loofah 2.9.0 → 2.12.0

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.

This version of loofah might be problematic. Click here for more details.

Files changed (7) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +41 -2
  3. data/README.md +3 -4
  4. data/lib/loofah/html5/safelist.rb +11 -7
  5. data/lib/loofah/html5/scrub.rb +11 -3
  6. data/lib/loofah/version.rb +1 -1
  7. metadata +36 -50
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 10f6e8ff06a760da3400cdf8660e6768cfc2e7bbcb34a3ae6aaadea5e29ff924
4
- data.tar.gz: 7e0accdb26147612bd7da3abc8fa98a6fac850dbb7a0ee99d20375400de4b877
3
+ metadata.gz: c868e8e66e94839a6486619672b3aa05b3f1b2d59987290eded52829fbe5ee9e
4
+ data.tar.gz: 7610aa28be173f2ad1e917fa01ef783a96189cc5ee98ce8878983f67ad46661d
5
5
  SHA512:
6
- metadata.gz: 11b0f4dcad5a9f38444e9eebd45cb09705e536468c901c03d792711133536812f8b0579533eb54a305311d5303fdd4cf510761a9a0d42d0af46bb153d3402a3c
7
- data.tar.gz: d6032694eaaaddd47c02868ecb037dc2673b5ebd749a7d8846c2a55e13744f9455a66b41ec16a4cf3c4905e6019df3493972ec462cd04404365ebe202e15e211
6
+ metadata.gz: 6676ba0100a6348670618e03015be589c207290880a91cd86c8502767cf7f6a9a91aa2d19d8cc9131a18537f74eb5440f273430f3cc27ebf4c6691259ddf3c7b
7
+ data.tar.gz: 4a9f90a2bf23dcb52a3b4a1ee7d8ace37ee310c14495fb749e7d4defc8b4a6dc4542b53b8cf6ea7579c70f753478ed523b29fbb13b6f1509fa47d422f0074b75
data/CHANGELOG.md CHANGED
@@ -1,11 +1,50 @@
1
1
  # Changelog
2
2
 
3
- ### 2.9.0 / 2021-01-14
3
+ ## 2.12.0 / 2021-08-11
4
+
5
+ ### Features
6
+
7
+ * Support empty HTML5 data attributes. [[#215](https://github.com/flavorjones/loofah/issues/215)]
8
+
9
+
10
+ ## 2.11.0 / 2021-07-31
11
+
12
+ ### Features
13
+
14
+ * Allow HTML5 element `wbr`.
15
+ * Allow all CSS property values for `border-collapse`. [[#201](https://github.com/flavorjones/loofah/issues/201)]
16
+
17
+
18
+ ### Changes
19
+
20
+ * Deprecating `Loofah::HTML5::SafeList::VOID_ELEMENTS` which is not a canonical list of void HTML4 or HTML5 elements.
21
+ * Removed some elements from `Loofah::HTML5::SafeList::VOID_ELEMENTS` that either are not acceptable elements or aren't considered "void" by libxml2.
22
+
23
+
24
+ ## 2.10.0 / 2021-06-06
25
+
26
+ ### Features
27
+
28
+ * Allow CSS properties `overflow-x` and `overflow-y`. [[#206](https://github.com/flavorjones/loofah/issues/206)] (Thanks, [@sampokuokkanen](https://github.com/sampokuokkanen)!)
29
+
30
+
31
+ ## 2.9.1 / 2021-04-07
32
+
33
+ ### Bug fixes
34
+
35
+ * Fix a regression in v2.9.0 which inappropriately removed CSS properties with quoted string values. [[#202](https://github.com/flavorjones/loofah/issues/202)]
36
+
37
+
38
+ ## 2.9.0 / 2021-01-14
39
+
40
+ ### Features
4
41
 
5
42
  * Handle CSS functions in a CSS shorthand property (like `background`). [[#199](https://github.com/flavorjones/loofah/issues/199), [#200](https://github.com/flavorjones/loofah/issues/200)]
6
43
 
7
44
 
8
- ### 2.8.0 / 2020-11-25
45
+ ## 2.8.0 / 2020-11-25
46
+
47
+ ### Features
9
48
 
10
49
  * Allow CSS properties `order`, `flex-direction`, `flex-grow`, `flex-wrap`, `flex-shrink`, `flex-flow`, `flex-basis`, `flex`, `justify-content`, `align-self`, `align-items`, and `align-content`. [[#197](https://github.com/flavorjones/loofah/issues/197)] (Thanks, [@miguelperez](https://github.com/miguelperez)!)
11
50
 
data/README.md CHANGED
@@ -1,13 +1,12 @@
1
1
  # Loofah
2
2
 
3
3
  * https://github.com/flavorjones/loofah
4
- * Docs: http://rubydoc.info/github/flavorjones/loofah/master/frames
4
+ * Docs: http://rubydoc.info/github/flavorjones/loofah/main/frames
5
5
  * Mailing list: [loofah-talk@googlegroups.com](https://groups.google.com/forum/#!forum/loofah-talk)
6
6
 
7
7
  ## Status
8
8
 
9
- [![Concourse CI](https://ci.nokogiri.org/api/v1/teams/nokogiri-core/pipelines/loofah/jobs/ruby-2.5/badge)](https://ci.nokogiri.org/teams/nokogiri-core/pipelines/loofah?groups=master)
10
- [![Code Climate](https://codeclimate.com/github/flavorjones/loofah.svg)](https://codeclimate.com/github/flavorjones/loofah)
9
+ [![ci](https://github.com/flavorjones/loofah/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/flavorjones/loofah/actions/workflows/ci.yml)
11
10
  [![Tidelift dependencies](https://tidelift.com/badges/package/rubygems/loofah)](https://tidelift.com/subscription/pkg/rubygems-loofah?utm_source=rubygems-loofah&utm_medium=referral&utm_campaign=readme)
12
11
 
13
12
 
@@ -211,7 +210,7 @@ end
211
210
  Loofah.xml_document(File.read('plague.xml')).scrub!(bring_out_your_dead)
212
211
  ```
213
212
 
214
- === Built-In HTML Scrubbers
213
+ ### Built-In HTML Scrubbers
215
214
 
216
215
  Loofah comes with a set of sanitizing scrubbers that use HTML5lib's
217
216
  safelist algorithm:
data/lib/loofah/html5/safelist.rb CHANGED
@@ -140,6 +140,7 @@ module Loofah
140
140
  "ul",
141
141
  "var",
142
142
  "video",
143
+ "wbr",
143
144
  ])
144
145
 
145
146
  MATHML_ELEMENTS = Set.new([
@@ -588,6 +589,8 @@ module Loofah
588
589
  "max-width",
589
590
  "order",
590
591
  "overflow",
592
+ "overflow-x",
593
+ "overflow-y",
591
594
  "page-break-after",
592
595
  "page-break-before",
593
596
  "page-break-inside",
@@ -635,6 +638,8 @@ module Loofah
635
638
  "green",
636
639
  "groove",
637
640
  "hidden",
641
+ "inherit",
642
+ "initial",
638
643
  "inset",
639
644
  "italic",
640
645
  "left",
@@ -650,16 +655,19 @@ module Loofah
650
655
  "pointer",
651
656
  "purple",
652
657
  "red",
658
+ "revert",
653
659
  "ridge",
654
660
  "right",
661
+ "separate",
655
662
  "silver",
656
663
  "solid",
657
664
  "teal",
658
- "thin",
659
665
  "thick",
666
+ "thin",
660
667
  "top",
661
668
  "transparent",
662
669
  "underline",
670
+ "unset",
663
671
  "white",
664
672
  "yellow",
665
673
  ])
@@ -786,18 +794,14 @@ module Loofah
786
794
  ALLOWED_PROTOCOLS = ACCEPTABLE_PROTOCOLS
787
795
  ALLOWED_URI_DATA_MEDIATYPES = ACCEPTABLE_URI_DATA_MEDIATYPES
788
796
 
797
+ # TODO: remove VOID_ELEMENTS in a future major release
798
+ # and put it in the tests (it is used only for testing, not for functional behavior)
789
799
  VOID_ELEMENTS = Set.new([
790
800
  "area",
791
- "base",
792
801
  "br",
793
- "col",
794
- "embed",
795
802
  "hr",
796
803
  "img",
797
804
  "input",
798
- "link",
799
- "meta",
800
- "param",
801
805
  ])
802
806
 
803
807
  # additional tags we should consider safe since we have libxml2 fixing up our documents.
data/lib/loofah/html5/scrub.rb CHANGED
@@ -9,6 +9,8 @@ module Loofah
9
9
  CSS_KEYWORDISH = /\A(#[0-9a-fA-F]+|rgb\(\d+%?,\d*%?,?\d*%?\)?|-?\d{0,3}\.?\d{0,10}(ch|cm|r?em|ex|in|lh|mm|pc|pt|px|Q|vmax|vmin|vw|vh|%|,|\))?)\z/
10
10
  CRASS_SEMICOLON = { node: :semicolon, raw: ";" }
11
11
  CSS_IMPORTANT = '!important'
12
+ CSS_PROPERTY_STRING_WITHOUT_EMBEDDED_QUOTES = /\A(["'])?[^"']+\1\z/
13
+ DATA_ATTRIBUTE_NAME = /\Adata-[\w-]+\z/
12
14
 
13
15
  class << self
14
16
  def allowed_element?(element_name)
@@ -24,7 +26,7 @@ module Loofah
24
26
  attr_node.node_name
25
27
  end
26
28
 
27
- if attr_name =~ /\Adata-[\w-]+\z/
29
+ if attr_name =~ DATA_ATTRIBUTE_NAME
28
30
  next
29
31
  end
30
32
 
@@ -61,7 +63,9 @@ module Loofah
61
63
  scrub_css_attribute(node)
62
64
 
63
65
  node.attribute_nodes.each do |attr_node|
64
- node.remove_attribute(attr_node.name) if attr_node.value !~ /[^[:space:]]/
66
+ if attr_node.value !~ /[^[:space:]]/ && attr_node.name !~ DATA_ATTRIBUTE_NAME
67
+ node.remove_attribute(attr_node.name)
68
+ end
65
69
  end
66
70
 
67
71
  force_correct_attribute_escaping!(node)
@@ -92,7 +96,11 @@ module Loofah
92
96
  when :whitespace
93
97
  nil
94
98
  when :string
95
- nil
99
+ if child[:raw] =~ CSS_PROPERTY_STRING_WITHOUT_EMBEDDED_QUOTES
100
+ Crass::Parser.stringify(child)
101
+ else
102
+ nil
103
+ end
96
104
  when :function
97
105
  if SafeList::ALLOWED_CSS_FUNCTIONS.include?(child[:name].downcase)
98
106
  Crass::Parser.stringify(child)
data/lib/loofah/version.rb CHANGED
@@ -1,5 +1,5 @@
1
1
  # frozen_string_literal: true
2
2
  module Loofah
3
3
  # The version of Loofah you are using
4
- VERSION = "2.9.0"
4
+ VERSION = "2.12.0"
5
5
  end
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: loofah
3
3
  version: !ruby/object:Gem::Version
4
- version: 2.9.0
4
+ version: 2.12.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Mike Dalessio
@@ -9,22 +9,8 @@ authors:
9
9
  autorequire:
10
10
  bindir: bin
11
11
  cert_chain: []
12
- date: 2021-01-14 00:00:00.000000000 Z
12
+ date: 2021-08-11 00:00:00.000000000 Z
13
13
  dependencies:
14
- - !ruby/object:Gem::Dependency
15
- name: nokogiri
16
- requirement: !ruby/object:Gem::Requirement
17
- requirements:
18
- - - ">="
19
- - !ruby/object:Gem::Version
20
- version: 1.5.9
21
- type: :runtime
22
- prerelease: false
23
- version_requirements: !ruby/object:Gem::Requirement
24
- requirements:
25
- - - ">="
26
- - !ruby/object:Gem::Version
27
- version: 1.5.9
28
14
  - !ruby/object:Gem::Dependency
29
15
  name: crass
30
16
  requirement: !ruby/object:Gem::Requirement
@@ -40,47 +26,33 @@ dependencies:
40
26
  - !ruby/object:Gem::Version
41
27
  version: 1.0.2
42
28
  - !ruby/object:Gem::Dependency
43
- name: rake
44
- requirement: !ruby/object:Gem::Requirement
45
- requirements:
46
- - - "~>"
47
- - !ruby/object:Gem::Version
48
- version: '13.0'
49
- type: :development
50
- prerelease: false
51
- version_requirements: !ruby/object:Gem::Requirement
52
- requirements:
53
- - - "~>"
54
- - !ruby/object:Gem::Version
55
- version: '13.0'
56
- - !ruby/object:Gem::Dependency
57
- name: minitest
29
+ name: nokogiri
58
30
  requirement: !ruby/object:Gem::Requirement
59
31
  requirements:
60
- - - "~>"
32
+ - - ">="
61
33
  - !ruby/object:Gem::Version
62
- version: '5.14'
63
- type: :development
34
+ version: 1.5.9
35
+ type: :runtime
64
36
  prerelease: false
65
37
  version_requirements: !ruby/object:Gem::Requirement
66
38
  requirements:
67
- - - "~>"
39
+ - - ">="
68
40
  - !ruby/object:Gem::Version
69
- version: '5.14'
41
+ version: 1.5.9
70
42
  - !ruby/object:Gem::Dependency
71
- name: rr
43
+ name: hoe-markdown
72
44
  requirement: !ruby/object:Gem::Requirement
73
45
  requirements:
74
46
  - - "~>"
75
47
  - !ruby/object:Gem::Version
76
- version: 1.2.0
48
+ version: '1.3'
77
49
  type: :development
78
50
  prerelease: false
79
51
  version_requirements: !ruby/object:Gem::Requirement
80
52
  requirements:
81
53
  - - "~>"
82
54
  - !ruby/object:Gem::Version
83
- version: 1.2.0
55
+ version: '1.3'
84
56
  - !ruby/object:Gem::Dependency
85
57
  name: json
86
58
  requirement: !ruby/object:Gem::Requirement
@@ -96,33 +68,33 @@ dependencies:
96
68
  - !ruby/object:Gem::Version
97
69
  version: '2.2'
98
70
  - !ruby/object:Gem::Dependency
99
- name: concourse
71
+ name: minitest
100
72
  requirement: !ruby/object:Gem::Requirement
101
73
  requirements:
102
74
  - - "~>"
103
75
  - !ruby/object:Gem::Version
104
- version: '0.33'
76
+ version: '5.14'
105
77
  type: :development
106
78
  prerelease: false
107
79
  version_requirements: !ruby/object:Gem::Requirement
108
80
  requirements:
109
81
  - - "~>"
110
82
  - !ruby/object:Gem::Version
111
- version: '0.33'
83
+ version: '5.14'
112
84
  - !ruby/object:Gem::Dependency
113
- name: rubocop
85
+ name: rake
114
86
  requirement: !ruby/object:Gem::Requirement
115
87
  requirements:
116
88
  - - "~>"
117
89
  - !ruby/object:Gem::Version
118
- version: '1.1'
90
+ version: '13.0'
119
91
  type: :development
120
92
  prerelease: false
121
93
  version_requirements: !ruby/object:Gem::Requirement
122
94
  requirements:
123
95
  - - "~>"
124
96
  - !ruby/object:Gem::Version
125
- version: '1.1'
97
+ version: '13.0'
126
98
  - !ruby/object:Gem::Dependency
127
99
  name: rdoc
128
100
  requirement: !ruby/object:Gem::Requirement
@@ -144,19 +116,33 @@ dependencies:
144
116
  - !ruby/object:Gem::Version
145
117
  version: '7'
146
118
  - !ruby/object:Gem::Dependency
147
- name: hoe-markdown
119
+ name: rr
148
120
  requirement: !ruby/object:Gem::Requirement
149
121
  requirements:
150
122
  - - "~>"
151
123
  - !ruby/object:Gem::Version
152
- version: '1.3'
124
+ version: 1.2.0
153
125
  type: :development
154
126
  prerelease: false
155
127
  version_requirements: !ruby/object:Gem::Requirement
156
128
  requirements:
157
129
  - - "~>"
158
130
  - !ruby/object:Gem::Version
159
- version: '1.3'
131
+ version: 1.2.0
132
+ - !ruby/object:Gem::Dependency
133
+ name: rubocop
134
+ requirement: !ruby/object:Gem::Requirement
135
+ requirements:
136
+ - - "~>"
137
+ - !ruby/object:Gem::Version
138
+ version: '1.1'
139
+ type: :development
140
+ prerelease: false
141
+ version_requirements: !ruby/object:Gem::Requirement
142
+ requirements:
143
+ - - "~>"
144
+ - !ruby/object:Gem::Version
145
+ version: '1.1'
160
146
  description: |-
161
147
  Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri.
162
148
 
@@ -196,7 +182,7 @@ metadata:
196
182
  homepage_uri: https://github.com/flavorjones/loofah
197
183
  source_code_uri: https://github.com/flavorjones/loofah
198
184
  bug_tracker_uri: https://github.com/flavorjones/loofah/issues
199
- changelog_uri: https://github.com/flavorjones/loofah/blob/master/CHANGELOG.md
185
+ changelog_uri: https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md
200
186
  documentation_uri: https://www.rubydoc.info/gems/loofah/
201
187
  post_install_message:
202
188
  rdoc_options: []
@@ -213,7 +199,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
213
199
  - !ruby/object:Gem::Version
214
200
  version: '0'
215
201
  requirements: []
216
- rubygems_version: 3.1.4
202
+ rubygems_version: 3.2.15
217
203
  signing_key:
218
204
  specification_version: 4
219
205
  summary: Loofah is a general library for manipulating and transforming HTML/XML documents