loofah 2.3.1 → 2.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1196afab25d29644d1961e4516ac317a2c38dee3295f35354c468e6a9318fa55
-  data.tar.gz: 2e07ff641edb37d2b0dce2933288da4667d4b680a586912af9c171db7dfb0a63
+  metadata.gz: 29f0764dd4fc0eed44139b573bd3708917cab618126b094b9faa42d26a29d949
+  data.tar.gz: e1e9cc2ecbd68de48d1f2554a65b86bed0756616008cf9c9a7ed62af1197afa4
 SHA512:
-  metadata.gz: 37ac2cdb0d136da417cff62e3845c5b71769f044d8150c636a549dc9ca4cf98bcef4c6d2b6e653eff56922b95d812ed39310a406c49366c14791456ca905e8fe
-  data.tar.gz: 0fa3cdd75a3d2950801a1cfe7f8d4cad6bb73bbec67d24ba25980c09a565f6c95c5d664c1789ccd62486d1917c685a5b0f762cc073a054bbb0f02fb0222688f0
+  metadata.gz: 05bc54adcab4ee55e52f69685366ba81e492a6b6c25c8e282d79d4ec85349f8ac37c3e34b74ed81089bda662ebed620c208a7a46bc64f4a504ec1bf51f7c8bf9
+  data.tar.gz: 8b0e5d75ab88d683240183b5b3e4ed3d1a1fd26bac0d89780ce64722a3d05cba95c42376208e294ad1b3b215fcb90a795e479a2d0e8a3fd643d3b136e88bb562

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 2.4.0 / 2019-11-25
+
+### Features
+
+* Allow CSS property `max-width` [#175] (Thanks, @bchaney!)
+* Allow CSS sizes expressed in `rem` [#176, #177]
+* Add `frozen_string_literal: true` magic comment to all `lib` files. [#118]
+
+
 ## 2.3.1 / 2019-10-22
 
 ### Security

data/Gemfile

@@ -7,16 +7,17 @@ source "https://rubygems.org/"
 gem "nokogiri", ">=1.5.9"
 gem "crass", "~>1.0.2"
 
-gem "rake", ">=0.8", :group => [:development, :test]
+gem "rake", "~>12.3", :group => [:development, :test]
 gem "minitest", "~>2.2", :group => [:development, :test]
 gem "rr", "~>1.2.0", :group => [:development, :test]
-gem "json", ">=0", :group => [:development, :test]
-gem "hoe-gemspec", ">=0", :group => [:development, :test]
-gem "hoe-debugging", ">=0", :group => [:development, :test]
-gem "hoe-bundler", ">=0", :group => [:development, :test]
-gem "hoe-git", ">=0", :group => [:development, :test]
+gem "json", "~>2.2.0", :group => [:development, :test]
+gem "hoe-gemspec", "~>1.0", :group => [:development, :test]
+gem "hoe-debugging", "~>2.0", :group => [:development, :test]
+gem "hoe-bundler", "~>1.5", :group => [:development, :test]
+gem "hoe-git", "~>1.6", :group => [:development, :test]
 gem "concourse", ">=0.26.0", :group => [:development, :test]
+gem "rubocop", ">=0.76.0", :group => [:development, :test]
 gem "rdoc", ">=4.0", "<7", :group => [:development, :test]
-gem "hoe", "~>3.17", :group => [:development, :test]
+gem "hoe", "~>3.20", :group => [:development, :test]
 
 # vim: syntax=ruby

data/Rakefile

@@ -28,6 +28,7 @@ Hoe.spec "loofah" do
   extra_dev_deps << ["hoe-bundler", "~> 1.5"]
   extra_dev_deps << ["hoe-git", "~> 1.6"]
   extra_dev_deps << ["concourse", ">=0.26.0"]
+  extra_dev_deps << ["rubocop", ">=0.76.0"]
 end
 
 task :gemspec do
@@ -75,6 +76,15 @@ task :generate_safelists do
   load "tasks/generate-safelists"
 end
 
+task :rubocop => [:rubocop_security, :rubocop_frozen_string_literals]
+task :rubocop_security do
+  sh "rubocop lib --only Security"
+end
+task :rubocop_frozen_string_literals do
+  sh "rubocop lib --auto-correct --only Style/FrozenStringLiteralComment"
+end
+Rake::Task[:test].prerequisites << :rubocop
+
 Concourse.new("loofah", fly_target: "ci") do |c|
   c.add_pipeline "loofah", "loofah.yml"
   c.add_pipeline "loofah-pr", "loofah-pr.yml"

data/lib/loofah.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 $LOAD_PATH.unshift(File.expand_path(File.dirname(__FILE__))) unless $LOAD_PATH.include?(File.expand_path(File.dirname(__FILE__)))
 
 require "nokogiri"
@@ -28,7 +29,7 @@ require "loofah/html/document_fragment"
 #
 module Loofah
   # The version of Loofah you are using
-  VERSION = "2.3.1"
+  VERSION = "2.4.0"
 
   class << self
     # Shortcut for Loofah::HTML::Document.parse

data/lib/loofah/elements.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'set'
 
 module Loofah

data/lib/loofah/helpers.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Loofah
   module Helpers
     class << self

data/lib/loofah/html/document.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Loofah
   module HTML # :nodoc:
     #

data/lib/loofah/html/document_fragment.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Loofah
   module HTML # :nodoc:
     #

data/lib/loofah/html5/libxml2_workarounds.rb

@@ -1,4 +1,5 @@
 # coding: utf-8
+# frozen_string_literal: true
 require 'set'
 
 module Loofah

data/lib/loofah/html5/safelist.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require "set"
 
 module Loofah
@@ -573,6 +574,7 @@ module Loofah
                                             "line-height",
                                             "list-style",
                                             "list-style-type",
+                                            "max-width",
                                             "overflow",
                                             "pause",
                                             "pause-after",

data/lib/loofah/html5/scrub.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'cgi'
 require 'crass'
 
@@ -6,7 +7,7 @@ module Loofah
     module Scrub
 
       CONTROL_CHARACTERS = /[`\u0000-\u0020\u007f\u0080-\u0101]/
-      CSS_KEYWORDISH = /\A(#[0-9a-fA-F]+|rgb\(\d+%?,\d*%?,?\d*%?\)?|-?\d{0,3}\.?\d{0,10}(cm|em|ex|in|mm|pc|pt|px|%|,|\))?)\z/
+      CSS_KEYWORDISH = /\A(#[0-9a-fA-F]+|rgb\(\d+%?,\d*%?,?\d*%?\)?|-?\d{0,3}\.?\d{0,10}(cm|r?em|ex|in|mm|pc|pt|px|%|,|\))?)\z/
       CRASS_SEMICOLON = {:node => :semicolon, :raw => ";"}
 
       class << self

data/lib/loofah/instance_methods.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Loofah
   #
   #  Mixes +scrub!+ into Document, DocumentFragment, Node and NodeSet.

data/lib/loofah/metahelpers.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Loofah
   module MetaHelpers # :nodoc:
     def self.add_downcased_set_members_to_all_set_constants mojule

data/lib/loofah/scrubber.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Loofah
   #
   #  A RuntimeError raised when Loofah could not find an appropriate scrubber.

data/lib/loofah/scrubbers.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Loofah
   #
   #  Loofah provides some built-in scrubbers for sanitizing with

data/lib/loofah/xml/document.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Loofah
   module XML # :nodoc:
     #

data/lib/loofah/xml/document_fragment.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Loofah
   module XML # :nodoc:
     #

data/test/html5/test_sanitizer.rb

@@ -294,6 +294,12 @@ class Html5TestSanitizer < Loofah::TestCase
     assert_match %r/0.3333333334em/, sane.inner_html
   end
 
+  def test_css_rem_value
+    html = "<span style=\"margin-top:10rem;\">"
+    sane = Nokogiri::HTML(Loofah.scrub_fragment(html, :escape).to_xml)
+    assert_match %r/10rem/, sane.inner_html
+  end
+
   def test_css_function_sanitization_leaves_safelisted_functions_calc
     html = "<span style=\"width:calc(5%)\">"
     sane = Nokogiri::HTML(Loofah.scrub_fragment(html, :strip).to_html)
@@ -326,6 +332,13 @@ class Html5TestSanitizer < Loofah::TestCase
     assert_match %r/<span><\/span>/, sane.inner_html
   end
 
+  def test_css_max_width
+    html = '<div style="max-width: 100%;"></div>'
+    sane = Nokogiri::HTML(Loofah.scrub_fragment(html, :escape).to_xml)
+    assert_match %r/max-width/, sane.inner_html
+  end
+
+
   def test_issue_90_slow_regex
     skip("timing tests are hard to make pass and have little regression-testing value")
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: loofah
 version: !ruby/object:Gem::Version
-  version: 2.3.1
+  version: 2.4.0
 platform: ruby
 authors:
 - Mike Dalessio
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-10-22 00:00:00.000000000 Z
+date: 2019-11-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri
@@ -165,6 +165,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 0.26.0
+- !ruby/object:Gem::Dependency
+  name: rubocop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.76.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.76.0
 - !ruby/object:Gem::Dependency
   name: rdoc
   requirement: !ruby/object:Gem::Requirement
@@ -191,14 +205,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.18'
+        version: '3.20'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.18'
+        version: '3.20'
 description: |-
   Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri.
 
@@ -261,7 +275,8 @@ files:
 homepage: https://github.com/flavorjones/loofah
 licenses:
 - MIT
-metadata: {}
+metadata:
+  homepage_uri: https://github.com/flavorjones/loofah
 post_install_message: 
 rdoc_options:
 - "--main"