prosemirror_to_html 0.3.1 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 258fc1681186bbb3be3b85c5e2924233f9792ce35dacc0eacbdde9224f756d93
-  data.tar.gz: 1b68a3cbf52aa3c0712d707ad589d291c760dc715baad0e26556c462de7bdf9a
+  metadata.gz: aa4a2d6f0e0e0478ae5eddd0f8024bfee0a3a87af1c7039f2e9b2e42d6b8dfce
+  data.tar.gz: 39f9b61a9ace8c399beb416e60e78a5b6a42102ebd3d5ae1a3841959d3aa3398
 SHA512:
-  metadata.gz: 6018cc198040f13e4f9fefbb147fb4c226bfa08bf7c473c625e5a85e57caa092ca60bbf35cc0932a253fbf0c1807a6204efea6723e171f2312050971cc388274
-  data.tar.gz: cbb61fbeec67cdce929c5f9c3f06b137e3f9ab9e617f94acd22ff0dfe320ce4f93eff3021111dde8ee681b730193c6058f363bad3d467fcc1a9426988a35c3d3
+  metadata.gz: cefafdf1e45d0f76695fc0aafe3b45f9f4d7df3fd4c14c4832f20d1122d813e1a303833084c70e2647d4727bffea5a7a6fe5a984ec3a5deacdf73e262b2b1ea2
+  data.tar.gz: ac1023217710f151bb0225796e3d1ebe97a3c3b2997d54d3160848411d58394ed5eef4403d90d242ebf1fa4a3dbaea76e7e2fa7546df25ccb588541d43efd646

data/CHANGELOG.md

@@ -1,3 +1,10 @@
+## [0.4.0] - 2026-08-12
+
+### Security
+
+- Sanitize all rendered output with Loofah, stripping event-handler attributes, `javascript:` URLs, and other unsafe HTML that value escaping alone did not neutralize (attribute-name XSS)
+- Clamp the heading `level` to a valid range (1-6) so a document-supplied value cannot steer the tag name (e.g. injecting a `<script>` element)
+
 ## [0.3.1] - 2026-02-23
 
 ### Fixed

data/Gemfile.lock

@@ -1,15 +1,20 @@
 PATH
   remote: .
   specs:
-    prosemirror_to_html (0.3.1)
+    prosemirror_to_html (0.4.0)
+      loofah
       nokogiri
 
 GEM
   remote: https://rubygems.org/
   specs:
+    crass (1.0.7)
     diff-lcs (1.6.2)
+    loofah (2.25.2)
+      crass (~> 1.0.2)
+      nokogiri (>= 1.12.0)
     mini_portile2 (2.8.9)
-    nokogiri (1.19.1)
+    nokogiri (1.19.4)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     racc (1.8.1)
@@ -27,7 +32,7 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
     rspec-support (3.13.7)
-    yard (0.9.38)
+    yard (0.9.44)
 
 PLATFORMS
   ruby

data/lib/prosemirror_to_html/nodes/heading.rb

@@ -6,7 +6,7 @@ module ProsemirrorToHtml
       def tag
         [
           {
-            tag: "h#{@node[:attrs][:level]}",
+            tag: "h#{level}",
             attrs: tag_attrs
           }
         ]
@@ -14,6 +14,12 @@ module ProsemirrorToHtml
 
       private
 
+      # Coerce and clamp the level to a valid heading (1-6) so a
+      # document-supplied value cannot steer the tag name.
+      def level
+        @node[:attrs][:level].to_i.clamp(1, 6)
+      end
+
       def tag_attrs
         attrs_hash = @node[:attrs].to_h
         attrs_hash.slice(*attrs_hash.keys - %i[level])

data/lib/prosemirror_to_html/version.rb

@@ -1,3 +1,3 @@
 module ProsemirrorToHtml
-  VERSION = "0.3.1"
+  VERSION = "0.4.0"
 end

data/lib/prosemirror_to_html.rb

@@ -25,6 +25,7 @@ require "prosemirror_to_html/nodes/table_header"
 require "prosemirror_to_html/nodes/table_row"
 require 'nokogiri'
 require 'json'
+require "loofah"
 
 module ProsemirrorToHtml
   class Error < StandardError; end
@@ -94,7 +95,7 @@ module ProsemirrorToHtml
         html << render_node(node, prev_node, next_node)
       end
 
-      html
+      sanitize(html)
     end
 
     def add_node(node)
@@ -143,6 +144,23 @@ module ProsemirrorToHtml
 
     private
 
+    # Serialize without libxml2's block-element auto-indentation (no FORMAT
+    # flag), so sanitizing does not reformat the renderer's compact output.
+    SANITIZE_SAVE_OPTIONS = Nokogiri::XML::Node::SaveOptions::AS_HTML |
+                            Nokogiri::XML::Node::SaveOptions::NO_DECLARATION |
+                            Nokogiri::XML::Node::SaveOptions::NO_EMPTY_TAGS
+
+    # Scrub the rendered HTML against Loofah's allowlist, stripping unsafe
+    # elements and attributes (event handlers, javascript: URLs, unknown tags)
+    # while keeping their text content. Mirrors Loofah::Helpers.sanitize but
+    # serializes compactly (see SANITIZE_SAVE_OPTIONS).
+    def sanitize(html)
+      fragment = Loofah.fragment(html)
+      fragment.scrub!(:strip)
+      fragment.xpath("./form").each(&:remove)
+      fragment.to_html(save_with: SANITIZE_SAVE_OPTIONS)
+    end
+
     def render_node(node, prev_node, next_node)
       html = ''
       render_klass = nil

data/prosemirror_to_html.gemspec

@@ -42,5 +42,6 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "rspec", "~> 3.0"
   spec.add_development_dependency "yard"
   spec.add_dependency "nokogiri"
+  spec.add_dependency "loofah"
 
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: prosemirror_to_html
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.4.0
 platform: ruby
 authors:
 - Hans Lemuet
@@ -80,6 +80,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: loofah
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Takes ProseMirror compatible JSON and outputs HTML.
 email:
 - hans@etamin.studio
@@ -148,7 +162,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Takes ProseMirror compatible JSON and outputs HTML.
 test_files: []