loofah 2.25.1 → 2.25.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d07f9d310067f14d41ee4661fd3cd831de5af3d1c60bbfc949ba57219636ee9f
-  data.tar.gz: 0ea8df2bfb5396bcbcbec9b1ba3c7d1d0e852739be595efc4e27826226246eac
+  metadata.gz: ab3a16b00807f63098be8c67dbd785edea496daf292dc063299d84d25ae56133
+  data.tar.gz: d9ba643579b0190c1f66aa4cdfeb79ec5ade635032172c805be58bd0d67fc5fc
 SHA512:
-  metadata.gz: 0562da17634578281969ad6ebab59608ca78048d46a0ef298a5f767e32a0c66d11d74c1edd89a9710c80b2a27cc745af434890f8a79f055748e213642084f0c2
-  data.tar.gz: a39abf331334da243c9b608ab0a41fe5c08c0a41622433c86a3013a8aaaa204458afc7b99fe7d9042471f467433c6f4101f8f09adaddfb80fe091bf2541b6917
+  metadata.gz: b9b7dc5b9f7e3c0ac798a7e70f6257bb65827baadae3861d17cf0a24e1bf5cab48c909cd463ecc51ae5ba59acd91ca73c004faa7d1c489bbd0e91b7245132c79
+  data.tar.gz: 7e17e0f6e9cec7edd72c0f254aa406e510531297af9acc10714cd7277ec1641d48ab369a0bfeeef585104c314a79cdfb795f112e84591a5cf81f4cb8eac46486

data/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 2.25.3 / 2026-11-01
+
+### Security
+
+* Ensure `Loofah::HTML5::Scrub.allowed_uri?` rejects schemes split by a numeric character reference without a semicolon that ends at a character `allowed_uri?` strips (e.g. `javascript&#x3a alert(1)`) or at another character reference (e.g. `javascript&#x3aalert(1)`). Character references are now decoded before anything is stripped, as browsers do. See [GHSA-p9wj-w8xq-vjx6](https://github.com/flavorjones/loofah/security/advisories/GHSA-p9wj-w8xq-vjx6). @flavorjones
+* Ensure `Loofah::HTML5::Scrub.allowed_uri?` recognizes the named character reference `&sol;`, which `CGI.unescapeHTML` does not decode and browsers read as `/`, and rejects `data:` URIs that disguise a disallowed mediatype with it (e.g. `data:text&sol;html,<script>alert(1)</script>`). Previously that mediatype was treated as malformed and fell back to the allowed `text/plain`. Only v2.25.2 is affected. See [GHSA-jcff-cj73-4w4f](https://github.com/flavorjones/loofah/security/advisories/GHSA-jcff-cj73-4w4f). @flavorjones
+* Ensure `Loofah::HTML5::Scrub.scrub_css` does not decode CSS escapes in identifiers. Previously, escaped parentheses (e.g. `url\28 http://example.com/\29`) came out as a live `url()`, which could make the viewer's browser fetch an attacker-chosen URL. See [GHSA-m3x9-938q-5767](https://github.com/flavorjones/loofah/security/advisories/GHSA-m3x9-938q-5767). @flavorjones
+* Ensure that `href` and `xlink:href` on SVG `textPath` and `mpath` elements are restricted to local (same-document) references. Previously `SVG_ALLOW_LOCAL_HREF` spelled `textPath` in lowercase, which never matched the name the HTML5 parser assigns inside `<svg>`, and omitted `mpath` entirely. See [GHSA-345x-3rq2-jfrm](https://github.com/flavorjones/loofah/security/advisories/GHSA-345x-3rq2-jfrm). @flavorjones
+* Fix quadratic-time scrubbing of the `href` and `xlink:href` attributes of SVG elements. Only Ruby 3.1 and earlier are affected, because Ruby 3.2 introduced linear-time regexp matching. See [GHSA-mf2j-8f84-cc9q](https://github.com/flavorjones/loofah/security/advisories/GHSA-mf2j-8f84-cc9q). @flavorjones
+* Ensure HTML5 scrubber output does not turn into new markup when a browser parses it again. The fix is in Nokogiri v1.19.5, which escapes `<` and `>` in attribute values as the HTML standard requires, so Loofah now requires Nokogiri >= 1.19.5. See [GHSA-h6v6-rg66-fqj4](https://github.com/flavorjones/loofah/security/advisories/GHSA-h6v6-rg66-fqj4). @flavorjones @hackvertor
+
+### Dependencies
+
+* Loofah now requires Ruby >= 3.2, the minimum that Nokogiri v1.19.x supports. We don't like dropping Ruby versions in a patch release, and we're sorry for the inconvenience, but it's the only way to make sure everyone gets the security fix in [GHSA-h6v6-rg66-fqj4](https://github.com/flavorjones/loofah/security/advisories/GHSA-h6v6-rg66-fqj4).
+
+### Added
+
+* `Loofah::HTML5::Scrub.prefixed_attribute_name` and `Loofah::HTML5::Scrub.scrub_attribute_value` expose the html5lib attribute name and value rules, so downstream consumers can apply them instead of carrying their own copy. @flavorjones
+
+### Fixed
+
+* Fix `:double_breakpoint`, which left document fragments unchanged despite its documented example. The scrubber now changes only paragraphs inside the scrubbed node, and its run time on a document grows linearly, not quadratically, with the paragraph count. #309 @OskarEichler
+* Fix `:whitewash`, which passed CDATA sections through unchanged. Markup inside a CDATA section in `Loofah.xml_fragment` or `Loofah.xml_document` survived scrubbing and became live elements if the output was later parsed as HTML. The scrubber now escapes CDATA content, as `:strip`, `:prune` and `:escape` already do. On JRuby, every sanitizer now emits escaped CDATA content as a CDATA section, as on CRuby, instead of a text node that double-escaped it. #313 @flavorjones (reported by @MegaManSec)
+* Fix `:double_breakpoint`, which raised `NoMethodError` on a paragraph that ends with a `<br>` after a double break. #314 @flavorjones (reported by @MegaManSec)
+* Fix `Loofah::HTML5::Scrub.allowed_uri?`, which raised `Encoding::CompatibilityError` on a string in an encoding other than UTF-8 and `ArgumentError` on invalid UTF-8. It now transcodes the input to UTF-8 and returns `false` when the input has an invalid byte sequence or no UTF-8 representation. #315 @flavorjones
+
+
+## 2.25.2 / 2026-07-15
+
+### Security
+
+* Ensure `Loofah::HTML5::Scrub.allowed_uri?` recognizes numeric character references without semicolons (e.g. `javascript&#58alert(1)`), which browsers decode and execute, and rejects schemes split by them. See [GHSA-5qhf-9phg-95m2](https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2). @flavorjones
+* Ensure `Loofah::HTML5::Scrub.allowed_uri?` recognizes the named character references `&Tab;` and `&NewLine;`, which `CGI.unescapeHTML` does not decode and browsers strip from URIs, and rejects schemes split by them (e.g. `java&Tab;script:alert(1)`). See [GHSA-8whx-365g-h9vv](https://github.com/flavorjones/loofah/security/advisories/GHSA-8whx-365g-h9vv). @flavorjones
+* Ensure that both `href` and `xlink:href` attributes on SVG elements like `use` are restricted to local (same-document) references. Previously only `xlink:href` was restricted, allowing the SVG 2 `href` attribute to reference external documents. See [GHSA-9wjq-cp2p-hrgf](https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf). @flavorjones
+
+### Improved
+
+* Harden `data:` URI mediatype parsing in `Loofah::HTML5::Scrub.allowed_uri?`. The mediatype is now parsed following the [WHATWG data: URL spec](https://fetch.spec.whatwg.org/#data-urls) and [RFC 2397](https://www.rfc-editor.org/rfc/rfc2397) instead of simply being split on a colon. A `data:` URI with an omitted or malformed mediatype is now treated as `text/plain` and allowed, and one without the required comma is now rejected. #305 @flavorjones
+* Remove `feed` from the default set of allowed protocols. The [feed URI scheme](https://en.wikipedia.org/wiki/Feed_URI_scheme) was never accepted as a standard protocol, and no major browser supports it. Removing it reduces the attack surface particularly for non-browser contexts. #304 @flavorjones
+* Remove a vestigial `&#x70` alternative from `Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR`. This appears to be an ancient typo dating back to pre-extraction Rails circa 2007. #305 @flavorjones
+
+
 ## 2.25.1 / 2026-03-17
 
 * Ensure `Loofah::HTML5::Scrub.allowed_uri?` recognizes unescaped whitespace entities and rejects schemas containing them. See [GHSA-46fp-8f5p-pf2m](https://github.com/flavorjones/loofah/security/advisories/GHSA-46fp-8f5p-pf2m). #302 @flavorjones

data/lib/loofah/html5/safelist.rb

@@ -605,6 +605,11 @@ module Loofah
         "stroke",
       ])
 
+      SVG_HREF_ATTRIBUTES = Set.new([
+        "xlink:href",
+        "href",
+      ])
+
       SVG_ALLOW_LOCAL_HREF = Set.new([
         "altGlyph",
         "animate",
@@ -618,7 +623,8 @@ module Loofah
         "pattern",
         "radialGradient",
         "set",
-        "textpath",
+        "mpath",
+        "textPath",
         "tref",
         "use",
       ])
@@ -978,7 +984,7 @@ module Loofah
         "stroke-opacity",
       ])
 
-      PROTOCOL_SEPARATOR = /:|(&#0*58)|(&#x70)|(&#x0*3a)|(%|%)3A/i
+      PROTOCOL_SEPARATOR = /:|(&#0*58)|(&#x0*3a)|(%|%)3A/i
 
       ACCEPTABLE_PROTOCOLS = Set.new([
         "afs",
@@ -987,7 +993,6 @@ module Loofah
         "data",
         "ed2k",
         "fax",
-        "feed",
         "ftp",
         "gopher",
         "http",

data/lib/loofah/html5/scrub.rb

@@ -13,8 +13,54 @@ module Loofah
       CSS_IMPORTANT = "!important"
       CSS_WHITESPACE = " "
       CSS_PROPERTY_STRING_WITHOUT_EMBEDDED_QUOTES = /\A(["'])?[^"']+\1\z/
+      CSS_URLISH_NODES = [:url, :bad_url, :bad_string]
       DATA_ATTRIBUTE_NAME = /\Adata-[\w-]+\z/
-      URI_PROTOCOL_REGEX = /\A[a-z][a-z0-9+\-.]*:/ # RFC 3986
+
+      # Decimal (`&#58`) or hexadecimal (`&#x3a`) form, with or without the trailing semicolon that
+      # CGI.unescapeHTML requires but browsers do not.
+      NUMERIC_CHARACTER_REFERENCE = /&#(x[0-9a-f]+|[0-9]+);?/i
+
+      # A scheme (RFC 3986) followed by a protocol separator. The separator must recognize the same
+      # encoded-colon forms as PROTOCOL_SEPARATOR, otherwise a scheme split by an encoded colon (for
+      # example "javascript&#58alert(1)") would not be recognized as having a scheme and would skip
+      # protocol validation.
+      URI_PROTOCOL_REGEX = /\A[a-z][a-z0-9+\-.]*#{SafeList::PROTOCOL_SEPARATOR}/
+
+      # Matches a valid MIME type "essence" (type "/" subtype, no parameters), used to
+      # decide whether a data: URI mediatype is well-formed; a non-match is not a valid
+      # MIME type, which the data: URL processor treats as text/plain. Specs:
+      #
+      #   https://mimesniff.spec.whatwg.org/#valid-mime-type
+      #   https://mimesniff.spec.whatwg.org/#mime-type-essence
+      #   https://mimesniff.spec.whatwg.org/#http-token-code-point
+      #
+      # The character class below is the HTTP token set (tchar) from RFC 9110 section
+      # 5.6.2, https://www.rfc-editor.org/rfc/rfc9110#name-tokens :
+      #
+      #   tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." / "^"
+      #         / "_" / "`" / "|" / "~" / DIGIT / ALPHA
+      #
+      # ALPHA is written a-z, not a-zA-Z, because allowed_uri? downcases the input first.
+      DATA_URI_MEDIATYPE = %r{
+        \A
+        [a-z0-9!\#$%&'*+\-.^_`|~]+   # type:    1*tchar
+        /                            # "/" is not a tchar, so it is the sole delimiter
+        [a-z0-9!\#$%&'*+\-.^_`|~]+   # subtype: 1*tchar
+        \z
+      }x
+
+      # HTML5 named character references for whitespace that browsers strip from
+      # URIs. CGI.unescapeHTML does not decode these, so they are handled explicitly.
+      WHITESPACE_CHARACTER_REFERENCES = /&(Tab|NewLine);/
+
+      # HTML5 named character references for the delimiters that decide how a URI parses:
+      # ":" ends the scheme, and "/" separates the type and subtype of a data: mediatype.
+      # CGI.unescapeHTML does not decode these either. Together with
+      # WHITESPACE_CHARACTER_REFERENCES these are every named character reference that
+      # decodes to U+0009, U+000A, U+002F, or U+003A, so no other named reference can
+      # change how a URI parses.
+      DELIMITER_CHARACTER_REFERENCES = { ":" => ":", "/" => "/" }.freeze
+      DELIMITER_CHARACTER_REFERENCE = Regexp.union(DELIMITER_CHARACTER_REFERENCES.keys)
 
       class << self
         def allowed_element?(element_name)
@@ -24,11 +70,7 @@ module Loofah
         #  alternative implementation of the html5lib attribute scrubbing algorithm
         def scrub_attributes(node)
           node.attribute_nodes.each do |attr_node|
-            attr_name = if attr_node.namespace
-              "#{attr_node.namespace.prefix}:#{attr_node.node_name}"
-            else
-              attr_node.node_name
-            end
+            attr_name = prefixed_attribute_name(attr_node)
 
             if DATA_ATTRIBUTE_NAME.match?(attr_name)
               next
@@ -39,20 +81,7 @@ module Loofah
               next
             end
 
-            if SafeList::ATTR_VAL_IS_URI.include?(attr_name)
-              next if scrub_uri_attribute(attr_node)
-            end
-
-            if SafeList::SVG_ATTR_VAL_ALLOWS_REF.include?(attr_name)
-              scrub_attribute_that_allows_local_ref(attr_node)
-            end
-
-            next unless SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) &&
-              attr_name == "xlink:href" &&
-              attr_node.value =~ /^\s*[^#\s].*/m
-
-            attr_node.remove
-            next
+            scrub_attribute_value(node, attr_node, attr_name)
           end
 
           scrub_css_attribute(node)
@@ -66,28 +95,58 @@ module Loofah
           force_correct_attribute_escaping!(node)
         end
 
+        #  The name an attribute is matched by in the safelists, qualified by its namespace prefix.
+        def prefixed_attribute_name(attr_node)
+          if attr_node.namespace
+            "#{attr_node.namespace.prefix}:#{attr_node.node_name}"
+          else
+            attr_node.node_name
+          end
+        end
+
+        #  Apply the html5lib value rules to an attribute that is already permitted by name.
+        #  Returns true when `scrub_uri_attribute` removed the attribute, in which case the caller
+        #  should stop scrubbing it.
+        def scrub_attribute_value(node, attr_node, attr_name = prefixed_attribute_name(attr_node))
+          if SafeList::ATTR_VAL_IS_URI.include?(attr_name)
+            return true if scrub_uri_attribute(attr_node)
+          end
+
+          if SafeList::SVG_ATTR_VAL_ALLOWS_REF.include?(attr_name)
+            scrub_attribute_that_allows_local_ref(attr_node)
+          end
+
+          # The whitespace run is `[^\S\n]*` rather than `\s*` so that it cannot cross a line
+          # boundary. With `\s*` the engine rescanned the entire run from every line start,
+          # which is quadratic in the length of an all-whitespace value.
+          if SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) &&
+              SafeList::SVG_HREF_ATTRIBUTES.include?(attr_name) &&
+              attr_node.value =~ /^[^\S\n]*[^#\s]/
+            attr_node.remove
+          end
+
+          false
+        end
+
         def scrub_css_attribute(node)
           style = node.attributes["style"]
           style.value = scrub_css(style.value) if style
         end
 
         def scrub_css(style)
-          url_flags = [:url, :bad_url]
           style_tree = Crass.parse_properties(style)
           sanitized_tree = []
 
           style_tree.each do |node|
             next unless node[:node] == :property
-            next if node[:children].any? do |child|
-              url_flags.include?(child[:node])
-            end
+            next if node[:children].any? { |child| CSS_URLISH_NODES.include?(child[:node]) }
 
             name = node[:name].downcase
             next unless SafeList::ALLOWED_CSS_PROPERTIES.include?(name) ||
               SafeList::ALLOWED_SVG_PROPERTIES.include?(name) ||
               SafeList::SHORTHAND_CSS_PROPERTIES.include?(name.split("-").first)
 
-            value = node[:children].map do |child|
+            value = node[:children].filter_map do |child|
               case child[:node]
               when :whitespace
                 CSS_WHITESPACE
@@ -104,30 +163,55 @@ module Loofah
                 if !SafeList::SHORTHAND_CSS_PROPERTIES.include?(name.split("-").first) ||
                     SafeList::ALLOWED_CSS_KEYWORDS.include?(keyword) ||
                     (keyword =~ CSS_KEYWORDISH)
-                  keyword
+                  child[:raw]
                 end
               else
                 child[:raw]
               end
-            end.compact.join.strip
+            end.join.strip
 
             next if value.empty?
 
             value << CSS_WHITESPACE << CSS_IMPORTANT if node[:important]
+            # Dropping tokens can join the survivors into new ones (`url/(a)*/(b)` becomes `url/*/`),
+            # so the rebuilt string may tokenize differently from the original and stringify
+            # differently again. Keep a property only if its rebuilt string survives a parse and
+            # stringify unchanged, so the tokens checked are exactly the tokens a browser will see.
             propstring = format("%s:%s", name, value)
             sanitized_node = Crass.parse_properties(propstring).first
+            next unless Crass::Parser.stringify(sanitized_node) == propstring
+            next if css_property_unsafe?(sanitized_node)
+
             sanitized_tree << sanitized_node << CRASS_SEMICOLON
           end
 
           Crass::Parser.stringify(sanitized_tree)
         end
 
+        # Dropping a token joins its neighbours, which can build a token that was not in the input:
+        # dropping the string from `url\28 "x"linear-gradient(red)` leaves one function token. So the
+        # rebuilt property is checked for functions and strings, which the input check never sees.
+        def css_property_unsafe?(node)
+          node[:children].any? do |child|
+            case child[:node]
+            when *CSS_URLISH_NODES
+              true
+            when :string
+              !CSS_PROPERTY_STRING_WITHOUT_EMBEDDED_QUOTES.match?(child[:raw])
+            when :function
+              !SafeList::ALLOWED_CSS_FUNCTIONS.include?(child[:name].downcase(:ascii))
+            else
+              false
+            end
+          end
+        end
+
         def scrub_attribute_that_allows_local_ref(attr_node)
           return unless attr_node.value
 
           nodes = Crass::Parser.new(attr_node.value).parse_component_values
 
-          values = nodes.map do |node|
+          values = nodes.filter_map do |node|
             case node[:node]
             when :url
               if node[:value].start_with?("#")
@@ -136,34 +220,68 @@ module Loofah
             when :hash, :ident, :string
               node[:raw]
             end
-          end.compact
+          end
 
           attr_node.value = values.join(" ")
         end
 
-        # Returns true if the given URI string is safe, false otherwise.
-        # This method can be used to validate URI attribute values without
-        # requiring a Nokogiri DOM node.
+        # Returns true if the given URI string is safe, false otherwise. This method can be used to
+        # validate URI attribute values without requiring a Nokogiri DOM node.
         def allowed_uri?(uri_string)
-          # Replace control characters both before and after unescaping.
-          uri_string = CGI.unescapeHTML(uri_string.gsub(CONTROL_CHARACTERS, ""))
-            .gsub(CONTROL_CHARACTERS, "")
-            .gsub("&colon;", ":")
-            .downcase
+          # The character-reference regexps are UTF-8, so the input has to be transcoded before it can
+          # be matched against them. String#encode is a no-op on a string already tagged UTF-8, so an
+          # invalid byte sequence has to be rejected separately.
+          return false unless uri_string.valid_encoding?
+
+          begin
+            uri_string = uri_string.encode(Encoding::UTF_8)
+          rescue EncodingError
+            return false
+          end
+
+          # Decode character references before stripping anything, as a browser does: an HTML parser
+          # decodes the attribute value, then the URL parser strips characters from the result. A
+          # semicolon-less numeric reference ends at the first character that cannot extend it, so
+          # stripping that character first would let the reference run on into the following text.
+          # CGI.unescapeHTML decodes numeric references only when they carry a trailing semicolon, so
+          # the semicolon-less ones are decoded separately.
+          uri_string = CGI.unescapeHTML(decode_numeric_character_references(uri_string))
+          uri_string.gsub!(CONTROL_CHARACTERS, "")
+          uri_string.gsub!(WHITESPACE_CHARACTER_REFERENCES, "")
+          uri_string.gsub!(DELIMITER_CHARACTER_REFERENCE, DELIMITER_CHARACTER_REFERENCES)
+          uri_string.downcase!
           if URI_PROTOCOL_REGEX.match?(uri_string)
             protocol = uri_string.split(SafeList::PROTOCOL_SEPARATOR)[0]
             return false unless SafeList::ALLOWED_PROTOCOLS.include?(protocol)
 
             if protocol == "data"
               # permit only allowed data mediatypes
-              mediatype = uri_string.split(SafeList::PROTOCOL_SEPARATOR)[1]
-              mediatype, _ = mediatype.split(/[;,]/)[0..1] if mediatype
-              return false if mediatype && !SafeList::ALLOWED_URI_DATA_MEDIATYPES.include?(mediatype)
+              return false unless SafeList::ALLOWED_URI_DATA_MEDIATYPES.include?(data_uri_mediatype(uri_string))
             end
           end
           true
         end
 
+        def decode_numeric_character_references(string)
+          string.gsub(NUMERIC_CHARACTER_REFERENCE) do |reference|
+            digits = ::Regexp.last_match(1)
+            hexadecimal = digits.start_with?("x", "X")
+            digits = digits[1..-1] if hexadecimal
+            significant_digits = digits.sub(/\A0+/, "")
+
+            # The largest code point is U+10FFFF: 7 decimal or 6 hexadecimal significant digits.
+            # Anything longer is out of range; skip it without building a large integer from it.
+            next reference if significant_digits.length > (hexadecimal ? 6 : 7)
+
+            codepoint = significant_digits.to_i(hexadecimal ? 16 : 10)
+            begin
+              codepoint.chr(Encoding::UTF_8)
+            rescue RangeError
+              reference
+            end
+          end
+        end
+
         def scrub_uri_attribute(attr_node)
           if allowed_uri?(attr_node.value)
             false
@@ -206,10 +324,10 @@ module Loofah
 
         def cdata_escape(node)
           escaped_text = escape_tags(node.text)
-          if Nokogiri.jruby?
-            node.document.create_text_node(escaped_text)
-          else
+          if node.cdata?
             node.document.create_cdata(escaped_text)
+          else
+            node.document.create_text_node(escaped_text)
           end
         end
 
@@ -238,6 +356,20 @@ module Loofah
             string
           end
         end
+
+        private
+
+        # Returns the mediatype of a data: URI per RFC 2397, or nil when the
+        # required comma is absent. allowed_uri? entity-decodes, downcases, and
+        # strips control characters before calling this. An omitted or malformed
+        # mediatype resolves to "text/plain", matching the WHATWG data: URL processor.
+        def data_uri_mediatype(uri_string)
+          metadata, comma, _data = uri_string.delete_prefix("data:").partition(",")
+          return nil if comma.empty?
+
+          mediatype = metadata.delete_suffix(";base64").split(";", 2).first.to_s.strip
+          mediatype.match?(DATA_URI_MEDIATYPE) ? mediatype : "text/plain"
+        end
       end
     end
   end

data/lib/loofah/scrubbers.rb

@@ -201,7 +201,11 @@ module Loofah
             return CONTINUE if node.namespaces.empty?
           end
         when Nokogiri::XML::Node::TEXT_NODE, Nokogiri::XML::Node::CDATA_SECTION_NODE
-          return CONTINUE
+          if HTML5::Scrub.cdata_needs_escaping?(node)
+            node.before(HTML5::Scrub.cdata_escape(node))
+          else
+            return CONTINUE
+          end
         end
         node.remove
         STOP
@@ -361,37 +365,34 @@ module Loofah
     #
     class DoubleBreakpoint < Scrubber
       def initialize # rubocop:disable Lint/MissingSuper
-        @direction = :top_down
+        # a top-down walk would empty a paragraph before reaching a paragraph nested in it
+        @direction = :bottom_up
       end
 
       def scrub(node)
         return CONTINUE unless (node.type == Nokogiri::XML::Node::ELEMENT_NODE) && (node.name == "p")
+        return CONTINUE unless node.at_xpath("./br[following-sibling::br]")
 
-        paragraph_with_break_point_nodes = node.xpath("//p[br[following-sibling::br]]")
+        new_paragraph = node.add_previous_sibling("<p>").first
 
-        paragraph_with_break_point_nodes.each do |paragraph_node|
-          new_paragraph = paragraph_node.add_previous_sibling("<p>").first
+        node.children.each do |child|
+          remove_blank_text_nodes(child)
+        end
 
-          paragraph_node.children.each do |child|
-            remove_blank_text_nodes(child)
-          end
+        node.children.each do |child|
+          # already unlinked
+          next if child.parent.nil?
 
-          paragraph_node.children.each do |child|
-            # already unlinked
-            next if child.parent.nil?
-
-            if child.name == "br" && child.next_sibling.name == "br"
-              new_paragraph = paragraph_node.add_previous_sibling("<p>").first
-              child.next_sibling.unlink
-              child.unlink
-            else
-              child.parent = new_paragraph
-            end
+          if child.name == "br" && child.next_sibling&.name == "br"
+            new_paragraph = node.add_previous_sibling("<p>").first
+            child.next_sibling.unlink
+            child.unlink
+          else
+            child.parent = new_paragraph
           end
-
-          paragraph_node.unlink
         end
 
+        node.unlink
         CONTINUE
       end
 

data/lib/loofah/version.rb

@@ -2,5 +2,5 @@
 
 module Loofah
   # The version of Loofah you are using
-  VERSION = "2.25.1"
+  VERSION = "2.25.3"
 end

data/lib/loofah.rb

@@ -5,13 +5,7 @@ require "nokogiri"
 module Loofah
   class << self
     def html5_support?
-      # Note that Loofah can only support HTML5 in Nokogiri >= 1.14.0 because it requires the
-      # subclassing fix from https://github.com/sparklemotion/nokogiri/pull/2534
-      return @html5_support if defined? @html5_support
-
-      @html5_support =
-        Gem::Version.new(Nokogiri::VERSION) > Gem::Version.new("1.14.0") &&
-        Nokogiri.uses_gumbo?
+      Nokogiri.uses_gumbo?
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: loofah
 version: !ruby/object:Gem::Version
-  version: 2.25.1
+  version: 2.25.3
 platform: ruby
 authors:
 - Mike Dalessio
@@ -30,14 +30,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.12.0
+        version: 1.19.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.12.0
+        version: 1.19.5
 description: |
   Loofah is a general library for manipulating and transforming HTML/XML documents and fragments,
   built on top of Nokogiri.
@@ -89,14 +89,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.5.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Loofah is a general library for manipulating and transforming HTML/XML documents
   and fragments, built on top of Nokogiri.