mike Dalessio
 - Bryan Helmkamp
 bindir: bin
 cert_chain: []
-date: 2025-01-01 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: crass
@@ -96,7 +96,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Loofah is a general library for manipulating and transforming HTML/XML documents
   and fragments, built on top of Nokogiri.