loofah 2.3.0 → 2.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 521948af26b151c0584b5eabd8e60c8c31ff451d2b134da4bc632256feeb87f4
-  data.tar.gz: 9b699d079c84a6c498fcb5be0e56f7c68ad7049bb0aa498e3413343803fcf585
+  metadata.gz: ce7e800422f2b83325a3c37aeb81c5fcb7f2c6d76d9be1f5228f3d49077643b8
+  data.tar.gz: 6f4a5303926248d42f4e375d59d8d92e60c7fb797762910dd027aa54d8875922
 SHA512:
-  metadata.gz: 7781d0db35620637fd69051e3729db36f4d10712bab60038df78f523d72b991b8e8f86009655495b56ef69d5b97aa5a621cc22698bc4eaec06577bece6841ec6
-  data.tar.gz: e42ab470cc2f3fbb5d0c3965b6a60fe698d0d076b3d87d58f6c4fa209531eac82188bef01c8005a94f3caa3f342ae7df4a850a4107fa043b618bdbd9f98c8d86
+  metadata.gz: 98570a9ed755a285a42b31c05b8f45413b77119162d190c199f2ea8624f1038cff8ce8532e4339e3747410c9ab8ca645b02f237975643d24b4ad3b447336a35a
+  data.tar.gz: '020485b66a1cb57fe1359bfbeec912631a48b268bbeb754b2ff67fa237cbb840d8ad5e66ec8b64b36d869dcf6866bd3c30191e3596a6481fd9a9258b0f4f8d96'

data/CHANGELOG.md

@@ -1,20 +1,75 @@
 # Changelog
 
-## 2.3.0 / unreleased
+## 2.7.0 / 2020-08-26
 
 ### Features
 
-* Expand set of allowed protocols to include `tel:` and `line:`. [#104, #147]
-* Expand set of allowed CSS functions. [related to #122]
-* Allow greater precision in shorthand CSS values. [#149] (Thanks, @danfstucky!)
-* Allow CSS property `list-style` [#162] (Thanks, @jaredbeck!)
-* Allow CSS keywords `thick` and `thin` [#168] (Thanks, @georgeclaghorn!)
-* Allow HTML property `contenteditable` [#167] (Thanks, @andreynering!)
+* Allow CSS properties `page-break-before`, `page-break-inside`, and `page-break-after`. [[#190](https://github.com/flavorjones/loofah/issues/190)] (Thanks, [@ahorek](https://github.com/ahorek)!)
+
+
+### Fixes
+
+* Don't drop the `!important` rule from some CSS properties. [[#191](https://github.com/flavorjones/loofah/issues/191)] (Thanks, [@b7kich](https://github.com/b7kich)!)
+
+
+## 2.6.0 / 2020-06-16
+
+### Features
+
+* Allow CSS `border-style` keywords. [[#188](https://github.com/flavorjones/loofah/issues/188)] (Thanks, [@tarcisiozf](https://github.com/tarcisiozf)!)
+
+
+## 2.5.0 / 2020-04-05
+
+### Features
+
+* Allow more CSS length units: "ch", "vw", "vh", "Q", "lh", "vmin", "vmax". [[#178](https://github.com/flavorjones/loofah/issues/178)] (Thanks, [@JuanitoFatas](https://github.com/JuanitoFatas)!)
+
+
+### Fixes
+
+* Remove comments from `Loofah::HTML::Document`s that exist outside the `html` element. [[#80](https://github.com/flavorjones/loofah/issues/80)]
+
+
+### Other changes
+
+* Gem metadata being set [[#181](https://github.com/flavorjones/loofah/issues/181)] (Thanks, [@JuanitoFatas](https://github.com/JuanitoFatas)!)
+* Test files removed from gem file [[#180](https://github.com/flavorjones/loofah/issues/180),[#166](https://github.com/flavorjones/loofah/issues/166),[#159](https://github.com/flavorjones/loofah/issues/159)] (Thanks, [@JuanitoFatas](https://github.com/JuanitoFatas) and [@greysteil](https://github.com/greysteil)!)
+
+
+## 2.4.0 / 2019-11-25
+
+### Features
+
+* Allow CSS property `max-width` [[#175](https://github.com/flavorjones/loofah/issues/175)] (Thanks, [@bchaney](https://github.com/bchaney)!)
+* Allow CSS sizes expressed in `rem` [[#176](https://github.com/flavorjones/loofah/issues/176), [#177](https://github.com/flavorjones/loofah/issues/177)]
+* Add `frozen_string_literal: true` magic comment to all `lib` files. [[#118](https://github.com/flavorjones/loofah/issues/118)]
+
+
+## 2.3.1 / 2019-10-22
+
+### Security
+
+Address CVE-2019-15587: Unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
+
+This CVE's public notice is at [#171](https://github.com/flavorjones/loofah/issues/171)
+
+
+## 2.3.0 / 2019-09-28
+
+### Features
+
+* Expand set of allowed protocols to include `tel:` and `line:`. [[#104](https://github.com/flavorjones/loofah/issues/104), [#147](https://github.com/flavorjones/loofah/issues/147)]
+* Expand set of allowed CSS functions. [related to [#122](https://github.com/flavorjones/loofah/issues/122)]
+* Allow greater precision in shorthand CSS values. [[#149](https://github.com/flavorjones/loofah/issues/149)] (Thanks, [@danfstucky](https://github.com/danfstucky)!)
+* Allow CSS property `list-style` [[#162](https://github.com/flavorjones/loofah/issues/162)] (Thanks, [@jaredbeck](https://github.com/jaredbeck)!)
+* Allow CSS keywords `thick` and `thin` [[#168](https://github.com/flavorjones/loofah/issues/168)] (Thanks, [@georgeclaghorn](https://github.com/georgeclaghorn)!)
+* Allow HTML property `contenteditable` [[#167](https://github.com/flavorjones/loofah/issues/167)] (Thanks, [@andreynering](https://github.com/andreynering)!)
 
 
 ### Bug fixes
 
-* CSS hex values are no longer limited to lowercase hex. Previously uppercase hex were scrubbed. [#165] (Thanks, @asok!)
+* CSS hex values are no longer limited to lowercase hex. Previously uppercase hex were scrubbed. [[#165](https://github.com/flavorjones/loofah/issues/165)] (Thanks, [@asok](https://github.com/asok)!)
 
 
 ### Deprecations / Name Changes
@@ -25,7 +80,7 @@ The following method and constants are hereby deprecated, and will be completely
 * Deprecate `Loofah::Helpers::ActionView::WhiteListSanitizer`, please use `Loofah::Helpers::ActionView::SafeListSanitizer` instead.
 * Deprecate `Loofah::HTML5::WhiteList`, please use `Loofah::HTML5::SafeList` instead.
 
-Thanks to @JuanitoFatas for submitting these changes in #164 and for making the language used in Loofah more inclusive.
+Thanks to [@JuanitoFatas](https://github.com/JuanitoFatas) for submitting these changes in [#164](https://github.com/flavorjones/loofah/issues/164) and for making the language used in Loofah more inclusive.
 
 
 ## 2.2.3 / 2018-10-30
@@ -34,7 +89,7 @@ Thanks to @JuanitoFatas for submitting these changes in #164 and for making the
 
 Address CVE-2018-16468: Unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
 
-This CVE's public notice is at https://github.com/flavorjones/loofah/issues/154
+This CVE's public notice is at [#154](https://github.com/flavorjones/loofah/issues/154)
 
 
 ## Meta / 2018-10-27
@@ -61,76 +116,76 @@ attribute scrubbers should they need to address CVE-2018-8048.
 
 Addresses CVE-2018-8048. Loofah allowed non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments.
 
-This CVE's public notice is at https://github.com/flavorjones/loofah/issues/144
+This CVE's public notice is at [#144](https://github.com/flavorjones/loofah/issues/144)
 
 
 ## 2.2.0 / 2018-02-11
 
 ### Features:
 
-* Support HTML5 `<main>` tag. #133 (Thanks, @MothOnMars!)
-* Recognize HTML5 block elements. #136 (Thanks, @MothOnMars!)
-* Support SVG `<symbol>` tag. #131 (Thanks, @baopham!)
-* Support for whitelisting CSS functions, initially just `calc` and `rgb`. #122/#123/#129 (Thanks, @NikoRoberts!)
-* Whitelist CSS property `list-style-type`. #68/#137/#142 (Thanks, @andela-ysanni and @NikoRoberts!)
+* Support HTML5 `<main>` tag. [#133](https://github.com/flavorjones/loofah/issues/133) (Thanks, [@MothOnMars](https://github.com/MothOnMars)!)
+* Recognize HTML5 block elements. [#136](https://github.com/flavorjones/loofah/issues/136) (Thanks, [@MothOnMars](https://github.com/MothOnMars)!)
+* Support SVG `<symbol>` tag. [#131](https://github.com/flavorjones/loofah/issues/131) (Thanks, [@baopham](https://github.com/baopham)!)
+* Support for whitelisting CSS functions, initially just `calc` and `rgb`. [#122](https://github.com/flavorjones/loofah/issues/122)/[#123](https://github.com/flavorjones/loofah/issues/123)/[#129](https://github.com/flavorjones/loofah/issues/129) (Thanks, [@NikoRoberts](https://github.com/NikoRoberts)!)
+* Whitelist CSS property `list-style-type`. [#68](https://github.com/flavorjones/loofah/issues/68)/[#137](https://github.com/flavorjones/loofah/issues/137)/[#142](https://github.com/flavorjones/loofah/issues/142) (Thanks, [@andela-ysanni](https://github.com/andela-ysanni) and [@NikoRoberts](https://github.com/NikoRoberts)!)
 
 ### Bugfixes:
 
-* Properly handle nested `script` tags. #127.
+* Properly handle nested `script` tags. [#127](https://github.com/flavorjones/loofah/issues/127).
 
 
 ## 2.1.1 / 2017-09-24
 
 ### Bugfixes:
 
-* Removed warning for unused variable. #124 (Thanks, @y-yagi!)
+* Removed warning for unused variable. [#124](https://github.com/flavorjones/loofah/issues/124) (Thanks, [@y-yagi](https://github.com/y-yagi)!)
 
 
 ## 2.1.0 / 2017-09-24
 
 ### Notes:
 
-* Re-implemented CSS parsing and sanitization using the [crass](https://github.com/rgrove/crass) library. #91
+* Re-implemented CSS parsing and sanitization using the [crass](https://github.com/rgrove/crass) library. [#91](https://github.com/flavorjones/loofah/issues/91)
 
 
 ### Features:
 
-* Added :noopener HTML scrubber (Thanks, @tastycode!)
-* Support `data` URIs with the following media types: text/plain, text/css, image/png, image/gif, image/jpeg, image/svg+xml. #101, #120. (Thanks, @mrpasquini!)
+* Added :noopener HTML scrubber (Thanks, [@tastycode](https://github.com/tastycode)!)
+* Support `data` URIs with the following media types: text/plain, text/css, image/png, image/gif, image/jpeg, image/svg+xml. [#101](https://github.com/flavorjones/loofah/issues/101), [#120](https://github.com/flavorjones/loofah/issues/120). (Thanks, [@mrpasquini](https://github.com/mrpasquini)!)
 
 
 ### Bugfixes:
 
-* The :unprintable scrubber now scrubs unprintable characters in CDATA nodes (like `<script>`). #124
-* Allow negative values in CSS properties. Restores functionality that was reverted in v2.0.3. #91
+* The :unprintable scrubber now scrubs unprintable characters in CDATA nodes (like `<script>`). [#124](https://github.com/flavorjones/loofah/issues/124)
+* Allow negative values in CSS properties. Restores functionality that was reverted in v2.0.3. [#91](https://github.com/flavorjones/loofah/issues/91)
 
 
 ## 2.0.3 / 2015-08-17
 
 ### Bug fixes:
 
-* Revert support for negative values in CSS properties due to slow performance. #90 (Related to #85.)
+* Revert support for negative values in CSS properties due to slow performance. [#90](https://github.com/flavorjones/loofah/issues/90) (Related to [#85](https://github.com/flavorjones/loofah/issues/85).)
 
 
 ## 2.0.2 / 2015-05-05
 
 ### Bug fixes:
 
-* Fix error with `#to_text` when Loofah::Helpers hadn't been required. #75
-* Allow multi-word data attributes. #84 (Thanks, @jstorimer!)
-* Allow negative values in CSS properties. #85 (Thanks, @siddhartham!)
+* Fix error with `#to_text` when Loofah::Helpers hadn't been required. [#75](https://github.com/flavorjones/loofah/issues/75)
+* Allow multi-word data attributes. [#84](https://github.com/flavorjones/loofah/issues/84) (Thanks, [@jstorimer](https://github.com/jstorimer)!)
+* Allow negative values in CSS properties. [#85](https://github.com/flavorjones/loofah/issues/85) (Thanks, [@siddhartham](https://github.com/siddhartham)!)
 
 
 ## 2.0.1 / 2014-08-21
 
 ### Bug fixes:
 
-* Load RR correctly when running test files directly. (Thanks, @ktdreyer!)
+* Load RR correctly when running test files directly. (Thanks, [@ktdreyer](https://github.com/ktdreyer)!)
 
 
 ### Notes:
 
-* Extracted HTML5::Scrub#scrub_css_attribute to accommodate the Rails integration work. (Thanks, @kaspth!)
+* Extracted HTML5::Scrub#scrub_css_attribute to accommodate the Rails integration work. (Thanks, [@kaspth](https://github.com/kaspth)!)
 
 
 ## 2.0.0 / 2014-05-09
@@ -146,19 +201,19 @@ This CVE's public notice is at https://github.com/flavorjones/loofah/issues/144
   * tags: `article`, `aside`, `bdi`, `bdo`, `canvas`, `command`, `datalist`, `details`, `figcaption`, `figure`, `footer`, `header`, `mark`, `meter`, `nav`, `output`, `section`, `summary`, `time`
   * attributes: `data-*` (Thanks, Rafael Franca!)
   * URI attributes: `poster` and `preload`
-* Addition of the `:unprintable` scrubber to remove unprintable characters from text nodes. #65 (Thanks, Matt Swanson!)
-* `Loofah.fragment` accepts an optional encoding argument, compatible with `Nokogiri::HTML::DocumentFragment.parse`. #62 (Thanks, Ben Atkins!)
+* Addition of the `:unprintable` scrubber to remove unprintable characters from text nodes. [#65](https://github.com/flavorjones/loofah/issues/65) (Thanks, Matt Swanson!)
+* `Loofah.fragment` accepts an optional encoding argument, compatible with `Nokogiri::HTML::DocumentFragment.parse`. [#62](https://github.com/flavorjones/loofah/issues/62) (Thanks, Ben Atkins!)
 * HTML5 sanitizers now remove attributes without values. (Thanks, Kasper Timm Hansen!)
 
 ### Bug fixes:
 
 * HTML5 sanitizers' CSS keyword check now actually works (broken in v2.0). Additional regression tests added. (Thanks, Kasper Timm Hansen!)
-* HTML5 sanitizers now allow negative arguments to CSS. #64 (Thanks, Jon Calhoun!)
+* HTML5 sanitizers now allow negative arguments to CSS. [#64](https://github.com/flavorjones/loofah/issues/64) (Thanks, Jon Calhoun!)
 
 
 ## 1.2.1 (2012-04-14)
 
-* Declaring encoding in html5/scrub.rb. Without this, use of the ruby -KU option would cause havoc. (#32)
+* Declaring encoding in html5/scrub.rb. Without this, use of the ruby -KU option would cause havoc. ([#32](https://github.com/flavorjones/loofah/issues/32))
 
 
 ## 1.2.0 (2011-08-08)
@@ -176,7 +231,7 @@ This CVE's public notice is at https://github.com/flavorjones/loofah/issues/144
 * Additional HTML5lib whitelist elements (from html5lib 1524:80b5efe26230).
   Up to date with HTML5lib ruby code as of 1723:7ee6a0331856.
 * Whitelists (which are not part of the public API) are now Sets (were previously Arrays).
-* Don't explode when encountering UTF-8 URIs. (#25, #29)
+* Don't explode when encountering UTF-8 URIs. ([#25](https://github.com/flavorjones/loofah/issues/25), [#29](https://github.com/flavorjones/loofah/issues/29))
 
 
 ## 1.0.0 (2010-10-26)
@@ -194,7 +249,7 @@ This CVE's public notice is at https://github.com/flavorjones/loofah/issues/144
 * New methods Loofah::HTML::Document#to_text and
   Loofah::HTML::DocumentFragment#to_text do the right thing with
   whitespace. Note that these methods are significantly slower than
-  #text. GH #12
+  #text. GH [#12](https://github.com/flavorjones/loofah/issues/12)
 * Loofah::Elements::BLOCK_LEVEL contains a canonical list of HTML4 block-level4 elements.
 * Loofah::HTML::Document#text and Loofah::HTML::DocumentFragment#text
   will return unescaped HTML entities by passing :encode_special_chars => false.
@@ -208,7 +263,7 @@ This CVE's public notice is at https://github.com/flavorjones/loofah/issues/144
 
 ### Bug fixes:
 
-* Loofah::XssFoliate was not properly escaping HTML entities when implicitly scrubbing a string attribute. GH #17
+* Loofah::XssFoliate was not properly escaping HTML entities when implicitly scrubbing a string attribute. GH [#17](https://github.com/flavorjones/loofah/issues/17)
 
 
 ## 0.4.3 (2010-01-29)
@@ -236,7 +291,7 @@ This CVE's public notice is at https://github.com/flavorjones/loofah/issues/144
 
 ### Bug fixes:
 
-* Supporting Rails apps that aren't loading ActiveRecord. GH #10
+* Supporting Rails apps that aren't loading ActiveRecord. GH [#10](https://github.com/flavorjones/loofah/issues/10)
 
 ### Miscellaneous:
 
@@ -297,13 +352,13 @@ This CVE's public notice is at https://github.com/flavorjones/loofah/issues/144
 ### Enhancements:
 
 * when loaded in a Rails app, automatically extend ActiveRecord::Base
-  with html_fragment and html_document. GH #6 (Thanks Josh Nichols!)
+  with html_fragment and html_document. GH [#6](https://github.com/flavorjones/loofah/issues/6) (Thanks Josh Nichols!)
 
 ### Bugfixes:
 
 * ActiveRecord scrubbing should generate strings instead of Document or
-  DocumentFragment objects. GH #5
-* init.rb fixed to support installation as a Rails plugin. GH #6
+  DocumentFragment objects. GH [#5](https://github.com/flavorjones/loofah/issues/5)
+* init.rb fixed to support installation as a Rails plugin. GH [#6](https://github.com/flavorjones/loofah/issues/6)
   (Thanks Josh Nichols!)
 
 

data/Gemfile

@@ -7,16 +7,18 @@ source "https://rubygems.org/"
 gem "nokogiri", ">=1.5.9"
 gem "crass", "~>1.0.2"
 
-gem "rake", ">=0.8", :group => [:development, :test]
+gem "rake", "~>12.3", :group => [:development, :test]
 gem "minitest", "~>2.2", :group => [:development, :test]
 gem "rr", "~>1.2.0", :group => [:development, :test]
-gem "json", ">=0", :group => [:development, :test]
-gem "hoe-gemspec", ">=0", :group => [:development, :test]
-gem "hoe-debugging", ">=0", :group => [:development, :test]
-gem "hoe-bundler", ">=0", :group => [:development, :test]
-gem "hoe-git", ">=0", :group => [:development, :test]
+gem "json", "~>2.3.0", :group => [:development, :test]
+gem "hoe-gemspec", "~>1.0", :group => [:development, :test]
+gem "hoe-debugging", "~>2.0", :group => [:development, :test]
+gem "hoe-bundler", "~>1.5", :group => [:development, :test]
+gem "hoe-git", "~>1.6", :group => [:development, :test]
+gem "hoe-markdown", "~>1.2", :group => [:development, :test]
 gem "concourse", ">=0.26.0", :group => [:development, :test]
+gem "rubocop", ">=0.76.0", :group => [:development, :test]
 gem "rdoc", ">=4.0", "<7", :group => [:development, :test]
-gem "hoe", "~>3.17", :group => [:development, :test]
+gem "hoe", "~>3.22", :group => [:development, :test]
 
 # vim: syntax=ruby

data/Manifest.txt

@@ -1,4 +1,3 @@
-.gemtest
 CHANGELOG.md
 Gemfile
 MIT-LICENSE.txt
@@ -24,18 +23,3 @@ lib/loofah/scrubber.rb
 lib/loofah/scrubbers.rb
 lib/loofah/xml/document.rb
 lib/loofah/xml/document_fragment.rb
-test/assets/msword.html
-test/assets/testdata_sanitizer_tests1.dat
-test/helper.rb
-test/html5/test_sanitizer.rb
-test/html5/test_scrub.rb
-test/integration/test_ad_hoc.rb
-test/integration/test_helpers.rb
-test/integration/test_html.rb
-test/integration/test_scrubbers.rb
-test/integration/test_xml.rb
-test/unit/test_api.rb
-test/unit/test_encoding.rb
-test/unit/test_helpers.rb
-test/unit/test_scrubber.rb
-test/unit/test_scrubbers.rb

data/README.md

@@ -14,17 +14,11 @@
 
 ## Description
 
-Loofah is a general library for manipulating and transforming HTML/XML
-documents and fragments. It's built on top of Nokogiri and libxml2, so
-it's fast and has a nice API.
+Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri.
 
-Loofah excels at HTML sanitization (XSS prevention). It includes some
-nice HTML sanitizers, which are based on HTML5lib's safelist, so it
-most likely won't make your codes less secure. (These statements have
-not been evaluated by Netexperts.)
+Loofah excels at HTML sanitization (XSS prevention). It includes some nice HTML sanitizers, which are based on HTML5lib's safelist, so it most likely won't make your codes less secure. (These statements have not been evaluated by Netexperts.)
 
-ActiveRecord extensions for sanitization are available in the
-[`loofah-activerecord` gem](https://github.com/flavorjones/loofah-activerecord).
+ActiveRecord extensions for sanitization are available in the [`loofah-activerecord` gem](https://github.com/flavorjones/loofah-activerecord).
 
 
 ## Features

data/Rakefile

@@ -6,15 +6,20 @@ Hoe.plugin :git
 Hoe.plugin :gemspec
 Hoe.plugin :bundler
 Hoe.plugin :debugging
+Hoe.plugin :markdown
 
 Hoe.spec "loofah" do
   developer "Mike Dalessio", "mike.dalessio@gmail.com"
   developer "Bryan Helmkamp", "bryan@brynary.com"
 
-  self.extra_rdoc_files = FileList["*.md"]
-  self.history_file = "CHANGELOG.md"
-  self.readme_file = "README.md"
   self.license "MIT"
+  self.urls = {
+    "home" => "https://github.com/flavorjones/loofah",
+    "bugs" => "https://github.com/flavorjones/loofah/issues",
+    "doco" => "https://www.rubydoc.info/gems/loofah/",
+    "clog" => "https://github.com/flavorjones/loofah/blob/master/CHANGELOG.md",
+    "code" => "https://github.com/flavorjones/loofah",
+  }
 
   extra_deps << ["nokogiri", ">=1.5.9"]
   extra_deps << ["crass", "~> 1.0.2"]
@@ -22,12 +27,14 @@ Hoe.spec "loofah" do
   extra_dev_deps << ["rake", "~> 12.3"]
   extra_dev_deps << ["minitest", "~>2.2"]
   extra_dev_deps << ["rr", "~>1.2.0"]
-  extra_dev_deps << ["json", "~> 2.2.0"]
+  extra_dev_deps << ["json", "~> 2.3.0"]
   extra_dev_deps << ["hoe-gemspec", "~> 1.0"]
   extra_dev_deps << ["hoe-debugging", "~> 2.0"]
   extra_dev_deps << ["hoe-bundler", "~> 1.5"]
   extra_dev_deps << ["hoe-git", "~> 1.6"]
+  extra_dev_deps << ["hoe-markdown", "~> 1.2"]
   extra_dev_deps << ["concourse", ">=0.26.0"]
+  extra_dev_deps << ["rubocop", ">=0.76.0"]
 end
 
 task :gemspec do
@@ -75,6 +82,15 @@ task :generate_safelists do
   load "tasks/generate-safelists"
 end
 
+task :rubocop => [:rubocop_security, :rubocop_frozen_string_literals]
+task :rubocop_security do
+  sh "rubocop lib --only Security"
+end
+task :rubocop_frozen_string_literals do
+  sh "rubocop lib --auto-correct --only Style/FrozenStringLiteralComment"
+end
+Rake::Task[:test].prerequisites << :rubocop
+
 Concourse.new("loofah", fly_target: "ci") do |c|
   c.add_pipeline "loofah", "loofah.yml"
   c.add_pipeline "loofah-pr", "loofah-pr.yml"

data/benchmark/benchmark.rb

@@ -23,7 +23,7 @@ def compare_scrub_methods
 end
 
 module TestSet
-  def test_set options={}
+  def test_set(options = {})
     scale = options[:rehearse] ? 10 : 1
     puts self.class.name
 
@@ -49,6 +49,7 @@ end
 
 class HeadToHeadRailsSanitize < Measure
   include TestSet
+
   def bench(content, ntimes, fragment_p)
     clear_measure
 
@@ -65,6 +66,7 @@ end
 
 class HeadToHeadRailsStripTags < Measure
   include TestSet
+
   def bench(content, ntimes, fragment_p)
     clear_measure
 
@@ -81,6 +83,7 @@ end
 
 class HeadToHeadSanitizerSanitize < Measure
   include TestSet
+
   def bench(content, ntimes, fragment_p)
     clear_measure
 
@@ -100,6 +103,7 @@ end
 
 class HeadToHeadHtml5LibSanitize < Measure
   include TestSet
+
   def bench(content, ntimes, fragment_p)
     clear_measure
 
@@ -120,6 +124,7 @@ end
 
 class HeadToHeadHTMLFilter < Measure
   include TestSet
+
   def bench(content, ntimes, fragment_p)
     clear_measure