loofah 2.3.0 → 2.7.0

data/benchmark/helper.rb

@@ -1,13 +1,13 @@
-require 'rubygems'
-require 'open-uri'
-require 'hpricot'
+require "rubygems"
+require "open-uri"
+require "hpricot"
 require File.expand_path(File.dirname(__FILE__) + "/../lib/loofah")
-require 'benchmark'
+require "benchmark"
 require "action_view"
 require "action_controller/vendor/html-scanner"
 require "sanitize"
-require 'hitimes'
-require 'htmlfilter'
+require "hitimes"
+require "htmlfilter"
 
 unless defined?(HTMLFilter)
   HTMLFilter = HtmlFilter
@@ -19,20 +19,20 @@ class RailsSanitize
 end
 
 class HTML5libSanitize
-  require 'html5/html5parser'
-  require 'html5/liberalxmlparser'
-  require 'html5/treewalkers'
-  require 'html5/treebuilders'
-  require 'html5/serializer'
-  require 'html5/sanitizer'
+  require "html5/html5parser"
+  require "html5/liberalxmlparser"
+  require "html5/treewalkers"
+  require "html5/treebuilders"
+  require "html5/serializer"
+  require "html5/sanitizer"
 
   include HTML5
 
   def sanitize(html)
     HTMLParser.parse_fragment(html, {
-      :tokenizer  => HTMLSanitizer,
-      :encoding   => 'utf-8',
-      :tree       => TreeBuilders::REXML::TreeBuilder
+      :tokenizer => HTMLSanitizer,
+      :encoding => "utf-8",
+      :tree => TreeBuilders::REXML::TreeBuilder,
     }).to_s
   end
 end

data/lib/loofah.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 $LOAD_PATH.unshift(File.expand_path(File.dirname(__FILE__))) unless $LOAD_PATH.include?(File.expand_path(File.dirname(__FILE__)))
 
 require "nokogiri"
@@ -28,13 +29,13 @@ require "loofah/html/document_fragment"
 #
 module Loofah
   # The version of Loofah you are using
-  VERSION = "2.3.0"
+  VERSION = "2.7.0"
 
   class << self
     # Shortcut for Loofah::HTML::Document.parse
     # This method accepts the same parameters as Nokogiri::HTML::Document.parse
     def document(*args, &block)
-      Loofah::HTML::Document.parse(*args, &block)
+      remove_comments_before_html_element Loofah::HTML::Document.parse(*args, &block)
     end
 
     # Shortcut for Loofah::HTML::DocumentFragment.parse
@@ -79,5 +80,23 @@ module Loofah
     def remove_extraneous_whitespace(string)
       string.gsub(/\n\s*\n\s*\n/, "\n\n")
     end
+
+    private
+
+    # remove comments that exist outside of the HTML element.
+    #
+    # these comments are allowed by the HTML spec:
+    #
+    #    https://www.w3.org/TR/html401/struct/global.html#h-7.1
+    #
+    # but are not scrubbed by Loofah because these nodes don't meet
+    # the contract that scrubbers expect of a node (e.g., it can be
+    # replaced, sibling and children nodes can be created).
+    def remove_comments_before_html_element(doc)
+      doc.children.each do |child|
+        child.unlink if child.comment?
+      end
+      doc
+    end
   end
 end

data/lib/loofah/elements.rb

@@ -1,89 +1,90 @@
-require 'set'
+# frozen_string_literal: true
+require "set"
 
 module Loofah
   module Elements
     STRICT_BLOCK_LEVEL_HTML4 = Set.new %w[
-      address
-      blockquote
-      center
-      dir
-      div
-      dl
-      fieldset
-      form
-      h1
-      h2
-      h3
-      h4
-      h5
-      h6
-      hr
-      isindex
-      menu
-      noframes
-      noscript
-      ol
-      p
-      pre
-      table
-      ul
-    ]
+                                         address
+                                         blockquote
+                                         center
+                                         dir
+                                         div
+                                         dl
+                                         fieldset
+                                         form
+                                         h1
+                                         h2
+                                         h3
+                                         h4
+                                         h5
+                                         h6
+                                         hr
+                                         isindex
+                                         menu
+                                         noframes
+                                         noscript
+                                         ol
+                                         p
+                                         pre
+                                         table
+                                         ul
+                                       ]
 
     # https://developer.mozilla.org/en-US/docs/Web/HTML/Block-level_elements
     STRICT_BLOCK_LEVEL_HTML5 = Set.new %w[
-      address
-      article
-      aside
-      blockquote
-      canvas
-      dd
-      div
-      dl
-      dt
-      fieldset
-      figcaption
-      figure
-      footer
-      form
-      h1
-      h2
-      h3
-      h4
-      h5
-      h6
-      header
-      hgroup
-      hr
-      li
-      main
-      nav
-      noscript
-      ol
-      output
-      p
-      pre
-      section
-      table
-      tfoot
-      ul
-      video
-    ]
+                                         address
+                                         article
+                                         aside
+                                         blockquote
+                                         canvas
+                                         dd
+                                         div
+                                         dl
+                                         dt
+                                         fieldset
+                                         figcaption
+                                         figure
+                                         footer
+                                         form
+                                         h1
+                                         h2
+                                         h3
+                                         h4
+                                         h5
+                                         h6
+                                         header
+                                         hgroup
+                                         hr
+                                         li
+                                         main
+                                         nav
+                                         noscript
+                                         ol
+                                         output
+                                         p
+                                         pre
+                                         section
+                                         table
+                                         tfoot
+                                         ul
+                                         video
+                                       ]
 
     STRICT_BLOCK_LEVEL = STRICT_BLOCK_LEVEL_HTML4 + STRICT_BLOCK_LEVEL_HTML5
 
     # The following elements may also be considered block-level
     # elements since they may contain block-level elements
     LOOSE_BLOCK_LEVEL = Set.new %w[dd
-      dt
-      frameset
-      li
-      tbody
-      td
-      tfoot
-      th
-      thead
-      tr
-    ]
+                                   dt
+                                   frameset
+                                   li
+                                   tbody
+                                   td
+                                   tfoot
+                                   th
+                                   thead
+                                   tr
+                                ]
 
     BLOCK_LEVEL = STRICT_BLOCK_LEVEL + LOOSE_BLOCK_LEVEL
   end

data/lib/loofah/helpers.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Loofah
   module Helpers
     class << self
@@ -27,7 +28,7 @@ module Loofah
       #
       #    Loofah::Helpers.sanitize_css("display:block;background-image:url(http://www.ragingplatypus.com/i/cam-full.jpg)") # => "display: block;"
       #
-      def sanitize_css style_string
+      def sanitize_css(style_string)
         ::Loofah::HTML5::Scrub.scrub_css style_string
       end
 
@@ -68,7 +69,7 @@ module Loofah
       #    Loofah::Helpers::ActionView.set_as_default_sanitizer
       #
       class FullSanitizer
-        def sanitize html, *args
+        def sanitize(html, *args)
           Loofah::Helpers.strip_tags html
         end
       end
@@ -85,11 +86,11 @@ module Loofah
       #    Loofah::Helpers::ActionView.set_as_default_sanitizer
       #
       class SafeListSanitizer
-        def sanitize html, *args
+        def sanitize(html, *args)
           Loofah::Helpers.sanitize html
         end
 
-        def sanitize_css style_string, *args
+        def sanitize_css(style_string, *args)
           Loofah::Helpers.sanitize_css style_string
         end
       end

data/lib/loofah/html/document.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Loofah
   module HTML # :nodoc:
     #

data/lib/loofah/html/document_fragment.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Loofah
   module HTML # :nodoc:
     #
@@ -14,10 +15,10 @@ module Loofah
         #  constructor. Applications should use Loofah.fragment to
         #  parse a fragment.
         #
-        def parse tags, encoding = nil
+        def parse(tags, encoding = nil)
           doc = Loofah::HTML::Document.new
 
-          encoding ||= tags.respond_to?(:encoding) ? tags.encoding.name : 'UTF-8'
+          encoding ||= tags.respond_to?(:encoding) ? tags.encoding.name : "UTF-8"
           doc.encoding = encoding
 
           new(doc, tags)
@@ -30,6 +31,7 @@ module Loofah
       def to_s
         serialize_root.children.to_s
       end
+
       alias :serialize :to_s
 
       def serialize_root

data/lib/loofah/html5/libxml2_workarounds.rb

@@ -1,5 +1,6 @@
 # coding: utf-8
-require 'set'
+# frozen_string_literal: true
+require "set"
 
 module Loofah
   #
@@ -16,11 +17,11 @@ module Loofah
     #  see comments about CVE-2018-8048 within the tests for more information
     #
     BROKEN_ESCAPING_ATTRIBUTES = Set.new %w[
-        href
-        action
-        src
-        name
-      ]
-    BROKEN_ESCAPING_ATTRIBUTES_QUALIFYING_TAG = {"name" => "a"}
+                                           href
+                                           action
+                                           src
+                                           name
+                                         ]
+    BROKEN_ESCAPING_ATTRIBUTES_QUALIFYING_TAG = { "name" => "a" }
   end
 end

data/lib/loofah/html5/safelist.rb

@@ -1,4 +1,5 @@
-require 'set'
+# frozen_string_literal: true
+require "set"
 
 module Loofah
   module HTML5 # :nodoc:
@@ -45,7 +46,6 @@ module Loofah
     #
     # </html5_license>
     module SafeList
-
       ACCEPTABLE_ELEMENTS = Set.new([
                                       "a",
                                       "abbr",
@@ -361,7 +361,6 @@ module Loofah
                                  "baseProfile",
                                  "bbox",
                                  "begin",
-                                 "by",
                                  "calcMode",
                                  "cap-height",
                                  "class",
@@ -468,7 +467,6 @@ module Loofah
                                  "systemLanguage",
                                  "target",
                                  "text-anchor",
-                                 "to",
                                  "transform",
                                  "type",
                                  "u1",
@@ -478,7 +476,6 @@ module Loofah
                                  "unicode",
                                  "unicode-range",
                                  "units-per-em",
-                                 "values",
                                  "version",
                                  "viewBox",
                                  "visibility",
@@ -577,7 +574,11 @@ module Loofah
                                             "line-height",
                                             "list-style",
                                             "list-style-type",
+                                            "max-width",
                                             "overflow",
+                                            "page-break-after",
+                                            "page-break-before",
+                                            "page-break-inside",
                                             "pause",
                                             "pause-after",
                                             "pause-before",
@@ -616,9 +617,13 @@ module Loofah
                                           "collapse",
                                           "dashed",
                                           "dotted",
+                                          "double",
                                           "fuchsia",
                                           "gray",
                                           "green",
+                                          "groove",
+                                          "hidden",
+                                          "inset",
                                           "italic",
                                           "left",
                                           "lime",
@@ -629,9 +634,11 @@ module Loofah
                                           "normal",
                                           "nowrap",
                                           "olive",
+                                          "outset",
                                           "pointer",
                                           "purple",
                                           "red",
+                                          "ridge",
                                           "right",
                                           "silver",
                                           "solid",

data/lib/loofah/html5/scrub.rb

@@ -1,22 +1,22 @@
-require 'cgi'
-require 'crass'
+# frozen_string_literal: true
+require "cgi"
+require "crass"
 
 module Loofah
   module HTML5 # :nodoc:
     module Scrub
-
       CONTROL_CHARACTERS = /[`\u0000-\u0020\u007f\u0080-\u0101]/
-      CSS_KEYWORDISH = /\A(#[0-9a-fA-F]+|rgb\(\d+%?,\d*%?,?\d*%?\)?|-?\d{0,3}\.?\d{0,10}(cm|em|ex|in|mm|pc|pt|px|%|,|\))?)\z/
-      CRASS_SEMICOLON = {:node => :semicolon, :raw => ";"}
+      CSS_KEYWORDISH = /\A(#[0-9a-fA-F]+|rgb\(\d+%?,\d*%?,?\d*%?\)?|-?\d{0,3}\.?\d{0,10}(ch|cm|r?em|ex|in|lh|mm|pc|pt|px|Q|vmax|vmin|vw|vh|%|,|\))?)\z/
+      CRASS_SEMICOLON = { :node => :semicolon, :raw => ";" }
+      CSS_IMPORTANT = '!important'
 
       class << self
-
-        def allowed_element? element_name
+        def allowed_element?(element_name)
           ::Loofah::HTML5::SafeList::ALLOWED_ELEMENTS_WITH_LIBXML2.include? element_name
         end
 
         #  alternative implementation of the html5lib attribute scrubbing algorithm
-        def scrub_attributes node
+        def scrub_attributes(node)
           node.attribute_nodes.each do |attr_node|
             attr_name = if attr_node.namespace
                           "#{attr_node.namespace.prefix}:#{attr_node.node_name}"
@@ -35,14 +35,14 @@ module Loofah
 
             if SafeList::ATTR_VAL_IS_URI.include?(attr_name)
               # this block lifted nearly verbatim from HTML5 sanitization
-              val_unescaped = CGI.unescapeHTML(attr_node.value).gsub(CONTROL_CHARACTERS,'').downcase
-              if val_unescaped =~ /^[a-z0-9][-+.a-z0-9]*:/ && ! SafeList::ALLOWED_PROTOCOLS.include?(val_unescaped.split(SafeList::PROTOCOL_SEPARATOR)[0])
+              val_unescaped = CGI.unescapeHTML(attr_node.value).gsub(CONTROL_CHARACTERS, "").downcase
+              if val_unescaped =~ /^[a-z0-9][-+.a-z0-9]*:/ && !SafeList::ALLOWED_PROTOCOLS.include?(val_unescaped.split(SafeList::PROTOCOL_SEPARATOR)[0])
                 attr_node.remove
                 next
-              elsif val_unescaped.split(SafeList::PROTOCOL_SEPARATOR)[0] == 'data'
+              elsif val_unescaped.split(SafeList::PROTOCOL_SEPARATOR)[0] == "data"
                 # permit only allowed data mediatypes
                 mediatype = val_unescaped.split(SafeList::PROTOCOL_SEPARATOR)[1]
-                mediatype, _ = mediatype.split(';')[0..1] if mediatype
+                mediatype, _ = mediatype.split(";")[0..1] if mediatype
                 if mediatype && !SafeList::ALLOWED_URI_DATA_MEDIATYPES.include?(mediatype)
                   attr_node.remove
                   next
@@ -50,9 +50,9 @@ module Loofah
               end
             end
             if SafeList::SVG_ATTR_VAL_ALLOWS_REF.include?(attr_name)
-              attr_node.value = attr_node.value.gsub(/url\s*\(\s*[^#\s][^)]+?\)/m, ' ') if attr_node.value
+              attr_node.value = attr_node.value.gsub(/url\s*\(\s*[^#\s][^)]+?\)/m, " ") if attr_node.value
             end
-            if SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) && attr_name == 'xlink:href' && attr_node.value =~ /^\s*[^#\s].*/m
+            if SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) && attr_name == "xlink:href" && attr_node.value =~ /^\s*[^#\s].*/m
               attr_node.remove
               next
             end
@@ -67,12 +67,12 @@ module Loofah
           force_correct_attribute_escaping! node
         end
 
-        def scrub_css_attribute node
-          style = node.attributes['style']
+        def scrub_css_attribute(node)
+          style = node.attributes["style"]
           style.value = scrub_css(style.value) if style
         end
 
-        def scrub_css style
+        def scrub_css(style)
           style_tree = Crass.parse_properties style
           sanitized_tree = []
 
@@ -84,13 +84,14 @@ module Loofah
             name = node[:name].downcase
             if SafeList::ALLOWED_CSS_PROPERTIES.include?(name) || SafeList::ALLOWED_SVG_PROPERTIES.include?(name)
               sanitized_tree << node << CRASS_SEMICOLON
-            elsif SafeList::SHORTHAND_CSS_PROPERTIES.include?(name.split('-').first)
+            elsif SafeList::SHORTHAND_CSS_PROPERTIES.include?(name.split("-").first)
               value = node[:value].split.map do |keyword|
                 if SafeList::ALLOWED_CSS_KEYWORDS.include?(keyword) || keyword =~ CSS_KEYWORDISH
                   keyword
                 end
               end.compact
               unless value.empty?
+                value << CSS_IMPORTANT if node[:important]
                 propstring = sprintf "%s:%s", name, value.join(" ")
                 sanitized_node = Crass.parse_properties(propstring).first
                 sanitized_tree << sanitized_node << CRASS_SEMICOLON
@@ -106,7 +107,7 @@ module Loofah
         #
         #  see comments about CVE-2018-8048 within the tests for more information
         #
-        def force_correct_attribute_escaping! node
+        def force_correct_attribute_escaping!(node)
           return unless Nokogiri::VersionInfo.instance.libxml2?
 
           node.attribute_nodes.each do |attr_node|
@@ -122,11 +123,10 @@ module Loofah
             #
             encoding = attr_node.value.encoding
             attr_node.value = attr_node.value.gsub(/[ "]/) do |m|
-              '%' + m.unpack('H2' * m.bytesize).join('%').upcase
+              "%" + m.unpack("H2" * m.bytesize).join("%").upcase
             end.force_encoding(encoding)
           end
         end
-
       end
     end
   end