premailer 1.31.0 → 1.32.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 533e735e745f5ffc88ea6643bdb54824761a1ea131f0ddca4b3a999eaee04bac
-  data.tar.gz: 77a38f71d31a3ed1fa3fadd34de8416cc3987b229d306ceb1d44d680fca343d7
+  metadata.gz: 2186c26ccc50f22227a6dbbf53b4cd3b5ae5f8bebdbdc190b0e7fd0e5a152565
+  data.tar.gz: 84becf9c1329983be14a427eef560806fb23ceb05847b7c5484033fe2fda0248
 SHA512:
-  metadata.gz: b571211f13970f25e89c4c32472596950cc399cea0a6c47c798956e27ffa1fa45a99b665a69440d50f97a92822623ec82612f52f839b39c604a9f3a1821a622d
-  data.tar.gz: 3dbb94a55011a64594000339cb949ede008aa1bbd546f675fae6f54e19821e5358aee82adacc2c104340fd4b12bbb9318892eaa98fb5bd3c34a6f178135e8f60
+  metadata.gz: c489d4a76330f66eeb60793faebc2839591870ee261179c0d9369ef95e5194d967f2b0f1aec31f16edb9355e363766fcb9245e67f13d2bb39b53cf1598ab8e36
+  data.tar.gz: 48a0cf85f5d2c2e3cbc2e7a5b21e70bf0e9e9215b2067703b9f9e5574342be25901aa639b1fcbdc3889e1d883905ad30e1e300d188fee68fd043f0de1588e2f2

data/README.md

@@ -127,6 +127,16 @@ Premailer.new(
 
 [available options](https://premailer.github.io/premailer/Premailer.html#initialize-instance_method)
 
+### Loading CSS from local/private hosts
+
+css_parser 3+ blocks fetching remote CSS (`<link>`, `@import`) from hosts that resolve to loopback/private IPs
+or do not resolve at all, to prevent SSRF.
+Those styles are silently dropped (unless `io_exceptions: true`).
+To allow them, when the html is trusted:
+```ruby
+Premailer.new(html, with_html_string: true, allow_local_network: true)
+```
+
 ## Support for CSS variables
 
 The gem does not automatically replace CSS variables with their static values.

data/lib/premailer/premailer.rb

@@ -171,6 +171,7 @@ class Premailer
   # @option options [Boolean] :verbose Whether to print errors and warnings to <tt>$stderr</tt>.  Default is false.
   # @option options [Boolean] :io_exceptions Throws exceptions on I/O errors. Default is false.
   # @option options [Boolean] :rule_set_exceptions Throws exceptions on invalid values in CSS Parser rule sets. Default is true.
+  # @option options [Boolean] :allow_local_network Allow css_parser to fetch remote CSS from local/private network hosts (disables its SSRF protection). Default is false.
   # @option options [Boolean] :include_link_tags Whether to include css from <tt>link rel=stylesheet</tt> tags.  Default is true.
   # @option options [Boolean] :include_style_tags Whether to include css from <tt>style</tt> tags.  Default is true.
   # @option options [String] :input_encoding Manually specify the source documents encoding. This is a good idea. Default is ASCII-8BIT.
@@ -204,6 +205,7 @@ class Premailer
       :debug => false,
       :io_exceptions => false,
       :rule_set_exceptions => true,
+      :allow_local_network => false,
       :include_link_tags => true,
       :include_style_tags => true,
       :input_encoding => 'ASCII-8BIT',
@@ -239,7 +241,8 @@ class Premailer
         :absolute_paths => true,
         :import => true,
         :io_exceptions => @options[:io_exceptions],
-        :rule_set_exceptions => @options[:rule_set_exceptions]
+        :rule_set_exceptions => @options[:rule_set_exceptions],
+        :allow_local_network => @options[:allow_local_network]
       }
     )
 

data/lib/premailer/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 class Premailer
   # Premailer version.
-  VERSION = '1.31.0'
+  VERSION = '1.32.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: premailer
 version: !ruby/object:Gem::Version
-  version: 1.31.0
+  version: 1.32.0
 platform: ruby
 authors:
 - Alex Dunae