makeup 0.4.2 → 0.4.3

data/.gitignore

@@ -1,2 +1,3 @@
 coverage
 test/reports
+Gemfile.lock

data/lib/makeup/markup.rb

@@ -22,6 +22,7 @@
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 # SOFTWARE.
 #++
+require "loofah"
 require "github/markup"
 require "makeup/code_block_parser"
 require "makeup/syntax_highlighter"
@@ -56,7 +57,11 @@ module Makeup
 
     def render(path, content)
       content = highlight_code_blocks(path, content)
-      GitHub::Markup.render(path, content)
+      sanitize(GitHub::Markup.render(path, content))
+    end
+
+    def sanitize(html)
+      Loofah.fragment(html).scrub!(:prune).to_s
     end
 
     def highlight_code_blocks(path, markup)

data/lib/makeup/version.rb

@@ -24,5 +24,5 @@
 #++
 
 module Makeup
-  VERSION = "0.4.2"
+  VERSION = "0.4.3"
 end

data/makeup.gemspec

@@ -21,6 +21,7 @@ markdown files.
   s.add_dependency "github-linguist", "~>2.8"
   s.add_dependency "github-markup", "~> 0.7"
   s.add_dependency "htmlentities", "~> 4.3"
+  s.add_dependency "loofah", "~> 1.2"
 
   s.add_development_dependency "minitest", "~> 2.0"
   s.add_development_dependency "rake", "~> 0.9"

data/test/makeup/markup_test.rb

@@ -62,6 +62,18 @@ describe Makeup::Markup do
 
       assert_equal 2, html.scan(/common-lisp/).length
     end
+
+    it "strips unsafe html attributes and elements" do
+      md = <<-MD
+<script>alert("foo")</script>
+<a href="foo" data-destroy="boom" onclick="alert('foo')">link</a>
+*bar*
+      MD
+
+      html = @renderer.render("file.md", md)
+
+      assert_equal %Q{<p><a href="foo">link</a>\n<em>bar</em></p>}, html
+    end
   end
 
   describe "#render" do

metadata

@@ -1,18 +1,20 @@
 --- !ruby/object:Gem::Specification
 name: makeup
 version: !ruby/object:Gem::Version
-  version: 0.4.2
+  version: 0.4.3
+  prerelease: 
 platform: ruby
 authors:
 - Christian Johansen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-11-21 00:00:00.000000000 Z
+date: 2013-12-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: pygments.rb
   requirement: !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -23,6 +25,7 @@ dependencies:
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -33,6 +36,7 @@ dependencies:
 - !ruby/object:Gem::Dependency
   name: github-linguist
   requirement: !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -40,6 +44,7 @@ dependencies:
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -47,6 +52,7 @@ dependencies:
 - !ruby/object:Gem::Dependency
   name: github-markup
   requirement: !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -54,6 +60,7 @@ dependencies:
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -61,6 +68,7 @@ dependencies:
 - !ruby/object:Gem::Dependency
   name: htmlentities
   requirement: !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -68,13 +76,31 @@ dependencies:
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
         version: '4.3'
+- !ruby/object:Gem::Dependency
+  name: loofah
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '1.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '1.2'
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -82,6 +108,7 @@ dependencies:
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -89,6 +116,7 @@ dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -96,6 +124,7 @@ dependencies:
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -103,6 +132,7 @@ dependencies:
 - !ruby/object:Gem::Dependency
   name: redcarpet
   requirement: !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - '='
       - !ruby/object:Gem::Version
@@ -110,14 +140,19 @@ dependencies:
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - '='
       - !ruby/object:Gem::Version
         version: 2.2.0
-description: |
-  Makeup provides markup rendering and code highlighting. It renders all kinds of
+description: ! 'Makeup provides markup rendering and code highlighting. It renders
+  all kinds of
+
   markup formats using GitHub::Markup, and implements "fenced code blocks" for
+
   markdown files.
+
+'
 email:
 - christian@gitorious.org
 executables: []
@@ -127,7 +162,6 @@ files:
 - .gitignore
 - .travis.yml
 - Gemfile
-- Gemfile.lock
 - Rakefile
 - Readme.md
 - lib/makeup.rb
@@ -141,25 +175,32 @@ files:
 - test/test_helper.rb
 homepage: http://gitorious.org/gitorious/makeup
 licenses: []
-metadata: {}
 post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
   requirements:
-  - - '>='
+  - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
+      segments:
+      - 0
+      hash: -3804366775395324945
 required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
   requirements:
-  - - '>='
+  - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
+      segments:
+      - 0
+      hash: -3804366775395324945
 requirements: []
 rubyforge_project: makeup
-rubygems_version: 2.0.3
+rubygems_version: 1.8.25
 signing_key: 
-specification_version: 4
+specification_version: 3
 summary: Pretty markup
 test_files: []

checksums.yaml

@@ -1,7 +0,0 @@
----
-SHA1:
-  metadata.gz: 379ce4e847dbec503944870569ff1457cbec0e2c
-  data.tar.gz: 3629cba614b795458796194237ed7a89a70b7fe3
-SHA512:
-  metadata.gz: 6de41d16b978fc8d73aaf826f6d4b3841293a43283d4e777dbbc0560f0d60610db8e43de32415ed67c49fe54abd0ea513b559d761e9ad65ab5c215dd83626f42
-  data.tar.gz: a8861ab5ba65ef7e15d5d82d81beaa332a5bca5a6570b1b9d0e85381bef14f6fa8ef50769b5ff6657f3b777f850bb06f4428f8bb65623580bbd6a6d9dc558506

data/Gemfile.lock

@@ -1,51 +0,0 @@
-PATH
-  remote: .
-  specs:
-    makeup (0.4.1)
-      github-linguist (~> 2.8)
-      github-markup (~> 0.7)
-      htmlentities (~> 4.3)
-      pygments.rb (~> 0.4)
-
-GEM
-  remote: http://rubygems.org/
-  specs:
-    builder (3.2.2)
-    charlock_holmes (0.6.9.4)
-    ci_reporter (1.9.0)
-      builder (>= 2.1.2)
-    escape_utils (0.3.2)
-    github-linguist (2.8.5)
-      charlock_holmes (~> 0.6.6)
-      escape_utils (~> 0.3.1)
-      mime-types (~> 1.19)
-      pygments.rb (~> 0.4.2)
-    github-markup (0.7.5)
-    htmlentities (4.3.1)
-    mime-types (1.24)
-    minitest (2.12.1)
-    multi_json (1.7.7)
-    posix-spawn (0.3.6)
-    pygments.rb (0.4.2)
-      posix-spawn (~> 0.3.6)
-      yajl-ruby (~> 1.1.0)
-    rake (0.9.2.2)
-    rcov (1.0.0)
-    redcarpet (2.2.0)
-    simplecov (0.7.1)
-      multi_json (~> 1.0)
-      simplecov-html (~> 0.7.1)
-    simplecov-html (0.7.1)
-    yajl-ruby (1.1.0)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  ci_reporter
-  makeup!
-  minitest (~> 2.0)
-  rake (~> 0.9)
-  rcov
-  redcarpet (= 2.2.0)
-  simplecov