loofah 2.2.1 → 2.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 55986c6edc7d96bf6301f01ed6c8474a0e0eedc3
-  data.tar.gz: e1e5ef44e194bd9333cfc92f9d182bedaac5799c
+  metadata.gz: 9445f9115cb9fbe0677be8a93170729ddc04cfaa
+  data.tar.gz: b39cfde37a7ee10027da8e29052785b41965299e
 SHA512:
-  metadata.gz: 7d45dbc3cb1e275e81f127e92107ba540da3f8294d486e927325cd9a8cb8c742ba1f34c14101b46437242b3778911c3f7392bf822b2dbeccd835410f52ca757f
-  data.tar.gz: 70318ae204e34718bbdf818c6be1d302e5377eec163ff1380556e219443d1d0c42887f5e6e69b4d2ef8876e6cbbaa4f2f7f84d73fe71e13bbe1b2d10b199e072
+  metadata.gz: ffb7c7bdec7a1fb813ccd81d8841779d57304d32e7b34f99d3bdec2407aafd96562d7a15a8758b0abe63dbbb8b1b078b396ab5ce55ed2a168f5f8fff4dce5c50
+  data.tar.gz: 3ed294bf7beaeb073c688a46c8bbc2d6ef870afe09e1ca0c09ad144b93f06ef02638757176a53baf86eb3f1311833acf18fe94f47ad8d55d63302fb19c7ec666

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 2.2.2 / 2018-03-22
+
+Make public `Loofah::HTML5::Scrub.force_correct_attribute_escaping!`,
+which was previously a private method. This is so that downstream gems
+(like rails-html-sanitizer) can use this logic directly for their own
+attribute scrubbers should they need to address CVE-2018-8048.
+
+
 ## 2.2.1 / 2018-03-19
 
 Addresses CVE-2018-8048. Loofah allowed non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments.

data/lib/loofah.rb

@@ -28,7 +28,7 @@ require 'loofah/html/document_fragment'
 #
 module Loofah
   # The version of Loofah you are using
-  VERSION = '2.2.1'
+  VERSION = '2.2.2'
 
   class << self
     # Shortcut for Loofah::HTML::Document.parse

data/lib/loofah/html5/scrub.rb

@@ -101,8 +101,6 @@ module Loofah
           Crass::Parser.stringify sanitized_tree
         end
 
-        private
-
         #
         #  libxml2 >= 2.9.2 fails to escape comments within some attributes.
         #

data/test/integration/test_ad_hoc.rb

@@ -231,7 +231,7 @@ mso-bidi-language:#0400;}
         attributes = reparsed.at_css(config[:tag]).attribute_nodes
 
         assert_equal [config[:attr]], attributes.collect(&:name)
-        if Nokogiri::VersionInfo.new.libxml2?
+        if Nokogiri::VersionInfo.instance.libxml2?
           if config[:unescaped]
             #
             #  this attribute was emitted wrapped in single-quotes, so a double quote is A-OK.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: loofah
 version: !ruby/object:Gem::Version
-  version: 2.2.1
+  version: 2.2.2
 platform: ruby
 authors:
 - Mike Dalessio
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-03-19 00:00:00.000000000 Z
+date: 2018-03-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri