phlex 1.11.0 → 1.11.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 91e06f170cfccd6ef24d00ef34643293d36c9df7540ffb3fe482577c4a115898
-  data.tar.gz: 9eb38a0b368e1543789252f6ba8cb80df204b73fc81d413fc47b758adba191bc
+  metadata.gz: b009908cf2bca382857d9e6adaf26040bbc72df73b4227546e48888d508552f0
+  data.tar.gz: 560928a3386b32c8f0a94a31462d29b9ff73bcbeb9ecad1171399c1f749be871
 SHA512:
-  metadata.gz: 4f2587dff9519706d7ec91c2745da7570c74a097b0282c0462504a54cc296312f1aee386a6645f1df5e7f503e1398df72681d345d18e5866f13a4dfcd4c4db1c
-  data.tar.gz: 3de0960cc4510e025620308ed8ae6c0b5594d3ee8a153b11c5c3eabdc74d3aa94193717f9a6fbc47fa378e8b7bbcd171a35bcfa3f486e66800bffd8da01bc033
+  metadata.gz: eb282ecd7594914cd485309e270748d64e3b74bed6fd49ec98244ea34e1fb90cbba0ff542909ee59d3347dce6cde47604aeb67efae605ccfa554473ed8934f61
+  data.tar.gz: 05ff1300599f9360d07d249e27ee3ef84667c77268bbe25c92a0609686e594f45aa377068714690ca55ee925548d85406b84aa3b3bad26d2eb2c6beb2dd12bf4

data/lib/phlex/sgml.rb

@@ -4,6 +4,13 @@ module Phlex
 	# **Standard Generalized Markup Language** for behaviour common to {HTML} and {SVG}.
 	class SGML
 		include Helpers
+		REF_ATTRIBUTES = Set.new(%w[href src action formaction lowsrc dynsrc background ping xlinkhref]).freeze
+		NAMED_CHARACTER_REFERENCES = {
+			"colon" => ":",
+			"tab" => "\t",
+			"newline" => "\n",
+		}.freeze
+		UNSAFE_ATTRIBUTE_NAME_CHARS = %r([<>&"'/=\s\x00])
 
 		class << self
 			# Render the view to a String. Arguments are delegated to {.new}.
@@ -421,6 +428,27 @@ module Phlex
 			buffer
 		end
 
+		def decode_html_character_references(value)
+			value
+				.gsub(/&#x([0-9a-f]+);?/i) {
+					begin
+						[$1.to_i(16)].pack("U*")
+					rescue
+						""
+					end
+				}
+				.gsub(/&#(\d+);?/) {
+					begin
+						[$1.to_i].pack("U*")
+					rescue
+						""
+					end
+				}
+				.gsub(/&([a-z][a-z0-9]+);?/i) {
+					NAMED_CHARACTER_REFERENCES[$1.downcase] || ""
+				}
+		end
+
 		# @api private
 		def __build_attributes__(attributes, buffer:)
 			attributes.each do |k, v|
@@ -433,10 +461,21 @@ module Phlex
 				end
 
 				lower_name = name.downcase
-				next if lower_name == "href" && v.to_s.downcase.tr("^a-z:",	"").start_with?("javascript:")
+				normalized_name = lower_name.delete("^a-z")
+
+				if REF_ATTRIBUTES.include?(normalized_name)
+					decoded_value = case v
+						when String then decode_html_character_references(v)
+						when Symbol then decode_html_character_references(v.name)
+					end
+
+					if decoded_value && decoded_value.downcase.tr("^a-z:", "").start_with?("javascript:")
+						next
+					end
+				end
 
 				# Detect unsafe attribute names. Attribute names are considered unsafe if they match an event attribute or include unsafe characters.
-				if HTML::EVENT_ATTRIBUTES.include?(lower_name.tr("^a-z-", "")) || name.match?(/[<>&"']/)
+				if HTML::EVENT_ATTRIBUTES.include?(lower_name.tr("^a-z-", "")) || name.match?(UNSAFE_ATTRIBUTE_NAME_CHARS)
 					raise ArgumentError, "Unsafe attribute name detected: #{k}."
 				end
 

data/lib/phlex/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Phlex
-	VERSION = "1.11.0"
+	VERSION = "1.11.1"
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: phlex
 version: !ruby/object:Gem::Version
-  version: 1.11.0
+  version: 1.11.1
 platform: ruby
 authors:
 - Joel Drapper
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-07-06 00:00:00.000000000 Z
+date: 2026-02-06 00:00:00.000000000 Z
 dependencies: []
 description: A high-performance view framework optimised for fun.
 email:
@@ -47,7 +46,6 @@ metadata:
   changelog_uri: https://github.com/phlex-ruby/phlex/blob/main/CHANGELOG.md
   funding_uri: https://github.com/sponsors/joeldrapper
   rubygems_mfa_required: 'true'
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -62,8 +60,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.13
-signing_key:
+rubygems_version: 3.6.2
 specification_version: 4
 summary: A fun framework for building views in Ruby.
 test_files: []