prosemirror_to_html 0.3.1 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 258fc1681186bbb3be3b85c5e2924233f9792ce35dacc0eacbdde9224f756d93
-  data.tar.gz: 1b68a3cbf52aa3c0712d707ad589d291c760dc715baad0e26556c462de7bdf9a
+  metadata.gz: 1ca8ddaa7d71d39eb954baaa2c5e512625a4bcb604bbbfbccdeff806cd7720d7
+  data.tar.gz: e6322b6bba5bf370b7e7efa471ead3034d7c0661c4989b2b208f413ce37ddb9a
 SHA512:
-  metadata.gz: 6018cc198040f13e4f9fefbb147fb4c226bfa08bf7c473c625e5a85e57caa092ca60bbf35cc0932a253fbf0c1807a6204efea6723e171f2312050971cc388274
-  data.tar.gz: cbb61fbeec67cdce929c5f9c3f06b137e3f9ab9e617f94acd22ff0dfe320ce4f93eff3021111dde8ee681b730193c6058f363bad3d467fcc1a9426988a35c3d3
+  metadata.gz: f7e9088612cf95311c521aca3322cf64cf998f09e38d07de2abc1dc51c0506d2c484d9b5bc8c89d79ec45ee213cd1c02e8b23be55e039c70c0db0dbe96e5501f
+  data.tar.gz: b83a368520eb3cc22fa4d042d9ec7304410e26282c299dabef2d547f793ed4a78531cb88693429dcc1e0f656536c300d6495d08601b095c777707d36cb188589

data/CHANGELOG.md

@@ -1,3 +1,16 @@
+## [0.4.1] - 2026-10-24
+
+### Deprecated
+
+- This gem is deprecated in favor of [prosemirror](https://github.com/etaminstudio/prosemirror), from the same maintainers: see the [migration guide](https://github.com/etaminstudio/prosemirror/blob/main/MIGRATING.md). Installing it shows a message pointing there.
+
+## [0.4.0] - 2026-08-12
+
+### Security
+
+- Sanitize all rendered output with Loofah, stripping event-handler attributes, `javascript:` URLs, and other unsafe HTML that value escaping alone did not neutralize (attribute-name XSS)
+- Clamp the heading `level` to a valid range (1-6) so a document-supplied value cannot steer the tag name (e.g. injecting a `<script>` element)
+
 ## [0.3.1] - 2026-02-23
 
 ### Fixed

data/Gemfile.lock

@@ -1,15 +1,20 @@
 PATH
   remote: .
   specs:
-    prosemirror_to_html (0.3.1)
+    prosemirror_to_html (0.4.0)
+      loofah
       nokogiri
 
 GEM
   remote: https://rubygems.org/
   specs:
+    crass (1.0.7)
     diff-lcs (1.6.2)
+    loofah (2.25.2)
+      crass (~> 1.0.2)
+      nokogiri (>= 1.12.0)
     mini_portile2 (2.8.9)
-    nokogiri (1.19.1)
+    nokogiri (1.19.4)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     racc (1.8.1)
@@ -27,7 +32,7 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
     rspec-support (3.13.7)
-    yard (0.9.38)
+    yard (0.9.44)
 
 PLATFORMS
   ruby

data/README.md

@@ -1,43 +1,18 @@
 # ProsemirrorToHtml
 
-Welcome to your new gem! In this directory, you'll find the files you need to be able to package up your Ruby library into a gem. Put your Ruby code in the file `lib/prosemirror_to_html`. To experiment with that code, run `bin/console` for an interactive prompt.
+> [!WARNING]
+> **This gem is deprecated.** Use [`prosemirror`](https://github.com/etaminstudio/prosemirror) instead, from the same maintainers. It builds the HTML with Phlex, which escapes text and attribute values as it writes them, types attributes and only allows safe URL schemes, instead of building strings and cleaning them up afterwards. It also imports HTML and Markdown, and exports Markdown and text. See the [migration guide](https://github.com/etaminstudio/prosemirror/blob/main/MIGRATING.md).
+>
+> This gem won't get new features.
 
-TODO: Delete this and the text above, and describe your gem
+Takes ProseMirror compatible JSON and outputs HTML.
 
-## Installation
-
-Add this line to your application's Gemfile:
+## Usage
 
 ```ruby
-gem 'prosemirror_to_html'
+ProsemirrorToHtml::Renderer.new.render(json)
 ```
 
-And then execute:
-
-    $ bundle
-
-Or install it yourself as:
-
-    $ gem install prosemirror_to_html
-
-## Usage
-
-TODO: Write usage instructions here
-
-## Development
-
-After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
-
-To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
-
-## Contributing
-
-Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/prosemirror_to_html. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [Contributor Covenant](http://contributor-covenant.org) code of conduct.
-
 ## License
 
 The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
-
-## Code of Conduct
-
-Everyone interacting in the ProsemirrorToHtml project’s codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/[USERNAME]/prosemirror_to_html/blob/master/CODE_OF_CONDUCT.md).

data/lib/prosemirror_to_html/nodes/heading.rb

@@ -6,7 +6,7 @@ module ProsemirrorToHtml
       def tag
         [
           {
-            tag: "h#{@node[:attrs][:level]}",
+            tag: "h#{level}",
             attrs: tag_attrs
           }
         ]
@@ -14,6 +14,12 @@ module ProsemirrorToHtml
 
       private
 
+      # Coerce and clamp the level to a valid heading (1-6) so a
+      # document-supplied value cannot steer the tag name.
+      def level
+        @node[:attrs][:level].to_i.clamp(1, 6)
+      end
+
       def tag_attrs
         attrs_hash = @node[:attrs].to_h
         attrs_hash.slice(*attrs_hash.keys - %i[level])

data/lib/prosemirror_to_html/version.rb

@@ -1,3 +1,3 @@
 module ProsemirrorToHtml
-  VERSION = "0.3.1"
+  VERSION = "0.4.1"
 end

data/lib/prosemirror_to_html.rb

@@ -25,6 +25,7 @@ require "prosemirror_to_html/nodes/table_header"
 require "prosemirror_to_html/nodes/table_row"
 require 'nokogiri'
 require 'json'
+require "loofah"
 
 module ProsemirrorToHtml
   class Error < StandardError; end
@@ -94,7 +95,7 @@ module ProsemirrorToHtml
         html << render_node(node, prev_node, next_node)
       end
 
-      html
+      sanitize(html)
     end
 
     def add_node(node)
@@ -143,6 +144,23 @@ module ProsemirrorToHtml
 
     private
 
+    # Serialize without libxml2's block-element auto-indentation (no FORMAT
+    # flag), so sanitizing does not reformat the renderer's compact output.
+    SANITIZE_SAVE_OPTIONS = Nokogiri::XML::Node::SaveOptions::AS_HTML |
+                            Nokogiri::XML::Node::SaveOptions::NO_DECLARATION |
+                            Nokogiri::XML::Node::SaveOptions::NO_EMPTY_TAGS
+
+    # Scrub the rendered HTML against Loofah's allowlist, stripping unsafe
+    # elements and attributes (event handlers, javascript: URLs, unknown tags)
+    # while keeping their text content. Mirrors Loofah::Helpers.sanitize but
+    # serializes compactly (see SANITIZE_SAVE_OPTIONS).
+    def sanitize(html)
+      fragment = Loofah.fragment(html)
+      fragment.scrub!(:strip)
+      fragment.xpath("./form").each(&:remove)
+      fragment.to_html(save_with: SANITIZE_SAVE_OPTIONS)
+    end
+
     def render_node(node, prev_node, next_node)
       html = ''
       render_klass = nil

data/prosemirror_to_html.gemspec

@@ -9,10 +9,11 @@ Gem::Specification.new do |spec|
   spec.authors       = ["Hans Lemuet", "Brian Kimball"]
   spec.email         = ["hans@etamin.studio", "bvkimball@gmail.com"]
 
-  spec.summary       = %q{Takes ProseMirror compatible JSON and outputs HTML.}
-  spec.description   = %q{Takes ProseMirror compatible JSON and outputs HTML.}
+  spec.summary       = %q{Deprecated: use the prosemirror gem. Takes ProseMirror compatible JSON and outputs HTML.}
+  spec.description   = %q{Deprecated in favor of the prosemirror gem. Takes ProseMirror compatible JSON and outputs HTML.}
   spec.homepage      = "https://github.com/etaminstudio/prosemirror_to_html"
   spec.license       = "MIT"
+  spec.post_install_message = "prosemirror_to_html is deprecated: use the prosemirror gem instead. Migration guide: https://github.com/etaminstudio/prosemirror/blob/main/MIGRATING.md"
 
 
   # Prevent pushing this gem to RubyGems.org. To allow pushes either set the 'allowed_push_host'
@@ -42,5 +43,6 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "rspec", "~> 3.0"
   spec.add_development_dependency "yard"
   spec.add_dependency "nokogiri"
+  spec.add_dependency "loofah"
 
 end

metadata

@@ -1,14 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: prosemirror_to_html
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.4.1
 platform: ruby
 authors:
 - Hans Lemuet
 - Brian Kimball
+autorequire:
 bindir: exe
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-10-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -80,7 +81,22 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: Takes ProseMirror compatible JSON and outputs HTML.
+- !ruby/object:Gem::Dependency
+  name: loofah
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: Deprecated in favor of the prosemirror gem. Takes ProseMirror compatible
+  JSON and outputs HTML.
 email:
 - hans@etamin.studio
 - bvkimball@gmail.com
@@ -134,6 +150,8 @@ homepage: https://github.com/etaminstudio/prosemirror_to_html
 licenses:
 - MIT
 metadata: {}
+post_install_message: 'prosemirror_to_html is deprecated: use the prosemirror gem
+  instead. Migration guide: https://github.com/etaminstudio/prosemirror/blob/main/MIGRATING.md'
 rdoc_options: []
 require_paths:
 - lib
@@ -148,7 +166,9 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 3.5.22
+signing_key:
 specification_version: 4
-summary: Takes ProseMirror compatible JSON and outputs HTML.
+summary: 'Deprecated: use the prosemirror gem. Takes ProseMirror compatible JSON and
+  outputs HTML.'
 test_files: []