qiita-markdown 0.33.0 → 0.34.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 17dc016afba392cc6e3ea77af4cdc445e32c6004a6c23a24b8dce1a4e0ec1811
-  data.tar.gz: 042e3a11a8cc6d266463ae7bb8d3e46c8c732efeb061086586c80a277898cf38
+  metadata.gz: 930ee5ee8bc770b95b918f3cfed4fdac57f133e9e69d0b21fff77cd2506a8fdc
+  data.tar.gz: 87f95cb871e08f94e1e03dd11a14ddd974ee24726b78ae3496bd3629e3b76959
 SHA512:
-  metadata.gz: 0c59646956b877c13e7c6ef62bd366483b5a7da78f19bfe8aee2305ea568c6f59dfb2d916e68a822e3363ddabbf7577166e8e21a8da79152550b11c77a3dc8d6
-  data.tar.gz: b907d5a284c9c77e9f264298d38d6ec4a0861179dda36320f6fd40187b606662b1e07e61d9f3e5bd2070f203e3de5d60b53cdb05593ca64ceb875c6bbd811f31
+  metadata.gz: 0ac7943de01ab9b05c990f6ec8abe64d37c780b186da66b30017129f014d7944aa60e437a9466033b2c801dd701fdf6564d30451bc2ece1d6551011ff44d814b
+  data.tar.gz: cb8bd175dcd7aec1685209eca0c51c396a80d686737267155d1815d98546f65d7fa5927cf525cb109ed777a5a92835239f59d46e70f246e8ddb1bd9b8f7ebac5

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 ## Unreleased
 
+## 0.34.0
+
+- Delete gist embed rule to avoid XSS
+
 ## 0.33.0
 
 - Fix XSS possibility bug

data/lib/qiita/markdown.rb

@@ -10,7 +10,6 @@ require "sanitize"
 require "qiita/markdown/embed/code_pen"
 require "qiita/markdown/embed/tweet"
 require "qiita/markdown/embed/asciinema"
-require "qiita/markdown/embed/gist"
 require "qiita/markdown/embed/youtube"
 require "qiita/markdown/embed/slide_share"
 require "qiita/markdown/embed/google_slide"

data/lib/qiita/markdown/transformers/filter_script.rb

@@ -10,7 +10,6 @@ module Qiita
 
         HOST_WHITE_LIST = [
           Embed::Asciinema::SCRIPT_HOST,
-          Embed::Gist::SCRIPT_HOST,
         ].flatten.freeze
 
         def self.call(*args)

data/lib/qiita/markdown/version.rb

@@ -1,5 +1,5 @@
 module Qiita
   module Markdown
-    VERSION = "0.33.0"
+    VERSION = "0.34.0"
   end
 end

data/spec/qiita/markdown/processor_spec.rb

@@ -1451,28 +1451,6 @@ describe Qiita::Markdown::Processor do
         end
       end
 
-      context "with HTML embed code for Gist" do
-        let(:markdown) do
-          <<-MARKDOWN.strip_heredoc
-            <script id="example" src="https://gist.github.com/a/example.js"></script>
-          MARKDOWN
-        end
-
-        if allowed
-          it "does not sanitize embed code" do
-            should eq <<-HTML.strip_heredoc
-              <script id="example" src="https://gist.github.com/a/example.js"></script>
-            HTML
-          end
-        else
-          it "forces async attribute on script" do
-            should eq <<-HTML.strip_heredoc
-              <script id="example" src="https://gist.github.com/a/example.js" async="async"></script>
-            HTML
-          end
-        end
-      end
-
       context "with HTML embed code for Youtube" do
         let(:markdown) do
           <<-MARKDOWN.strip_heredoc

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: qiita-markdown
 version: !ruby/object:Gem::Version
-  version: 0.33.0
+  version: 0.34.0
 platform: ruby
 authors:
 - Ryo Nakamura
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-03-18 00:00:00.000000000 Z
+date: 2021-03-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: gemoji
@@ -258,7 +258,6 @@ files:
 - lib/qiita/markdown/base_processor.rb
 - lib/qiita/markdown/embed/asciinema.rb
 - lib/qiita/markdown/embed/code_pen.rb
-- lib/qiita/markdown/embed/gist.rb
 - lib/qiita/markdown/embed/google_slide.rb
 - lib/qiita/markdown/embed/slide_share.rb
 - lib/qiita/markdown/embed/speeker_deck.rb

data/lib/qiita/markdown/embed/gist.rb

@@ -1,9 +0,0 @@
-module Qiita
-  module Markdown
-    module Embed
-      module Gist
-        SCRIPT_HOST = "gist.github.com".freeze
-      end
-    end
-  end
-end