rails-html-sanitizer 1.0.4 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f1aa629ae03d828f900932e2272c2d13baf2eae94adb214896cdf2eb959e4172
-  data.tar.gz: 970c65b32aa93c659e6483e8b798ea23fa8b8eadb1963fba813dd33ba6432ae2
+  metadata.gz: 78b391f62382bca60620a37a2b7a1fe6cd8e81545210d308bc56991d11b39b6e
+  data.tar.gz: a8065b0d76a88caadeb594ac9e70857aaf061cdceab106781af41285c2e7302f
 SHA512:
-  metadata.gz: c97587f6427b9e67e76050f21ab8f39148fd0ff47e87282a4a13802a6ae02ffa62034a187a8e5cfd0577e53d0f0cbc8e2e72abce3171d7f6139f186f1b75e1a2
-  data.tar.gz: 411f2f9593fda42880b3ed9fcb99431e353c133d36a74e0aed52fa3959efa4bd8cc6aad5d90dddfc4565b0fabc80d68e9cfbf8cea055ae9463cba326f0735dc2
+  metadata.gz: b2a15acaf0bf620db43645b28d44d4e75d9bb9111bf77d4c7d90f812f697cbd8e33b704694af590e2af3c5e083d600c1cf82f7234ef737a05954582d1785bebb
+  data.tar.gz: af8b02f7811544234b263bfa6dd7062f117e549a6b58271be609c827a1468131caa56afd14b4f2b34e069e5f5d088ef3ba05f11c62b7d84ed69da6794c2c7de0

data/CHANGELOG.md

@@ -1,3 +1,20 @@
+## 1.1.0
+
+* Add `safe_list_sanitizer` and deprecate `white_list_sanitizer` to be removed
+  in 1.2.0. https://github.com/rails/rails-html-sanitizer/pull/87
+
+  *Juanito Fatas*
+
+* Remove `href` from LinkScrubber's `tags` as it's not an element.
+  https://github.com/rails/rails-html-sanitizer/pull/92
+
+  *Juanito Fatas*
+
+* Explain that we don't need to bump Loofah here if there's CVEs.
+  https://github.com/rails/rails-html-sanitizer/commit/d4d823c617fdd0064956047f7fbf23fff305a69b
+
+  *Kasper Timm Hansen*
+
 ## 1.0.1
 
 * Added support for Rails 4.2.0.beta2 and above

data/README.md

@@ -41,22 +41,22 @@ link_sanitizer.sanitize('<a href="example.com">Only the link text will be kept.<
 # => Only the link text will be kept.
 ```
 
-#### WhiteListSanitizer
+#### SafeListSanitizer
 
 ```ruby
-white_list_sanitizer = Rails::Html::WhiteListSanitizer.new
+safe_list_sanitizer = Rails::Html::SafeListSanitizer.new
 
-# sanitize via an extensive white list of allowed elements
-white_list_sanitizer.sanitize(@article.body)
+# sanitize via an extensive safe list of allowed elements
+safe_list_sanitizer.sanitize(@article.body)
 
-# white list only the supplied tags and attributes
-white_list_sanitizer.sanitize(@article.body, tags: %w(table tr td), attributes: %w(id class style))
+# safe list only the supplied tags and attributes
+safe_list_sanitizer.sanitize(@article.body, tags: %w(table tr td), attributes: %w(id class style))
 
-# white list via a custom scrubber
-white_list_sanitizer.sanitize(@article.body, scrubber: ArticleScrubber.new)
+# safe list via a custom scrubber
+safe_list_sanitizer.sanitize(@article.body, scrubber: ArticleScrubber.new)
 
-# white list sanitizer can also sanitize css
-white_list_sanitizer.sanitize_css('background-color: #000;')
+# safe list sanitizer can also sanitize css
+safe_list_sanitizer.sanitize_css('background-color: #000;')
 ```
 
 ### Scrubbers
@@ -127,7 +127,7 @@ Loofah is what underlies the sanitizers and scrubbers of rails-html-sanitizer.
 - [Loofah and Loofah Scrubbers](https://github.com/flavorjones/loofah)
 
 The `node` argument passed to some methods in a custom scrubber is an instance of `Nokogiri::XML::Node`.
-- [`Nokogiri::XML::Node`](http://nokogiri.org/Nokogiri/XML/Node.html)
+- [`Nokogiri::XML::Node`](https://nokogiri.org/rdoc/Nokogiri/XML/Node.html)
 - [Nokogiri](http://nokogiri.org)
 
 ## Contributing to Rails Html Sanitizers

data/lib/rails-html-sanitizer.rb

@@ -15,8 +15,14 @@ module Rails
           Html::LinkSanitizer
         end
 
+        def safe_list_sanitizer
+          Html::SafeListSanitizer
+        end
+
         def white_list_sanitizer
-          Html::WhiteListSanitizer
+          ActiveSupport::Deprecation.warn "warning: white_list_sanitizer is" \
+          "deprecated, please use safe_list_sanitizer instead."
+          safe_list_sanitizer
         end
       end
     end
@@ -34,7 +40,7 @@ module ActionView
         #   end
         #
         def sanitized_allowed_tags=(tags)
-          sanitizer_vendor.white_list_sanitizer.allowed_tags = tags
+          sanitizer_vendor.safe_list_sanitizer.allowed_tags = tags
         end
 
         # Replaces the allowed HTML attributes for the +sanitize+ helper.
@@ -44,7 +50,7 @@ module ActionView
         #   end
         #
         def sanitized_allowed_attributes=(attributes)
-          sanitizer_vendor.white_list_sanitizer.allowed_attributes = attributes
+          sanitizer_vendor.safe_list_sanitizer.allowed_attributes = attributes
         end
 
         [:protocol_separator,

data/lib/rails/html/sanitizer.rb

@@ -40,15 +40,16 @@ module Rails
     end
 
     # === Rails::Html::LinkSanitizer
-    # Removes a tags and href attributes leaving only the link text
+    # Removes +a+ tags and +href+ attributes leaving only the link text.
     #
-    # link_sanitizer = Rails::Html::LinkSanitizer.new
-    # link_sanitizer.sanitize('<a href="example.com">Only the link text will be kept.</a>')
-    # # => Only the link text will be kept.
+    #  link_sanitizer = Rails::Html::LinkSanitizer.new
+    #  link_sanitizer.sanitize('<a href="example.com">Only the link text will be kept.</a>')
+    #
+    #  => 'Only the link text will be kept.'
     class LinkSanitizer < Sanitizer
       def initialize
         @link_scrubber = TargetScrubber.new
-        @link_scrubber.tags = %w(a href)
+        @link_scrubber.tags = %w(a)
         @link_scrubber.attributes = %w(href)
       end
 
@@ -57,8 +58,8 @@ module Rails
       end
     end
 
-    # === Rails::Html::WhiteListSanitizer
-    # Sanitizes html and css from an extensive white list (see link further down).
+    # === Rails::Html::SafeListSanitizer
+    # Sanitizes html and css from an extensive safe list (see link further down).
     #
     # === Whitespace
     # We can't make any guarantees about whitespace being kept or stripped.
@@ -72,34 +73,34 @@ module Rails
     # so automatically.
     #
     # === Options
-    # Sanitizes both html and css via the white lists found here:
+    # Sanitizes both html and css via the safe lists found here:
     # https://github.com/flavorjones/loofah/blob/master/lib/loofah/html5/whitelist.rb
     #
-    # WhiteListSanitizer also accepts options to configure
-    # the white list used when sanitizing html.
+    # SafeListSanitizer also accepts options to configure
+    # the safe list used when sanitizing html.
     # There's a class level option:
-    # Rails::Html::WhiteListSanitizer.allowed_tags = %w(table tr td)
-    # Rails::Html::WhiteListSanitizer.allowed_attributes = %w(id class style)
+    # Rails::Html::SafeListSanitizer.allowed_tags = %w(table tr td)
+    # Rails::Html::SafeListSanitizer.allowed_attributes = %w(id class style)
     #
     # Tags and attributes can also be passed to +sanitize+.
     # Passed options take precedence over the class level options.
     #
     # === Examples
-    # white_list_sanitizer = Rails::Html::WhiteListSanitizer.new
+    # safe_list_sanitizer = Rails::Html::SafeListSanitizer.new
     #
     # Sanitize css doesn't take options
-    # white_list_sanitizer.sanitize_css('background-color: #000;')
+    # safe_list_sanitizer.sanitize_css('background-color: #000;')
     #
-    # Default: sanitize via a extensive white list of allowed elements
-    # white_list_sanitizer.sanitize(@article.body)
+    # Default: sanitize via a extensive safe list of allowed elements
+    # safe_list_sanitizer.sanitize(@article.body)
     #
-    # White list via the supplied tags and attributes
-    # white_list_sanitizer.sanitize(@article.body, tags: %w(table tr td),
+    # Safe list via the supplied tags and attributes
+    # safe_list_sanitizer.sanitize(@article.body, tags: %w(table tr td),
     # attributes: %w(id class style))
     #
-    # White list via a custom scrubber
-    # white_list_sanitizer.sanitize(@article.body, scrubber: ArticleScrubber.new)
-    class WhiteListSanitizer < Sanitizer
+    # Safe list via a custom scrubber
+    # safe_list_sanitizer.sanitize(@article.body, scrubber: ArticleScrubber.new)
+    class SafeListSanitizer < Sanitizer
       class << self
         attr_accessor :allowed_tags
         attr_accessor :allowed_attributes
@@ -148,5 +149,10 @@ module Rails
         options[:attributes] || self.class.allowed_attributes
       end
     end
+
+    WhiteListSanitizer = SafeListSanitizer
+    if Object.respond_to?(:deprecate_constant)
+      deprecate_constant :WhiteListSanitizer
+    end
   end
 end

data/lib/rails/html/sanitizer/version.rb

@@ -1,7 +1,7 @@
 module Rails
   module Html
     class Sanitizer
-      VERSION = "1.0.4"
+      VERSION = "1.1.0"
     end
   end
 end

data/lib/rails/html/scrubbers.rb

@@ -2,9 +2,9 @@ module Rails
   module Html
     # === Rails::Html::PermitScrubber
     #
-    # Rails::Html::PermitScrubber allows you to permit only your own tags and/or attributes.
+    # +Rails::Html::PermitScrubber+ allows you to permit only your own tags and/or attributes.
     #
-    # Rails::Html::PermitScrubber can be subclassed to determine:
+    # +Rails::Html::PermitScrubber+ can be subclassed to determine:
     # - When a node should be skipped via +skip_node?+.
     # - When a node is allowed via +allowed_node?+.
     # - When an attribute should be scrubbed via +scrub_attribute?+.
@@ -27,23 +27,23 @@ module Rails
     # If set, attributes excluded will be removed.
     # If not, attributes are removed based on Loofahs +HTML5::Scrub.scrub_attributes+.
     #
-    # class CommentScrubber < Html::PermitScrubber
-    #   def initialize
-    #     super
-    #     self.tags = %w(form script comment blockquote)
-    #   end
+    #  class CommentScrubber < Html::PermitScrubber
+    #    def initialize
+    #      super
+    #      self.tags = %w(form script comment blockquote)
+    #    end
     #
-    #   def skip_node?(node)
-    #     node.text?
-    #   end
+    #    def skip_node?(node)
+    #      node.text?
+    #    end
     #
-    #   def scrub_attribute?(name)
-    #     name == "style"
-    #   end
-    # end
+    #    def scrub_attribute?(name)
+    #      name == "style"
+    #    end
+    #  end
     #
-    # See the documentation for Nokogiri::XML::Node to understand what's possible
-    # with nodes: http://nokogiri.org/Nokogiri/XML/Node.html
+    # See the documentation for +Nokogiri::XML::Node+ to understand what's possible
+    # with nodes: https://nokogiri.org/rdoc/Nokogiri/XML/Node.html
     class PermitScrubber < Loofah::Scrubber
       attr_reader :tags, :attributes
 
@@ -160,8 +160,8 @@ module Rails
 
     # === Rails::Html::TargetScrubber
     #
-    # Where Rails::Html::PermitScrubber picks out tags and attributes to permit in
-    # sanitization, Rails::Html::TargetScrubber targets them for removal.
+    # Where +Rails::Html::PermitScrubber+ picks out tags and attributes to permit in
+    # sanitization, +Rails::Html::TargetScrubber+ targets them for removal.
     #
     # +tags=+
     # If set, elements included will be stripped.
@@ -180,7 +180,7 @@ module Rails
 
     # === Rails::Html::TextOnlyScrubber
     #
-    # Rails::Html::TextOnlyScrubber allows you to permit text nodes.
+    # +Rails::Html::TextOnlyScrubber+ allows you to permit text nodes.
     #
     # Unallowed elements will be stripped, i.e. element is removed but its subtree kept.
     class TextOnlyScrubber < Loofah::Scrubber

data/test/sanitizer_test.rb

@@ -12,12 +12,12 @@ class SanitizersTest < Minitest::Test
   end
 
   def test_sanitize_nested_script
-    sanitizer = Rails::Html::WhiteListSanitizer.new
+    sanitizer = Rails::Html::SafeListSanitizer.new
     assert_equal '&lt;script&gt;alert("XSS");&lt;/script&gt;', sanitizer.sanitize('<script><script></script>alert("XSS");<script><</script>/</script><script>script></script>', tags: %w(em))
   end
 
   def test_sanitize_nested_script_in_style
-    sanitizer = Rails::Html::WhiteListSanitizer.new
+    sanitizer = Rails::Html::SafeListSanitizer.new
     assert_equal '&lt;script&gt;alert("XSS");&lt;/script&gt;', sanitizer.sanitize('<style><script></style>alert("XSS");<style><</style>/</style><style>script></style>', tags: %w(em))
   end
 
@@ -154,10 +154,6 @@ class SanitizersTest < Minitest::Test
     assert_equal "Magic", link_sanitize("<a href='http://www.rubyonrails.com/'>Mag<a href='http://www.ruby-lang.org/'>ic")
   end
 
-  def test_strip_links_with_a_tag_in_href
-    assert_equal "FrrFox", link_sanitize("<href onlclick='steal()'>FrrFox</a></href>")
-  end
-
   def test_sanitize_form
     assert_sanitized "<form action=\"/foo/bar\" method=\"post\"><input></form>", ''
   end
@@ -255,38 +251,38 @@ class SanitizersTest < Minitest::Test
 
   def test_should_allow_custom_tags
     text = "<u>foo</u>"
-    assert_equal text, white_list_sanitize(text, tags: %w(u))
+    assert_equal text, safe_list_sanitize(text, tags: %w(u))
   end
 
   def test_should_allow_only_custom_tags
     text = "<u>foo</u> with <i>bar</i>"
-    assert_equal "<u>foo</u> with bar", white_list_sanitize(text, tags: %w(u))
+    assert_equal "<u>foo</u> with bar", safe_list_sanitize(text, tags: %w(u))
   end
 
   def test_should_allow_custom_tags_with_attributes
     text = %(<blockquote cite="http://example.com/">foo</blockquote>)
-    assert_equal text, white_list_sanitize(text)
+    assert_equal text, safe_list_sanitize(text)
   end
 
   def test_should_allow_custom_tags_with_custom_attributes
     text = %(<blockquote foo="bar">Lorem ipsum</blockquote>)
-    assert_equal text, white_list_sanitize(text, attributes: ['foo'])
+    assert_equal text, safe_list_sanitize(text, attributes: ['foo'])
   end
 
   def test_scrub_style_if_style_attribute_option_is_passed
     input = '<p style="color: #000; background-image: url(http://www.ragingplatypus.com/i/cam-full.jpg);"></p>'
-    assert_equal '<p style="color: #000;"></p>', white_list_sanitize(input, attributes: %w(style))
+    assert_equal '<p style="color: #000;"></p>', safe_list_sanitize(input, attributes: %w(style))
   end
 
   def test_should_raise_argument_error_if_tags_is_not_enumerable
     assert_raises ArgumentError do
-      white_list_sanitize('<a>some html</a>', tags: 'foo')
+      safe_list_sanitize('<a>some html</a>', tags: 'foo')
     end
   end
 
   def test_should_raise_argument_error_if_attributes_is_not_enumerable
     assert_raises ArgumentError do
-      white_list_sanitize('<a>some html</a>', attributes: 'foo')
+      safe_list_sanitize('<a>some html</a>', attributes: 'foo')
     end
   end
 
@@ -295,7 +291,7 @@ class SanitizersTest < Minitest::Test
     def scrubber.scrub(node); node.name = 'h1'; end
 
     assert_raises Loofah::ScrubberNotFound do
-      white_list_sanitize('<a>some html</a>', scrubber: scrubber)
+      safe_list_sanitize('<a>some html</a>', scrubber: scrubber)
     end
   end
 
@@ -304,19 +300,19 @@ class SanitizersTest < Minitest::Test
     def scrubber.scrub(node); node.name = 'h1'; end
 
     html = "<script>hello!</script>"
-    assert_equal "<h1>hello!</h1>", white_list_sanitize(html, scrubber: scrubber)
+    assert_equal "<h1>hello!</h1>", safe_list_sanitize(html, scrubber: scrubber)
   end
 
   def test_should_accept_loofah_scrubber_that_wraps_a_block
     scrubber = Loofah::Scrubber.new { |node| node.name = 'h1' }
     html = "<script>hello!</script>"
-    assert_equal "<h1>hello!</h1>", white_list_sanitize(html, scrubber: scrubber)
+    assert_equal "<h1>hello!</h1>", safe_list_sanitize(html, scrubber: scrubber)
   end
 
   def test_custom_scrubber_takes_precedence_over_other_options
     scrubber = Loofah::Scrubber.new { |node| node.name = 'h1' }
     html = "<script>hello!</script>"
-    assert_equal "<h1>hello!</h1>", white_list_sanitize(html, scrubber: scrubber, tags: ['foo'])
+    assert_equal "<h1>hello!</h1>", safe_list_sanitize(html, scrubber: scrubber, tags: ['foo'])
   end
 
   [%w(img src), %w(a href)].each do |(tag, attr)|
@@ -468,7 +464,7 @@ class SanitizersTest < Minitest::Test
   end
 
   def test_sanitize_ascii_8bit_string
-    white_list_sanitize('<a>hello</a>'.encode('ASCII-8BIT')).tap do |sanitized|
+    safe_list_sanitize('<a>hello</a>'.encode('ASCII-8BIT')).tap do |sanitized|
       assert_equal '<a>hello</a>', sanitized
       assert_equal Encoding::UTF_8, sanitized.encoding
     end
@@ -481,39 +477,47 @@ class SanitizersTest < Minitest::Test
 
   def test_allow_data_attribute_if_requested
     text = %(<a data-foo="foo">foo</a>)
-    assert_equal %(<a data-foo="foo">foo</a>), white_list_sanitize(text, attributes: ['data-foo'])
+    assert_equal %(<a data-foo="foo">foo</a>), safe_list_sanitize(text, attributes: ['data-foo'])
   end
 
-  def test_uri_escaping_of_href_attr_in_a_tag_in_white_list_sanitizer
+  def test_uri_escaping_of_href_attr_in_a_tag_in_safe_list_sanitizer
+    skip if RUBY_VERSION < "2.3"
+
     html = %{<a href='examp<!--" unsafeattr=foo()>-->le.com'>test</a>}
 
-    text = white_list_sanitize(html)
+    text = safe_list_sanitize(html)
 
-    assert_equal %{<a href="examp<!--%22%20unsafeattr=foo()>-->le.com">test</a>}, text
+    assert_equal %{<a href=\"examp&lt;!--%22%20unsafeattr=foo()&gt;--&gt;le.com\">test</a>}, text
   end
 
-  def test_uri_escaping_of_src_attr_in_a_tag_in_white_list_sanitizer
+  def test_uri_escaping_of_src_attr_in_a_tag_in_safe_list_sanitizer
+    skip if RUBY_VERSION < "2.3"
+
     html = %{<a src='examp<!--" unsafeattr=foo()>-->le.com'>test</a>}
 
-    text = white_list_sanitize(html)
+    text = safe_list_sanitize(html)
 
-    assert_equal %{<a src="examp<!--%22%20unsafeattr=foo()>-->le.com">test</a>}, text
+    assert_equal %{<a src=\"examp&lt;!--%22%20unsafeattr=foo()&gt;--&gt;le.com\">test</a>}, text
   end
 
-  def test_uri_escaping_of_name_attr_in_a_tag_in_white_list_sanitizer
+  def test_uri_escaping_of_name_attr_in_a_tag_in_safe_list_sanitizer
+    skip if RUBY_VERSION < "2.3"
+
     html = %{<a name='examp<!--" unsafeattr=foo()>-->le.com'>test</a>}
 
-    text = white_list_sanitize(html)
+    text = safe_list_sanitize(html)
 
-    assert_equal %{<a name="examp<!--%22%20unsafeattr=foo()>-->le.com">test</a>}, text
+    assert_equal %{<a name=\"examp&lt;!--%22%20unsafeattr=foo()&gt;--&gt;le.com\">test</a>}, text
   end
 
-  def test_uri_escaping_of_name_action_in_a_tag_in_white_list_sanitizer
+  def test_uri_escaping_of_name_action_in_a_tag_in_safe_list_sanitizer
+    skip if RUBY_VERSION < "2.3"
+
     html = %{<a action='examp<!--" unsafeattr=foo()>-->le.com'>test</a>}
 
-    text = white_list_sanitize(html, attributes: ['action'])
+    text = safe_list_sanitize(html, attributes: ['action'])
 
-    assert_equal %{<a action="examp<!--%22%20unsafeattr=foo()>-->le.com">test</a>}, text
+    assert_equal %{<a action=\"examp&lt;!--%22%20unsafeattr=foo()&gt;--&gt;le.com\">test</a>}, text
   end
 
 protected
@@ -530,35 +534,35 @@ protected
     Rails::Html::LinkSanitizer.new.sanitize(input, options)
   end
 
-  def white_list_sanitize(input, options = {})
-    Rails::Html::WhiteListSanitizer.new.sanitize(input, options)
+  def safe_list_sanitize(input, options = {})
+    Rails::Html::SafeListSanitizer.new.sanitize(input, options)
   end
 
   def assert_sanitized(input, expected = nil)
     if input
-      assert_dom_equal expected || input, white_list_sanitize(input)
+      assert_dom_equal expected || input, safe_list_sanitize(input)
     else
-      assert_nil white_list_sanitize(input)
+      assert_nil safe_list_sanitize(input)
     end
   end
 
   def sanitize_css(input)
-    Rails::Html::WhiteListSanitizer.new.sanitize_css(input)
+    Rails::Html::SafeListSanitizer.new.sanitize_css(input)
   end
 
   def scope_allowed_tags(tags)
-    old_tags = Rails::Html::WhiteListSanitizer.allowed_tags
-    Rails::Html::WhiteListSanitizer.allowed_tags = tags
-    yield Rails::Html::WhiteListSanitizer.new
+    old_tags = Rails::Html::SafeListSanitizer.allowed_tags
+    Rails::Html::SafeListSanitizer.allowed_tags = tags
+    yield Rails::Html::SafeListSanitizer.new
   ensure
-    Rails::Html::WhiteListSanitizer.allowed_tags = old_tags
+    Rails::Html::SafeListSanitizer.allowed_tags = old_tags
   end
 
   def scope_allowed_attributes(attributes)
-    old_attributes = Rails::Html::WhiteListSanitizer.allowed_attributes
-    Rails::Html::WhiteListSanitizer.allowed_attributes = attributes
-    yield Rails::Html::WhiteListSanitizer.new
+    old_attributes = Rails::Html::SafeListSanitizer.allowed_attributes
+    Rails::Html::SafeListSanitizer.allowed_attributes = attributes
+    yield Rails::Html::SafeListSanitizer.new
   ensure
-    Rails::Html::WhiteListSanitizer.allowed_attributes = old_attributes
+    Rails::Html::SafeListSanitizer.allowed_attributes = old_attributes
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-html-sanitizer
 version: !ruby/object:Gem::Version
-  version: 1.0.4
+  version: 1.1.0
 platform: ruby
 authors:
 - Rafael Mendonça França
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-03-22 00:00:00.000000000 Z
+date: 2019-08-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: loofah
@@ -35,14 +35,14 @@ dependencies:
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.3'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.3'
 - !ruby/object:Gem::Dependency
@@ -123,8 +123,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.6
+rubygems_version: 3.0.4
 signing_key: 
 specification_version: 4
 summary: This gem is responsible to sanitize HTML fragments in Rails applications.