qti 2.14.0 → 2.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ce025f977e8afee917a58d479c15bc56fc7320596b1bfb0c28da5e94ad19602a
-  data.tar.gz: 642c6b5ba04eb180d5ff363d4aec28bdfc1807cb27fc8d8e99ab0d4b78c36ad0
+  metadata.gz: fcafa61127adf8dafdd3084cd6c22d56630473c0d01e42a7e6cddf6ee7b4ba96
+  data.tar.gz: 68fdf75e1b11fae2ca2ac55aca9daf936c2754ee1a0a244ccc94a51953c3957f
 SHA512:
-  metadata.gz: c96870e3a861ce1e635a5a2f09a8be85820528cc703303bdea362468c0107704be4cf87e425ed4f11d892e3db3453450d4058c5d102442e43c5caa71f3b21b4a
-  data.tar.gz: d0eac68354d0ffeeae4b1098e90bded2907462f0671ec21377de1d0fa596695fb4ae417f3f6770909c23edf108634f050b1452700b0324fd305833aedb536997
+  metadata.gz: 06543ad3a11e643f4c9731a641da3495afa53d94defa9ac8b40a34015d152ca24e5943fb1b33d9fe0db0714915f9a2e86dd2511821197f1b29395b071adf1ce0
+  data.tar.gz: 7b3ad6b2fa593ca9f2be62f524777fef0d41d9ddc8833af38ec445a89a3ffe5c855dd80312000978a0bd55bada68b8d711220a54b46d1b231223b0e41727b0b3

data/lib/qti/sanitizer.rb

@@ -40,7 +40,7 @@ module Qti
             'object' => MEDIA_ATTR,
             'embed' => %w[name src type allowfullscreen pluginspage wmode
                           allowscriptaccess width height],
-            'iframe' => %w[src width height name align frameborder scrolling sandbox
+            'iframe' => %w[src style width height name align frameborder scrolling sandbox
                            allowfullscreen webkitallowfullscreen mozallowfullscreen
                            allow] + ALL_DATA_ATTR, # TODO: remove explicit allow with domain whitelist account setting
             'a' => relaxed_config('a', ['target'] + ALL_DATA_ATTR),
@@ -92,7 +92,7 @@ module Qti
       lambda do |env|
         return unless FILTER_TAGS.include?(env[:node_name])
         return if env[:is_whitelisted] || !env[:node].element?
-        Sanitize.node!(env[:node], CONFIG)
+        Sanitize.node!(env[:node], Sanitize::Config.merge(Sanitize::Config::RELAXED, CONFIG))
         { node_whitelist: [env[:node]] }
       end
     end

data/lib/qti/version.rb

@@ -1,3 +1,3 @@
 module Qti
-  VERSION = '2.14.0'.freeze
+  VERSION = '2.15.0'.freeze
 end

data/spec/lib/qti/sanitizer_spec.rb

@@ -54,5 +54,14 @@ describe Qti::Sanitizer do
 
       expect(sanitizer.clean(html)).to include 'target="_blank"'
     end
+
+    it 'allows style attributes on iframe' do
+      html = '<iframe style="width: 523px; height: 294px; display: inline-block;"></iframe>'
+
+      expect(sanitizer.clean(html)).to include 'style'
+      expect(sanitizer.clean(html)).to include 'width: 523px;'
+      expect(sanitizer.clean(html)).to include 'height: 294px;'
+      expect(sanitizer.clean(html)).to include 'display: inline-block;'
+    end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: qti
 version: !ruby/object:Gem::Version
-  version: 2.14.0
+  version: 2.15.0
 platform: ruby
 authors:
 - Adrian Diaz
@@ -12,7 +12,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-05-11 00:00:00.000000000 Z
+date: 2023-05-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionview