loofah 2.24.1 → 2.25.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 16850a48486ab3e9191ceff0a4fd6d768f82151049332ae162068f6712efccb8
-  data.tar.gz: 6ccd67672b489120796711e08643cbaec9c88648622fc0c3a1ac013e49534b25
+  metadata.gz: 6494f909053083504e78578fee2ee3eea7ea3779f56dcc190f55bf2e0944a534
+  data.tar.gz: c8eb417d4a46efcffb41256ff928d51bd7503f20356450c27853c9c1b1d06539
 SHA512:
-  metadata.gz: b2a4f569f20365f63d548506946736a20ee195a3b4149228489c39f1d6fddf2fe9c774ded5d88d0d3bd547a00110b42ab37d582f8701a01eb2a047070cc2b440
-  data.tar.gz: 2bca5a9c58d363251e8ca5b3803a57b73e51506e9d294e45d69d1fef376b658f31901a359315c6d60974d469047e78307e7cd33005884314e98bf9d2775bd36a
+  metadata.gz: 89fafc68ced95a9dfa715e52a0033804e67e1935fbf0a7b4ec74708d6d1b975b1498507d2eb43cbba481562e9817db5f4d80bd797ba8470099ab7754dc0a8ef6
+  data.tar.gz: 6ef9cec163006ad1d7c995828cb7036ec8b7923611737c3ee2b1a98f69d2cb973847b8a39eb6b198039e258c0d10644bc5c817946524643b12c4d31e37b4e4e3

data/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 2.25.0 / 2025-12-15
+
+* Extract `Loofah::HTML5::Scrub.allowed_uri?` which operates on a string. Previously this logic was coupled to the parsed tree in `.scrub_uri_attribute`. #300 @flavorjones
+* Tightened up how entities and control characters are handled when detecting allowed URIs. #301 @flavorjones
+
+
 ## 2.24.1 / 2025-05-12
 
 ### Ruby support

data/lib/loofah/html5/scrub.rb

@@ -14,6 +14,7 @@ module Loofah
       CSS_WHITESPACE = " "
       CSS_PROPERTY_STRING_WITHOUT_EMBEDDED_QUOTES = /\A(["'])?[^"']+\1\z/
       DATA_ATTRIBUTE_NAME = /\Adata-[\w-]+\z/
+      URI_PROTOCOL_REGEX = /\A[a-z][a-z0-9+\-.]*:/ # RFC 3986
 
       class << self
         def allowed_element?(element_name)
@@ -140,23 +141,33 @@ module Loofah
           attr_node.value = values.join(" ")
         end
 
+        # Returns true if the given URI string is safe, false otherwise.
+        # This method can be used to validate URI attribute values without
+        # requiring a Nokogiri DOM node.
+        def allowed_uri?(uri_string)
+          # this logic lifted nearly verbatim from HTML5 sanitization
+          val_unescaped = CGI.unescapeHTML(uri_string.gsub(CONTROL_CHARACTERS, "")).gsub("&colon;", ":").downcase
+          if URI_PROTOCOL_REGEX.match?(val_unescaped)
+            protocol = val_unescaped.split(SafeList::PROTOCOL_SEPARATOR)[0]
+            return false unless SafeList::ALLOWED_PROTOCOLS.include?(protocol)
+
+            if protocol == "data"
+              # permit only allowed data mediatypes
+              mediatype = val_unescaped.split(SafeList::PROTOCOL_SEPARATOR)[1]
+              mediatype, _ = mediatype.split(/[;,]/)[0..1] if mediatype
+              return false if mediatype && !SafeList::ALLOWED_URI_DATA_MEDIATYPES.include?(mediatype)
+            end
+          end
+          true
+        end
+
         def scrub_uri_attribute(attr_node)
-          # this block lifted nearly verbatim from HTML5 sanitization
-          val_unescaped = CGI.unescapeHTML(attr_node.value).gsub(CONTROL_CHARACTERS, "").downcase
-          if val_unescaped =~ /^[a-z0-9][-+.a-z0-9]*:/ &&
-              !SafeList::ALLOWED_PROTOCOLS.include?(val_unescaped.split(SafeList::PROTOCOL_SEPARATOR)[0])
+          if allowed_uri?(attr_node.value)
+            false
+          else
             attr_node.remove
-            return true
-          elsif val_unescaped.split(SafeList::PROTOCOL_SEPARATOR)[0] == "data"
-            # permit only allowed data mediatypes
-            mediatype = val_unescaped.split(SafeList::PROTOCOL_SEPARATOR)[1]
-            mediatype, _ = mediatype.split(";")[0..1] if mediatype
-            if mediatype && !SafeList::ALLOWED_URI_DATA_MEDIATYPES.include?(mediatype)
-              attr_node.remove
-              return true
-            end
+            true
           end
-          false
         end
 
         #

data/lib/loofah/version.rb

@@ -2,5 +2,5 @@
 
 module Loofah
   # The version of Loofah you are using
-  VERSION = "2.24.1"
+  VERSION = "2.25.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: loofah
 version: !ruby/object:Gem::Version
-  version: 2.24.1
+  version: 2.25.0
 platform: ruby
 authors:
 - Mike Dalessio
@@ -96,7 +96,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.8
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Loofah is a general library for manipulating and transforming HTML/XML documents
   and fragments, built on top of Nokogiri.