loofah 2.24.1 → 2.25.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 16850a48486ab3e9191ceff0a4fd6d768f82151049332ae162068f6712efccb8
-  data.tar.gz: 6ccd67672b489120796711e08643cbaec9c88648622fc0c3a1ac013e49534b25
+  metadata.gz: d07f9d310067f14d41ee4661fd3cd831de5af3d1c60bbfc949ba57219636ee9f
+  data.tar.gz: 0ea8df2bfb5396bcbcbec9b1ba3c7d1d0e852739be595efc4e27826226246eac
 SHA512:
-  metadata.gz: b2a4f569f20365f63d548506946736a20ee195a3b4149228489c39f1d6fddf2fe9c774ded5d88d0d3bd547a00110b42ab37d582f8701a01eb2a047070cc2b440
-  data.tar.gz: 2bca5a9c58d363251e8ca5b3803a57b73e51506e9d294e45d69d1fef376b658f31901a359315c6d60974d469047e78307e7cd33005884314e98bf9d2775bd36a
+  metadata.gz: 0562da17634578281969ad6ebab59608ca78048d46a0ef298a5f767e32a0c66d11d74c1edd89a9710c80b2a27cc745af434890f8a79f055748e213642084f0c2
+  data.tar.gz: a39abf331334da243c9b608ab0a41fe5c08c0a41622433c86a3013a8aaaa204458afc7b99fe7d9042471f467433c6f4101f8f09adaddfb80fe091bf2541b6917

data/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 2.25.1 / 2026-03-17
+
+* Ensure `Loofah::HTML5::Scrub.allowed_uri?` recognizes unescaped whitespace entities and rejects schemas containing them. See [GHSA-46fp-8f5p-pf2m](https://github.com/flavorjones/loofah/security/advisories/GHSA-46fp-8f5p-pf2m). #302 @flavorjones
+
+## 2.25.0 / 2025-12-15
+
+* Extract `Loofah::HTML5::Scrub.allowed_uri?` which operates on a string. Previously this logic was coupled to the parsed tree in `.scrub_uri_attribute`. #300 @flavorjones
+* Tightened up how entities and control characters are handled when detecting allowed URIs. #301 @flavorjones
+
+
 ## 2.24.1 / 2025-05-12
 
 ### Ruby support

data/SECURITY.md

@@ -2,7 +2,7 @@
 
 The Loofah core contributors take security very seriously and investigate all reported vulnerabilities.
 
-If you would like to report a vulnerablity or have a security concern regarding Loofah, please [report it via HackerOne](https://hackerone.com/loofah/reports/new).
+If you would like to report a vulnerablity or have a security concern regarding Loofah, please [report it via Github](https://github.com/flavorjones/loofah/security).
 
 Your report will be acknowledged within 24 hours, and you'll receive a more detailed response within 72 hours indicating next steps in handling your report.
 

data/lib/loofah/html5/scrub.rb

@@ -14,6 +14,7 @@ module Loofah
       CSS_WHITESPACE = " "
       CSS_PROPERTY_STRING_WITHOUT_EMBEDDED_QUOTES = /\A(["'])?[^"']+\1\z/
       DATA_ATTRIBUTE_NAME = /\Adata-[\w-]+\z/
+      URI_PROTOCOL_REGEX = /\A[a-z][a-z0-9+\-.]*:/ # RFC 3986
 
       class << self
         def allowed_element?(element_name)
@@ -140,23 +141,36 @@ module Loofah
           attr_node.value = values.join(" ")
         end
 
+        # Returns true if the given URI string is safe, false otherwise.
+        # This method can be used to validate URI attribute values without
+        # requiring a Nokogiri DOM node.
+        def allowed_uri?(uri_string)
+          # Replace control characters both before and after unescaping.
+          uri_string = CGI.unescapeHTML(uri_string.gsub(CONTROL_CHARACTERS, ""))
+            .gsub(CONTROL_CHARACTERS, "")
+            .gsub("&colon;", ":")
+            .downcase
+          if URI_PROTOCOL_REGEX.match?(uri_string)
+            protocol = uri_string.split(SafeList::PROTOCOL_SEPARATOR)[0]
+            return false unless SafeList::ALLOWED_PROTOCOLS.include?(protocol)
+
+            if protocol == "data"
+              # permit only allowed data mediatypes
+              mediatype = uri_string.split(SafeList::PROTOCOL_SEPARATOR)[1]
+              mediatype, _ = mediatype.split(/[;,]/)[0..1] if mediatype
+              return false if mediatype && !SafeList::ALLOWED_URI_DATA_MEDIATYPES.include?(mediatype)
+            end
+          end
+          true
+        end
+
         def scrub_uri_attribute(attr_node)
-          # this block lifted nearly verbatim from HTML5 sanitization
-          val_unescaped = CGI.unescapeHTML(attr_node.value).gsub(CONTROL_CHARACTERS, "").downcase
-          if val_unescaped =~ /^[a-z0-9][-+.a-z0-9]*:/ &&
-              !SafeList::ALLOWED_PROTOCOLS.include?(val_unescaped.split(SafeList::PROTOCOL_SEPARATOR)[0])
+          if allowed_uri?(attr_node.value)
+            false
+          else
             attr_node.remove
-            return true
-          elsif val_unescaped.split(SafeList::PROTOCOL_SEPARATOR)[0] == "data"
-            # permit only allowed data mediatypes
-            mediatype = val_unescaped.split(SafeList::PROTOCOL_SEPARATOR)[1]
-            mediatype, _ = mediatype.split(";")[0..1] if mediatype
-            if mediatype && !SafeList::ALLOWED_URI_DATA_MEDIATYPES.include?(mediatype)
-              attr_node.remove
-              return true
-            end
+            true
           end
-          false
         end
 
         #

data/lib/loofah/version.rb

@@ -2,5 +2,5 @@
 
 module Loofah
   # The version of Loofah you are using
-  VERSION = "2.24.1"
+  VERSION = "2.25.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: loofah
 version: !ruby/object:Gem::Version
-  version: 2.24.1
+  version: 2.25.1
 platform: ruby
 authors:
 - Mike Dalessio
@@ -96,7 +96,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.8
+rubygems_version: 4.0.3
 specification_version: 4
 summary: Loofah is a general library for manipulating and transforming HTML/XML documents
   and fragments, built on top of Nokogiri.