rails-html-sanitizer 1.0.3 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 44e7ba72869ce5a5b6aa4f202dced7073ef94b72
-  data.tar.gz: b5410baf4f05cc97449852a7b3b4e36774a9942d
+SHA256:
+  metadata.gz: 8eba1aac52c80be280f186c5d378150709b7d4cd2a5d5b2367e6d2c036648d52
+  data.tar.gz: 96408eae2efee778a704f7caf246b64868a63bfdbbb81905b294bcca731a9289
 SHA512:
-  metadata.gz: 9ea541f36dbc6de129d6bd889a8b198bf5e4805a578e204dc21dfc01c29551f869e064b7c315a9cd7e2732cef58ad820851684df55568922135dd4866f5d8ff7
-  data.tar.gz: ff206594a72e31e5504f935b437ea105327f7540d5d1a8530f202d35419c278f9d78a5e7f413e86c519bf7bf12b54341aadb7591cfa719f35ea1693d4d4998b2
+  metadata.gz: c4209cebc841299143a466143f4b776461fc1cc8bba112dc603e86835b68ee44a800566f64224b27f5a45d164d0b004049b228dc405c3de59068800ec7a5d564
+  data.tar.gz: c899472b8dffe9f9fd4d15ae4739f07a775d74b9ed14143beb688bb546b6a82ec469add036747b81aff33510e6e241379e21458cb39d9b2a8e797824066e24e5

data/CHANGELOG.md

@@ -1,3 +1,40 @@
+## 1.3.0
+
+* Address deprecations in Loofah 2.3.0.
+
+  *Josh Goodall*
+
+## 1.2.0
+
+* Remove needless `white_list_sanitizer` deprecation.
+
+  By deprecating this, we were forcing Rails 5.2 to be updated or spew
+  deprecations that users could do nothing about.
+
+  That's pointless and I'm sorry for adding that!
+
+  Now there's no deprecation warning and Rails 5.2 works out of the box, while
+  Rails 6 can use the updated naming.
+
+  *Kasper Timm Hansen*
+
+## 1.1.0
+
+* Add `safe_list_sanitizer` and deprecate `white_list_sanitizer` to be removed
+  in 1.2.0. https://github.com/rails/rails-html-sanitizer/pull/87
+
+  *Juanito Fatas*
+
+* Remove `href` from LinkScrubber's `tags` as it's not an element.
+  https://github.com/rails/rails-html-sanitizer/pull/92
+
+  *Juanito Fatas*
+
+* Explain that we don't need to bump Loofah here if there's CVEs.
+  https://github.com/rails/rails-html-sanitizer/commit/d4d823c617fdd0064956047f7fbf23fff305a69b
+
+  *Kasper Timm Hansen*
+
 ## 1.0.1
 
 * Added support for Rails 4.2.0.beta2 and above

data/MIT-LICENSE

@@ -0,0 +1,23 @@
+Copyright (c) 2013-2015 Rafael Mendonça França, Kasper Timm Hansen
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+

data/README.md

@@ -41,22 +41,22 @@ link_sanitizer.sanitize('<a href="example.com">Only the link text will be kept.<
 # => Only the link text will be kept.
 ```
 
-#### WhiteListSanitizer
+#### SafeListSanitizer
 
 ```ruby
-white_list_sanitizer = Rails::Html::WhiteListSanitizer.new
+safe_list_sanitizer = Rails::Html::SafeListSanitizer.new
 
-# sanitize via an extensive white list of allowed elements
-white_list_sanitizer.sanitize(@article.body)
+# sanitize via an extensive safe list of allowed elements
+safe_list_sanitizer.sanitize(@article.body)
 
-# white list only the supplied tags and attributes
-white_list_sanitizer.sanitize(@article.body, tags: %w(table tr td), attributes: %w(id class style))
+# safe list only the supplied tags and attributes
+safe_list_sanitizer.sanitize(@article.body, tags: %w(table tr td), attributes: %w(id class style))
 
-# white list via a custom scrubber
-white_list_sanitizer.sanitize(@article.body, scrubber: ArticleScrubber.new)
+# safe list via a custom scrubber
+safe_list_sanitizer.sanitize(@article.body, scrubber: ArticleScrubber.new)
 
-# white list sanitizer can also sanitize css
-white_list_sanitizer.sanitize_css('background-color: #000;')
+# safe list sanitizer can also sanitize css
+safe_list_sanitizer.sanitize_css('background-color: #000;')
 ```
 
 ### Scrubbers
@@ -99,17 +99,15 @@ You can also create custom scrubbers in your application if you want to.
 
 ```ruby
 class CommentScrubber < Rails::Html::PermitScrubber
-  def allowed_node?(node)
-    !%w(form script comment blockquote).include?(node.name)
+  def initialize
+    super
+    self.tags = %w( form script comment blockquote )
+    self.attributes = %w( style )
   end
 
   def skip_node?(node)
     node.text?
   end
-
-  def scrub_attribute?(name)
-    name == "style"
-  end
 end
 ```
 
@@ -129,7 +127,7 @@ Loofah is what underlies the sanitizers and scrubbers of rails-html-sanitizer.
 - [Loofah and Loofah Scrubbers](https://github.com/flavorjones/loofah)
 
 The `node` argument passed to some methods in a custom scrubber is an instance of `Nokogiri::XML::Node`.
-- [`Nokogiri::XML::Node`](http://nokogiri.org/Nokogiri/XML/Node.html)
+- [`Nokogiri::XML::Node`](https://nokogiri.org/rdoc/Nokogiri/XML/Node.html)
 - [Nokogiri](http://nokogiri.org)
 
 ## Contributing to Rails Html Sanitizers

data/lib/rails-html-sanitizer.rb

@@ -15,8 +15,12 @@ module Rails
           Html::LinkSanitizer
         end
 
+        def safe_list_sanitizer
+          Html::SafeListSanitizer
+        end
+
         def white_list_sanitizer
-          Html::WhiteListSanitizer
+          safe_list_sanitizer
         end
       end
     end
@@ -34,7 +38,7 @@ module ActionView
         #   end
         #
         def sanitized_allowed_tags=(tags)
-          sanitizer_vendor.white_list_sanitizer.allowed_tags = tags
+          sanitizer_vendor.safe_list_sanitizer.allowed_tags = tags
         end
 
         # Replaces the allowed HTML attributes for the +sanitize+ helper.
@@ -44,7 +48,7 @@ module ActionView
         #   end
         #
         def sanitized_allowed_attributes=(attributes)
-          sanitizer_vendor.white_list_sanitizer.allowed_attributes = attributes
+          sanitizer_vendor.safe_list_sanitizer.allowed_attributes = attributes
         end
 
         [:protocol_separator,

data/lib/rails/html/sanitizer.rb

@@ -40,15 +40,16 @@ module Rails
     end
 
     # === Rails::Html::LinkSanitizer
-    # Removes a tags and href attributes leaving only the link text
+    # Removes +a+ tags and +href+ attributes leaving only the link text.
     #
-    # link_sanitizer = Rails::Html::LinkSanitizer.new
-    # link_sanitizer.sanitize('<a href="example.com">Only the link text will be kept.</a>')
-    # # => Only the link text will be kept.
+    #  link_sanitizer = Rails::Html::LinkSanitizer.new
+    #  link_sanitizer.sanitize('<a href="example.com">Only the link text will be kept.</a>')
+    #
+    #  => 'Only the link text will be kept.'
     class LinkSanitizer < Sanitizer
       def initialize
         @link_scrubber = TargetScrubber.new
-        @link_scrubber.tags = %w(a href)
+        @link_scrubber.tags = %w(a)
         @link_scrubber.attributes = %w(href)
       end
 
@@ -57,11 +58,11 @@ module Rails
       end
     end
 
-    # === Rails::Html::WhiteListSanitizer
-    # Sanitizes html and css from an extensive white list (see link further down).
+    # === Rails::Html::SafeListSanitizer
+    # Sanitizes html and css from an extensive safe list (see link further down).
     #
     # === Whitespace
-    # We can't make any guarentees about whitespace being kept or stripped.
+    # We can't make any guarantees about whitespace being kept or stripped.
     # Loofah uses Nokogiri, which wraps either a C or Java parser for the
     # respective Ruby implementation.
     # Those two parsers determine how whitespace is ultimately handled.
@@ -72,34 +73,34 @@ module Rails
     # so automatically.
     #
     # === Options
-    # Sanitizes both html and css via the white lists found here:
-    # https://github.com/flavorjones/loofah/blob/master/lib/loofah/html5/whitelist.rb
+    # Sanitizes both html and css via the safe lists found here:
+    # https://github.com/flavorjones/loofah/blob/master/lib/loofah/html5/safelist.rb
     #
-    # WhiteListSanitizer also accepts options to configure
-    # the white list used when sanitizing html.
+    # SafeListSanitizer also accepts options to configure
+    # the safe list used when sanitizing html.
     # There's a class level option:
-    # Rails::Html::WhiteListSanitizer.allowed_tags = %w(table tr td)
-    # Rails::Html::WhiteListSanitizer.allowed_attributes = %w(id class style)
+    # Rails::Html::SafeListSanitizer.allowed_tags = %w(table tr td)
+    # Rails::Html::SafeListSanitizer.allowed_attributes = %w(id class style)
     #
     # Tags and attributes can also be passed to +sanitize+.
     # Passed options take precedence over the class level options.
     #
     # === Examples
-    # white_list_sanitizer = Rails::Html::WhiteListSanitizer.new
+    # safe_list_sanitizer = Rails::Html::SafeListSanitizer.new
     #
     # Sanitize css doesn't take options
-    # white_list_sanitizer.sanitize_css('background-color: #000;')
+    # safe_list_sanitizer.sanitize_css('background-color: #000;')
     #
-    # Default: sanitize via a extensive white list of allowed elements
-    # white_list_sanitizer.sanitize(@article.body)
+    # Default: sanitize via a extensive safe list of allowed elements
+    # safe_list_sanitizer.sanitize(@article.body)
     #
-    # White list via the supplied tags and attributes
-    # white_list_sanitizer.sanitize(@article.body, tags: %w(table tr td),
+    # Safe list via the supplied tags and attributes
+    # safe_list_sanitizer.sanitize(@article.body, tags: %w(table tr td),
     # attributes: %w(id class style))
     #
-    # White list via a custom scrubber
-    # white_list_sanitizer.sanitize(@article.body, scrubber: ArticleScrubber.new)
-    class WhiteListSanitizer < Sanitizer
+    # Safe list via a custom scrubber
+    # safe_list_sanitizer.sanitize(@article.body, scrubber: ArticleScrubber.new)
+    class SafeListSanitizer < Sanitizer
       class << self
         attr_accessor :allowed_tags
         attr_accessor :allowed_attributes
@@ -148,5 +149,7 @@ module Rails
         options[:attributes] || self.class.allowed_attributes
       end
     end
+
+    WhiteListSanitizer = SafeListSanitizer
   end
 end

data/lib/rails/html/sanitizer/version.rb

@@ -1,7 +1,7 @@
 module Rails
   module Html
     class Sanitizer
-      VERSION = "1.0.3"
+      VERSION = "1.3.0"
     end
   end
 end

data/lib/rails/html/scrubbers.rb

@@ -2,9 +2,9 @@ module Rails
   module Html
     # === Rails::Html::PermitScrubber
     #
-    # Rails::Html::PermitScrubber allows you to permit only your own tags and/or attributes.
+    # +Rails::Html::PermitScrubber+ allows you to permit only your own tags and/or attributes.
     #
-    # Rails::Html::PermitScrubber can be subclassed to determine:
+    # +Rails::Html::PermitScrubber+ can be subclassed to determine:
     # - When a node should be skipped via +skip_node?+.
     # - When a node is allowed via +allowed_node?+.
     # - When an attribute should be scrubbed via +scrub_attribute?+.
@@ -27,22 +27,23 @@ module Rails
     # If set, attributes excluded will be removed.
     # If not, attributes are removed based on Loofahs +HTML5::Scrub.scrub_attributes+.
     #
-    # class CommentScrubber < Html::PermitScrubber
-    #   def allowed_node?(node)
-    #     !%w(form script comment blockquote).include?(node.name)
-    #   end
+    #  class CommentScrubber < Html::PermitScrubber
+    #    def initialize
+    #      super
+    #      self.tags = %w(form script comment blockquote)
+    #    end
     #
-    #   def skip_node?(node)
-    #     node.text?
-    #   end
+    #    def skip_node?(node)
+    #      node.text?
+    #    end
     #
-    #   def scrub_attribute?(name)
-    #     name == "style"
-    #   end
-    # end
+    #    def scrub_attribute?(name)
+    #      name == "style"
+    #    end
+    #  end
     #
-    # See the documentation for Nokogiri::XML::Node to understand what's possible
-    # with nodes: http://nokogiri.org/Nokogiri/XML/Node.html
+    # See the documentation for +Nokogiri::XML::Node+ to understand what's possible
+    # with nodes: https://nokogiri.org/rdoc/Nokogiri/XML/Node.html
     class PermitScrubber < Loofah::Scrubber
       attr_reader :tags, :attributes
 
@@ -137,28 +138,30 @@ module Rails
                       attr_node.node_name
                     end
 
-        if Loofah::HTML5::WhiteList::ATTR_VAL_IS_URI.include?(attr_name)
+        if Loofah::HTML5::SafeList::ATTR_VAL_IS_URI.include?(attr_name)
           # this block lifted nearly verbatim from HTML5 sanitization
           val_unescaped = CGI.unescapeHTML(attr_node.value).gsub(Loofah::HTML5::Scrub::CONTROL_CHARACTERS,'').downcase
-          if val_unescaped =~ /^[a-z0-9][-+.a-z0-9]*:/ && ! Loofah::HTML5::WhiteList::ALLOWED_PROTOCOLS.include?(val_unescaped.split(Loofah::HTML5::WhiteList::PROTOCOL_SEPARATOR)[0])
+          if val_unescaped =~ /^[a-z0-9][-+.a-z0-9]*:/ && ! Loofah::HTML5::SafeList::ALLOWED_PROTOCOLS.include?(val_unescaped.split(Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR)[0])
             attr_node.remove
           end
         end
-        if Loofah::HTML5::WhiteList::SVG_ATTR_VAL_ALLOWS_REF.include?(attr_name)
+        if Loofah::HTML5::SafeList::SVG_ATTR_VAL_ALLOWS_REF.include?(attr_name)
           attr_node.value = attr_node.value.gsub(/url\s*\(\s*[^#\s][^)]+?\)/m, ' ') if attr_node.value
         end
-        if Loofah::HTML5::WhiteList::SVG_ALLOW_LOCAL_HREF.include?(node.name) && attr_name == 'xlink:href' && attr_node.value =~ /^\s*[^#\s].*/m
+        if Loofah::HTML5::SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) && attr_name == 'xlink:href' && attr_node.value =~ /^\s*[^#\s].*/m
           attr_node.remove
         end
 
         node.remove_attribute(attr_node.name) if attr_name == 'src' && attr_node.value !~ /[^[:space:]]/
+
+        Loofah::HTML5::Scrub.force_correct_attribute_escaping! node
       end
     end
 
     # === Rails::Html::TargetScrubber
     #
-    # Where Rails::Html::PermitScrubber picks out tags and attributes to permit in
-    # sanitization, Rails::Html::TargetScrubber targets them for removal.
+    # Where +Rails::Html::PermitScrubber+ picks out tags and attributes to permit in
+    # sanitization, +Rails::Html::TargetScrubber+ targets them for removal.
     #
     # +tags=+
     # If set, elements included will be stripped.
@@ -177,7 +180,7 @@ module Rails
 
     # === Rails::Html::TextOnlyScrubber
     #
-    # Rails::Html::TextOnlyScrubber allows you to permit text nodes.
+    # +Rails::Html::TextOnlyScrubber+ allows you to permit text nodes.
     #
     # Unallowed elements will be stripped, i.e. element is removed but its subtree kept.
     class TextOnlyScrubber < Loofah::Scrubber

data/test/sanitizer_test.rb

@@ -12,12 +12,12 @@ class SanitizersTest < Minitest::Test
   end
 
   def test_sanitize_nested_script
-    sanitizer = Rails::Html::WhiteListSanitizer.new
+    sanitizer = Rails::Html::SafeListSanitizer.new
     assert_equal '&lt;script&gt;alert("XSS");&lt;/script&gt;', sanitizer.sanitize('<script><script></script>alert("XSS");<script><</script>/</script><script>script></script>', tags: %w(em))
   end
 
   def test_sanitize_nested_script_in_style
-    sanitizer = Rails::Html::WhiteListSanitizer.new
+    sanitizer = Rails::Html::SafeListSanitizer.new
     assert_equal '&lt;script&gt;alert("XSS");&lt;/script&gt;', sanitizer.sanitize('<style><script></style>alert("XSS");<style><</style>/</style><style>script></style>', tags: %w(em))
   end
 
@@ -33,7 +33,7 @@ class SanitizersTest < Minitest::Test
     assert_equal %(<h1>hello </h1>), xpath_sanitize(html, xpaths: %w(.//script))
   end
 
-  def test_remove_xpaths_removes_all_occurences_of_xpath
+  def test_remove_xpaths_removes_all_occurrences_of_xpath
     html = %(<section><header><script>code!</script></header><p>hello <script>code!</script></p></section>)
     assert_equal %(<section><header></header><p>hello </p></section>), xpath_sanitize(html, xpaths: %w(.//script))
   end
@@ -58,11 +58,11 @@ class SanitizersTest < Minitest::Test
   end
 
   def test_strip_invalid_html
-    assert_equal "", full_sanitize("<<<bad html")
+    assert_equal "&lt;&lt;", full_sanitize("<<<bad html")
   end
 
   def test_strip_nested_tags
-    expected = "Weia onclick='alert(document.cookie);'/&gt;rdos"
+    expected = "Wei&lt;a onclick='alert(document.cookie);'/&gt;rdos"
     input = "Wei<<a>a onclick='alert(document.cookie);'</a>/>rdos"
     assert_equal expected, full_sanitize(input)
   end
@@ -74,7 +74,7 @@ class SanitizersTest < Minitest::Test
     assert_equal expected, full_sanitize(input)
   end
 
-  def test_strip_comments
+  def test_remove_unclosed_tags
     assert_equal "This is ", full_sanitize("This is <-- not\n a comment here.")
   end
 
@@ -87,7 +87,9 @@ class SanitizersTest < Minitest::Test
   end
 
   def test_strip_blank_string
-    [nil, '', '   '].each { |blank| assert_equal blank, full_sanitize(blank) }
+    assert_nil full_sanitize(nil)
+    assert_equal "", full_sanitize("")
+    assert_equal "   ", full_sanitize("   ")
   end
 
   def test_strip_tags_with_plaintext
@@ -98,8 +100,8 @@ class SanitizersTest < Minitest::Test
     assert_equal "This is a test.", full_sanitize("<p>This <u>is<u> a <a href='test.html'><strong>test</strong></a>.</p>")
   end
 
-  def test_strip_tags_with_many_open_quotes
-    assert_equal "", full_sanitize("<<<bad html>")
+  def test_escape_tags_with_many_open_quotes
+    assert_equal "&lt;&lt;", full_sanitize("<<<bad html>")
   end
 
   def test_strip_tags_with_sentence
@@ -123,7 +125,7 @@ class SanitizersTest < Minitest::Test
   end
 
   def test_strip_links_with_tags_in_tags
-    expected = "a href='hello'&gt;all <b>day</b> long/a&gt;"
+    expected = "&lt;a href='hello'&gt;all <b>day</b> long&lt;/a&gt;"
     input = "<<a>a href='hello'>all <b>day</b> long<</A>/a>"
     assert_equal expected, link_sanitize(input)
   end
@@ -152,10 +154,6 @@ class SanitizersTest < Minitest::Test
     assert_equal "Magic", link_sanitize("<a href='http://www.rubyonrails.com/'>Mag<a href='http://www.ruby-lang.org/'>ic")
   end
 
-  def test_strip_links_with_a_tag_in_href
-    assert_equal "FrrFox", link_sanitize("<href onlclick='steal()'>FrrFox</a></href>")
-  end
-
   def test_sanitize_form
     assert_sanitized "<form action=\"/foo/bar\" method=\"post\"><input></form>", ''
   end
@@ -183,7 +181,7 @@ class SanitizersTest < Minitest::Test
     assert_sanitized raw, %{src="javascript:bang" <img width="5">foo</img>, <span>bar</span>}
   end
 
-  tags = Loofah::HTML5::WhiteList::ALLOWED_ELEMENTS - %w(script form)
+  tags = Loofah::HTML5::SafeList::ALLOWED_ELEMENTS - %w(script form)
   tags.each do |tag_name|
     define_method "test_should_allow_#{tag_name}_tag" do
       scope_allowed_tags(tags) do
@@ -253,38 +251,38 @@ class SanitizersTest < Minitest::Test
 
   def test_should_allow_custom_tags
     text = "<u>foo</u>"
-    assert_equal text, white_list_sanitize(text, tags: %w(u))
+    assert_equal text, safe_list_sanitize(text, tags: %w(u))
   end
 
   def test_should_allow_only_custom_tags
     text = "<u>foo</u> with <i>bar</i>"
-    assert_equal "<u>foo</u> with bar", white_list_sanitize(text, tags: %w(u))
+    assert_equal "<u>foo</u> with bar", safe_list_sanitize(text, tags: %w(u))
   end
 
   def test_should_allow_custom_tags_with_attributes
     text = %(<blockquote cite="http://example.com/">foo</blockquote>)
-    assert_equal text, white_list_sanitize(text)
+    assert_equal text, safe_list_sanitize(text)
   end
 
   def test_should_allow_custom_tags_with_custom_attributes
     text = %(<blockquote foo="bar">Lorem ipsum</blockquote>)
-    assert_equal text, white_list_sanitize(text, attributes: ['foo'])
+    assert_equal text, safe_list_sanitize(text, attributes: ['foo'])
   end
 
   def test_scrub_style_if_style_attribute_option_is_passed
     input = '<p style="color: #000; background-image: url(http://www.ragingplatypus.com/i/cam-full.jpg);"></p>'
-    assert_equal '<p style="color: #000;"></p>', white_list_sanitize(input, attributes: %w(style))
+    assert_equal '<p style="color: #000;"></p>', safe_list_sanitize(input, attributes: %w(style))
   end
 
   def test_should_raise_argument_error_if_tags_is_not_enumerable
     assert_raises ArgumentError do
-      white_list_sanitize('<a>some html</a>', tags: 'foo')
+      safe_list_sanitize('<a>some html</a>', tags: 'foo')
     end
   end
 
   def test_should_raise_argument_error_if_attributes_is_not_enumerable
     assert_raises ArgumentError do
-      white_list_sanitize('<a>some html</a>', attributes: 'foo')
+      safe_list_sanitize('<a>some html</a>', attributes: 'foo')
     end
   end
 
@@ -293,7 +291,7 @@ class SanitizersTest < Minitest::Test
     def scrubber.scrub(node); node.name = 'h1'; end
 
     assert_raises Loofah::ScrubberNotFound do
-      white_list_sanitize('<a>some html</a>', scrubber: scrubber)
+      safe_list_sanitize('<a>some html</a>', scrubber: scrubber)
     end
   end
 
@@ -302,19 +300,19 @@ class SanitizersTest < Minitest::Test
     def scrubber.scrub(node); node.name = 'h1'; end
 
     html = "<script>hello!</script>"
-    assert_equal "<h1>hello!</h1>", white_list_sanitize(html, scrubber: scrubber)
+    assert_equal "<h1>hello!</h1>", safe_list_sanitize(html, scrubber: scrubber)
   end
 
   def test_should_accept_loofah_scrubber_that_wraps_a_block
     scrubber = Loofah::Scrubber.new { |node| node.name = 'h1' }
     html = "<script>hello!</script>"
-    assert_equal "<h1>hello!</h1>", white_list_sanitize(html, scrubber: scrubber)
+    assert_equal "<h1>hello!</h1>", safe_list_sanitize(html, scrubber: scrubber)
   end
 
   def test_custom_scrubber_takes_precedence_over_other_options
     scrubber = Loofah::Scrubber.new { |node| node.name = 'h1' }
     html = "<script>hello!</script>"
-    assert_equal "<h1>hello!</h1>", white_list_sanitize(html, scrubber: scrubber, tags: ['foo'])
+    assert_equal "<h1>hello!</h1>", safe_list_sanitize(html, scrubber: scrubber, tags: ['foo'])
   end
 
   [%w(img src), %w(a href)].each do |(tag, attr)|
@@ -360,7 +358,7 @@ class SanitizersTest < Minitest::Test
   end
 
   def test_should_sanitize_script_tag_with_multiple_open_brackets
-    assert_sanitized %(<<SCRIPT>alert("XSS");//<</SCRIPT>), "alert(\"XSS\");//"
+    assert_sanitized %(<<SCRIPT>alert("XSS");//<</SCRIPT>), "&lt;alert(\"XSS\");//&lt;"
     assert_sanitized %(<iframe src=http://ha.ckers.org/scriptlet.html\n<a), ""
   end
 
@@ -383,13 +381,13 @@ class SanitizersTest < Minitest::Test
 
   def test_should_sanitize_illegal_style_properties
     raw      = %(display:block; position:absolute; left:0; top:0; width:100%; height:100%; z-index:1; background-color:black; background-image:url(http://www.ragingplatypus.com/i/cam-full.jpg); background-x:center; background-y:center; background-repeat:repeat;)
-    expected = %(display: block; width: 100%; height: 100%; background-color: black; background-x: center; background-y: center;)
+    expected = %(display:block;width:100%;height:100%;background-color:black;background-x:center;background-y:center;)
     assert_equal expected, sanitize_css(raw)
   end
 
   def test_should_sanitize_with_trailing_space
     raw = "display:block; "
-    expected = "display: block;"
+    expected = "display:block;"
     assert_equal expected, sanitize_css(raw)
   end
 
@@ -466,7 +464,7 @@ class SanitizersTest < Minitest::Test
   end
 
   def test_sanitize_ascii_8bit_string
-    white_list_sanitize('<a>hello</a>'.encode('ASCII-8BIT')).tap do |sanitized|
+    safe_list_sanitize('<a>hello</a>'.encode('ASCII-8BIT')).tap do |sanitized|
       assert_equal '<a>hello</a>', sanitized
       assert_equal Encoding::UTF_8, sanitized.encoding
     end
@@ -479,7 +477,47 @@ class SanitizersTest < Minitest::Test
 
   def test_allow_data_attribute_if_requested
     text = %(<a data-foo="foo">foo</a>)
-    assert_equal %(<a data-foo="foo">foo</a>), white_list_sanitize(text, attributes: ['data-foo'])
+    assert_equal %(<a data-foo="foo">foo</a>), safe_list_sanitize(text, attributes: ['data-foo'])
+  end
+
+  def test_uri_escaping_of_href_attr_in_a_tag_in_safe_list_sanitizer
+    skip if RUBY_VERSION < "2.3"
+
+    html = %{<a href='examp<!--" unsafeattr=foo()>-->le.com'>test</a>}
+
+    text = safe_list_sanitize(html)
+
+    assert_equal %{<a href=\"examp&lt;!--%22%20unsafeattr=foo()&gt;--&gt;le.com\">test</a>}, text
+  end
+
+  def test_uri_escaping_of_src_attr_in_a_tag_in_safe_list_sanitizer
+    skip if RUBY_VERSION < "2.3"
+
+    html = %{<a src='examp<!--" unsafeattr=foo()>-->le.com'>test</a>}
+
+    text = safe_list_sanitize(html)
+
+    assert_equal %{<a src=\"examp&lt;!--%22%20unsafeattr=foo()&gt;--&gt;le.com\">test</a>}, text
+  end
+
+  def test_uri_escaping_of_name_attr_in_a_tag_in_safe_list_sanitizer
+    skip if RUBY_VERSION < "2.3"
+
+    html = %{<a name='examp<!--" unsafeattr=foo()>-->le.com'>test</a>}
+
+    text = safe_list_sanitize(html)
+
+    assert_equal %{<a name=\"examp&lt;!--%22%20unsafeattr=foo()&gt;--&gt;le.com\">test</a>}, text
+  end
+
+  def test_uri_escaping_of_name_action_in_a_tag_in_safe_list_sanitizer
+    skip if RUBY_VERSION < "2.3"
+
+    html = %{<a action='examp<!--" unsafeattr=foo()>-->le.com'>test</a>}
+
+    text = safe_list_sanitize(html, attributes: ['action'])
+
+    assert_equal %{<a action=\"examp&lt;!--%22%20unsafeattr=foo()&gt;--&gt;le.com\">test</a>}, text
   end
 
 protected
@@ -496,35 +534,35 @@ protected
     Rails::Html::LinkSanitizer.new.sanitize(input, options)
   end
 
-  def white_list_sanitize(input, options = {})
-    Rails::Html::WhiteListSanitizer.new.sanitize(input, options)
+  def safe_list_sanitize(input, options = {})
+    Rails::Html::SafeListSanitizer.new.sanitize(input, options)
   end
 
   def assert_sanitized(input, expected = nil)
     if input
-      assert_dom_equal expected || input, white_list_sanitize(input)
+      assert_dom_equal expected || input, safe_list_sanitize(input)
     else
-      assert_nil white_list_sanitize(input)
+      assert_nil safe_list_sanitize(input)
     end
   end
 
   def sanitize_css(input)
-    Rails::Html::WhiteListSanitizer.new.sanitize_css(input)
+    Rails::Html::SafeListSanitizer.new.sanitize_css(input)
   end
 
   def scope_allowed_tags(tags)
-    old_tags = Rails::Html::WhiteListSanitizer.allowed_tags
-    Rails::Html::WhiteListSanitizer.allowed_tags = tags
-    yield Rails::Html::WhiteListSanitizer.new
+    old_tags = Rails::Html::SafeListSanitizer.allowed_tags
+    Rails::Html::SafeListSanitizer.allowed_tags = tags
+    yield Rails::Html::SafeListSanitizer.new
   ensure
-    Rails::Html::WhiteListSanitizer.allowed_tags = old_tags
+    Rails::Html::SafeListSanitizer.allowed_tags = old_tags
   end
 
   def scope_allowed_attributes(attributes)
-    old_attributes = Rails::Html::WhiteListSanitizer.allowed_attributes
-    Rails::Html::WhiteListSanitizer.allowed_attributes = attributes
-    yield Rails::Html::WhiteListSanitizer.new
+    old_attributes = Rails::Html::SafeListSanitizer.allowed_attributes
+    Rails::Html::SafeListSanitizer.allowed_attributes = attributes
+    yield Rails::Html::SafeListSanitizer.new
   ensure
-    Rails::Html::WhiteListSanitizer.allowed_attributes = old_attributes
+    Rails::Html::SafeListSanitizer.allowed_attributes = old_attributes
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-html-sanitizer
 version: !ruby/object:Gem::Version
-  version: 1.0.3
+  version: 1.3.0
 platform: ruby
 authors:
 - Rafael Mendonça França
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-01-25 00:00:00.000000000 Z
+date: 2019-10-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: loofah
@@ -17,26 +17,26 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.3'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.3'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.3'
 - !ruby/object:Gem::Dependency
@@ -90,6 +90,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - CHANGELOG.md
+- MIT-LICENSE
 - README.md
 - lib/rails-html-sanitizer.rb
 - lib/rails/html/sanitizer.rb
@@ -116,11 +117,10 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.5.1
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: This gem is responsible to sanitize HTML fragments in Rails applications.
 test_files:
-- test/sanitizer_test.rb
 - test/scrubbers_test.rb
+- test/sanitizer_test.rb