premailer 1.29.0 → 1.32.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fa4f38aaadca592e45c38537b54ad6e88bd15c0c43c07efed0beb25af8194766
-  data.tar.gz: cde54fad4ac9397bd09b88509aa2b5a22daaa1721172a7c98e0e78c94e8707ad
+  metadata.gz: 2186c26ccc50f22227a6dbbf53b4cd3b5ae5f8bebdbdc190b0e7fd0e5a152565
+  data.tar.gz: 84becf9c1329983be14a427eef560806fb23ceb05847b7c5484033fe2fda0248
 SHA512:
-  metadata.gz: bc0358601f237a6ec2cf74764dfb28e5d800cf1ca486d88ca44a7e4d3913ade8ff00b76b98017fa6f565f5812bd6f9c3e66be819708a2764a70fca051458f09f
-  data.tar.gz: 9ea81979f54bd5fd9d8edb2e390e5900d53b7462064bc1465999dba639218db5a479c74e93e6e179d6d6a51abbf066685a21b033d5003899ab037a021db385f7
+  metadata.gz: c489d4a76330f66eeb60793faebc2839591870ee261179c0d9369ef95e5194d967f2b0f1aec31f16edb9355e363766fcb9245e67f13d2bb39b53cf1598ab8e36
+  data.tar.gz: 48a0cf85f5d2c2e3cbc2e7a5b21e70bf0e9e9215b2067703b9f9e5574342be25901aa639b1fcbdc3889e1d883905ad30e1e300d188fee68fd043f0de1588e2f2

data/README.md

@@ -127,6 +127,16 @@ Premailer.new(
 
 [available options](https://premailer.github.io/premailer/Premailer.html#initialize-instance_method)
 
+### Loading CSS from local/private hosts
+
+css_parser 3+ blocks fetching remote CSS (`<link>`, `@import`) from hosts that resolve to loopback/private IPs
+or do not resolve at all, to prevent SSRF.
+Those styles are silently dropped (unless `io_exceptions: true`).
+To allow them, when the html is trusted:
+```ruby
+Premailer.new(html, with_html_string: true, allow_local_network: true)
+```
+
 ## Support for CSS variables
 
 The gem does not automatically replace CSS variables with their static values.

data/lib/premailer/adapter/nokogiri.rb

@@ -15,10 +15,21 @@ class Premailer
         doc = @processed_doc
         @unmergable_rules = CssParser::Parser.new
 
+        # Accumulate matched rule sets per node in memory instead of
+        # round-tripping them through style attributes as [SPEC=n[...]]
+        # string markers (which costs two libxml2 attribute round-trips per
+        # element plus a regex re-scan, and dominates allocation churn).
+        rules_by_node = {}
+
         # Give all styles already in style attributes a specificity of 1000
         # per http://www.w3.org/TR/CSS21/cascade.html#specificity
+        # Identical style strings (repeated components) share one rule set so
+        # the fold cache below can hit on them.
+        rule_set_cache = {}
         doc.search("*[@style]").each do |el|
-          el['style'] = '[SPEC=1000[' + el.attributes['style'] + ']]'
+          style = el.attributes['style'].to_s
+          rs = rule_set_cache.fetch(style) { rule_set_cache[style] = build_rule_set(style, 1000) }
+          rules_by_node[el] = rs ? [rs] : []
         end
         # Iterate through the rules and merge them into the HTML
         @css_parser.each_selector(:all) do |selector, declaration, specificity, media_types|
@@ -42,11 +53,25 @@ class Premailer
               # than one element.  Added to work around dodgy generated code.
               selector.gsub!(/\A\#([\w_\-]+)\Z/, '*[@id=\1]')
 
+              rule_set = nil
+              rule_set_missing = false
               doc.search(selector).each do |el|
                 if el.elem? && ((el.name != 'head') && (el.parent.name != 'head'))
-                  # Add a style attribute or append to the existing one
-                  block = "[SPEC=#{specificity}[#{declaration}]]"
-                  el['style'] = (el.attributes['style'].to_s ||= '') + ' ' + block
+                  # Enroll the element even when the rule below fails to build:
+                  # the marker implementation wrote the style attribute before
+                  # parsing, so matched elements end up with style="" when
+                  # their only rule is invalid and exceptions are disabled.
+                  rules = (rules_by_node[el] ||= [])
+                  next if rule_set_missing
+
+                  # One shared rule set per CSS rule; merge never mutates inputs
+                  # (CachedRuleSet#expand_shorthand! is idempotent by design).
+                  rule_set ||= build_rule_set(declaration, specificity)
+                  if rule_set.nil?
+                    rule_set_missing = true
+                    next
+                  end
+                  rules << rule_set
                 end
               end
             rescue ::Nokogiri::SyntaxError, RuntimeError, ArgumentError
@@ -59,60 +84,28 @@ class Premailer
         # Remove script tags
         doc.search("script").remove if @options[:remove_scripts]
 
-        # Read STYLE attributes and perform folding
-        doc.search("*[@style]").each do |el|
-          style = el.attributes['style'].to_s
-
-          declarations = style.scan(/\[SPEC=([\d]+)\[(.[^\]]*)\]\]/m).filter_map do |declaration|
-            rs = Premailer::CachedRuleSet.new(block: declaration[1].to_s, specificity: declaration[0].to_i)
-            rs.expand_shorthand!
-            rs
-          rescue ArgumentError => e
-            raise e if @options[:rule_set_exceptions]
+        # Perform style folding. Elements sharing the same matched rule sets
+        # (ubiquitous in table-based email markup) fold to the same result, so
+        # the merge/expand/collapse/serialize pipeline runs once per unique
+        # (element name, rule list) pair instead of once per element.
+        fold_cache = {}
+        rules_by_node.each do |el, declarations|
+          related = Premailer::RELATED_ATTRIBUTES.key?(el.name) && @options[:css_to_attributes]
+          # Rule sets are interned above, so default identity hashing makes
+          # them usable directly as cache key elements.
+          cache_key = [related ? el.name : nil, *declarations]
+
+          folded = fold_cache[cache_key] ||= fold_declarations(declarations, related ? el.name : nil)
+          style, attributes = folded
+
+          # Write the inline STYLE attribute first so the attribute order for
+          # elements that had no style attribute matches the marker-based
+          # implementation (style attr was created during selector matching).
+          el['style'] = style
+
+          attributes&.each do |html_attr, value|
+            el[html_attr] = value if el[html_attr].nil?
           end
-
-          # Perform style folding
-          merged = CssParser.merge(declarations)
-          begin
-            merged.expand_shorthand!
-          rescue ArgumentError => e
-            raise e if @options[:rule_set_exceptions]
-          end
-
-          # Duplicate CSS attributes as HTML attributes
-          if Premailer::RELATED_ATTRIBUTES.key?(el.name) && @options[:css_to_attributes]
-            Premailer::RELATED_ATTRIBUTES[el.name].each do |css_attr, html_attr|
-              if el[html_attr].nil? && !merged[css_attr].empty?
-                new_val = merged[css_attr].dup
-
-                # Remove url() function wrapper
-                new_val.gsub!(/url\((['"])(.*?)\1\)/, '\2')
-
-                # Remove !important, trailing semi-colon, and leading/trailing whitespace
-                new_val.gsub!(/;$|\s*!important/, '').strip!
-
-                # For width and height tags, remove px units
-                new_val.gsub!(/(\d+)px/, '\1') if WIDTH_AND_HIGHT.include?(html_attr)
-
-                # For color-related tags, convert RGB to hex if specified by options
-                new_val = ensure_hex(new_val) if css_attr.end_with?('color') && @options[:rgb_to_hex_attributes]
-
-                el[html_attr] = new_val
-              end
-
-              unless @options[:preserve_style_attribute]
-                merged.instance_variable_get(:@declarations).tap do |declarations|
-                  declarations.delete(css_attr)
-                end
-              end
-            end
-          end
-
-          # Collapse multiple rules into one as much as possible.
-          merged.create_shorthand! if @options[:create_shorthands]
-
-          # write the inline STYLE attribute
-          el['style'] = merged.declarations_to_s
         end
 
         doc = write_unmergable_css_rules(doc, @unmergable_rules) unless @options[:drop_unmergeable_css_rules]
@@ -161,6 +154,72 @@ class Premailer
         end
       end
 
+      # Merge a list of rule sets into a final style string plus the HTML
+      # attribute duplications (bgcolor/align/...) for RELATED_ATTRIBUTES
+      # elements. Element-independent: the per-element "attribute already
+      # set" guard stays with the caller.
+      def fold_declarations(declarations, related_el_name) # :nodoc:
+        merged = CssParser.merge(declarations)
+        if merged.equal?(declarations[0])
+          # CssParser.merge returns its input untouched when given a single
+          # rule set; copy it before the destructive fold pipeline below so
+          # rule sets shared across elements are not corrupted.
+          merged = CssParser::RuleSet.new(block: merged.declarations_to_s, specificity: merged.specificity)
+        end
+        begin
+          merged.expand_shorthand!
+        rescue ArgumentError => e
+          raise e if @options[:rule_set_exceptions]
+        end
+
+        attributes = nil
+        # Duplicate CSS attributes as HTML attributes
+        if related_el_name
+          Premailer::RELATED_ATTRIBUTES[related_el_name].each do |css_attr, html_attr|
+            unless merged[css_attr].empty?
+              new_val = merged[css_attr].dup
+
+              # Remove url() function wrapper
+              new_val.gsub!(/url\((['"])(.*?)\1\)/, '\2')
+
+              # Remove !important, trailing semi-colon, and leading/trailing whitespace
+              new_val.gsub!(/;$|\s*!important/, '').strip!
+
+              # For width and height tags, remove px units
+              new_val.gsub!(/(\d+)px/, '\1') if WIDTH_AND_HIGHT.include?(html_attr)
+
+              # For color-related tags, convert RGB to hex if specified by options
+              new_val = ensure_hex(new_val) if css_attr.end_with?('color') && @options[:rgb_to_hex_attributes]
+
+              (attributes ||= []) << [html_attr, new_val]
+            end
+
+            unless @options[:preserve_style_attribute]
+              merged.instance_variable_get(:@declarations).tap do |declarations|
+                declarations.delete(css_attr)
+              end
+            end
+          end
+        end
+
+        # Collapse multiple rules into one as much as possible.
+        merged.create_shorthand! if @options[:create_shorthands]
+
+        # write the inline STYLE attribute
+        [merged.declarations_to_s, attributes]
+      end
+
+      # Build an expanded rule set for folding. Returns nil (and optionally
+      # swallows the error, mirroring the old fold-time rescue) on bad CSS.
+      def build_rule_set(block, specificity) # :nodoc:
+        rs = Premailer::CachedRuleSet.new(block: block, specificity: specificity)
+        rs.expand_shorthand!
+        rs
+      rescue ArgumentError => e
+        raise e if @options[:rule_set_exceptions]
+        nil
+      end
+
       # Create a <tt>style</tt> element with un-mergable rules (e.g. <tt>:hover</tt>)
       # and write it into the <tt>head</tt>.
       #

data/lib/premailer/premailer.rb

@@ -171,6 +171,7 @@ class Premailer
   # @option options [Boolean] :verbose Whether to print errors and warnings to <tt>$stderr</tt>.  Default is false.
   # @option options [Boolean] :io_exceptions Throws exceptions on I/O errors. Default is false.
   # @option options [Boolean] :rule_set_exceptions Throws exceptions on invalid values in CSS Parser rule sets. Default is true.
+  # @option options [Boolean] :allow_local_network Allow css_parser to fetch remote CSS from local/private network hosts (disables its SSRF protection). Default is false.
   # @option options [Boolean] :include_link_tags Whether to include css from <tt>link rel=stylesheet</tt> tags.  Default is true.
   # @option options [Boolean] :include_style_tags Whether to include css from <tt>style</tt> tags.  Default is true.
   # @option options [String] :input_encoding Manually specify the source documents encoding. This is a good idea. Default is ASCII-8BIT.
@@ -204,6 +205,7 @@ class Premailer
       :debug => false,
       :io_exceptions => false,
       :rule_set_exceptions => true,
+      :allow_local_network => false,
       :include_link_tags => true,
       :include_style_tags => true,
       :input_encoding => 'ASCII-8BIT',
@@ -239,7 +241,8 @@ class Premailer
         :absolute_paths => true,
         :import => true,
         :io_exceptions => @options[:io_exceptions],
-        :rule_set_exceptions => @options[:rule_set_exceptions]
+        :rule_set_exceptions => @options[:rule_set_exceptions],
+        :allow_local_network => @options[:allow_local_network]
       }
     )
 
@@ -396,7 +399,7 @@ class Premailer
 
     warn "Attempting to append_query_string: #{queries}" if @options[:verbose]
 
-    doc.search('a').each do |el|
+    doc.search('a, area').each do |el|
       href = el.attributes['href'].to_s.strip
       next if href.nil? || href.empty?
 

data/lib/premailer/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 class Premailer
   # Premailer version.
-  VERSION = '1.29.0'
+  VERSION = '1.32.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: premailer
 version: !ruby/object:Gem::Version
-  version: 1.29.0
+  version: 1.32.0
 platform: ruby
 authors:
 - Alex Dunae