rails-html-sanitizer 1.6.2 → 1.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d5507b24d4d93d6efebf2e327d04980dd114cd491732b5c71a7e1a3294c846a9
-  data.tar.gz: dd7a5070b04bf6a97b96df01d65fce9d52790e62dc6631b31fb72ecc2a6d16ed
+  metadata.gz: 1e57ccc4baea7e97018e7794845e4f95ca0beee76bbdeff5f377dc1d8385a170
+  data.tar.gz: 4b66dc1f9e7f0bfbcb8707c4c208ed6f9f3af50b521015d65e638e90296db066
 SHA512:
-  metadata.gz: 912e9d41629bd93de8a14352757add81fde36e394e7907923a88dbebc39da85722fc13a01fa23973421a11e715b41fb78cec3f0379ccf5a97ab0f0ee3ed3dc5a
-  data.tar.gz: e03d92f6289ef71e4039a64b89bce79c5d5a9d628632c84b2b54235fbe69384578de92f7b2db114c13d041c4d589672dd09e23758a043e675eb37f961a858f67
+  metadata.gz: 5ba5bacc8b35f00909f62e68dbb21c30bce706d6e19865803a84119c5fb3ea6ac459719e5b14827f370d428e9fc22eb0cb507824f864855857abc9303175e46a
+  data.tar.gz: 395e935d2056f773fbf8324caa0852e070245dd02d7b6d69b205b4a4835fedc3951484f724ea20f69f6ae98578d80535eedc950be44cf149b440249bd1d58ee8

data/CHANGELOG.md

@@ -1,3 +1,28 @@
+## v1.7.1 / 2026-07-15
+
+* SVG reference elements now restrict both `href` and `xlink:href` to local references.
+
+  Previously `PermitScrubber` restricted only `xlink:href` on elements in `SVG_ALLOW_LOCAL_HREF`,
+  so a plain `href` attribute on those elements could reference an external document. Applications
+  are only affected if the allowed tags are overridden to include an SVG reference element such as
+  `use`; the default configuration is not affected.
+
+  This change addresses GHSA-cj75-f6xr-r4g7 (CVE requested). The minimum Loofah dependency is now
+  `~> 2.25, >= 2.25.2`.
+
+  *Mike Dalessio*
+
+
+## v1.7.0 / 2026-02-24
+
+* Add `Rails::HTML::Sanitizer.allowed_uri?` which delegates to `Loofah::HTML5::Scrub.allowed_uri?`,
+  allowing the Rails framework to check URI safety without a direct dependency on Loofah.
+
+  The minimum Loofah dependency is now `~> 2.25`.
+
+  *Mike Dalessio*
+
+
 ## v1.6.2 / 2024-12-12
 
 * `PermitScrubber` fully supports frozen "allowed tags".

data/lib/rails/html/sanitizer/version.rb

@@ -3,7 +3,7 @@
 module Rails
   module HTML
     class Sanitizer
-      VERSION = "1.6.2"
+      VERSION = "1.7.1"
     end
   end
 end

data/lib/rails/html/sanitizer.rb

@@ -13,6 +13,10 @@ module Rails
         def best_supported_vendor
           html5_support? ? Rails::HTML5::Sanitizer : Rails::HTML4::Sanitizer
         end
+
+        def allowed_uri?(uri_string)
+          Loofah::HTML5::Scrub.allowed_uri?(uri_string)
+        end
       end
 
       def sanitize(html, options = {})

data/lib/rails/html/scrubbers.rb

@@ -172,7 +172,7 @@ module Rails
             Loofah::HTML5::Scrub.scrub_attribute_that_allows_local_ref(attr_node)
           end
 
-          if Loofah::HTML5::SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) && attr_name == "xlink:href" && attr_node.value =~ /^\s*[^#\s].*/m
+          if Loofah::HTML5::SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) && Loofah::HTML5::SafeList::SVG_HREF_ATTRIBUTES.include?(attr_name) && attr_node.value =~ /^\s*[^#\s].*/m
             attr_node.remove
           end
 

metadata

@@ -1,16 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: rails-html-sanitizer
 version: !ruby/object:Gem::Version
-  version: 1.6.2
+  version: 1.7.1
 platform: ruby
 authors:
 - Rafael Mendonça França
 - Kasper Timm Hansen
 - Mike Dalessio
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-12-12 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: loofah
@@ -18,14 +17,20 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.21'
+        version: '2.25'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.25.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.21'
+        version: '2.25'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.25.2
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -110,18 +115,14 @@ files:
 - lib/rails/html/sanitizer.rb
 - lib/rails/html/sanitizer/version.rb
 - lib/rails/html/scrubbers.rb
-- test/rails_api_test.rb
-- test/sanitizer_test.rb
-- test/scrubbers_test.rb
 homepage: https://github.com/rails/rails-html-sanitizer
 licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails-html-sanitizer/issues
-  changelog_uri: https://github.com/rails/rails-html-sanitizer/blob/v1.6.2/CHANGELOG.md
-  documentation_uri: https://www.rubydoc.info/gems/rails-html-sanitizer/1.6.2
-  source_code_uri: https://github.com/rails/rails-html-sanitizer/tree/v1.6.2
-post_install_message:
+  changelog_uri: https://github.com/rails/rails-html-sanitizer/blob/v1.7.1/CHANGELOG.md
+  documentation_uri: https://www.rubydoc.info/gems/rails-html-sanitizer/1.7.1
+  source_code_uri: https://github.com/rails/rails-html-sanitizer/tree/v1.7.1
 rdoc_options: []
 require_paths:
 - lib
@@ -136,11 +137,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.22
-signing_key:
+rubygems_version: 4.0.10
 specification_version: 4
 summary: This gem is responsible to sanitize HTML fragments in Rails applications.
-test_files:
-- test/rails_api_test.rb
-- test/sanitizer_test.rb
-- test/scrubbers_test.rb
+test_files: []

data/test/rails_api_test.rb

@@ -1,88 +0,0 @@
-# frozen_string_literal: true
-
-require "minitest/autorun"
-require "rails-html-sanitizer"
-
-class RailsApiTest < Minitest::Test
-  def test_html_module_name_alias
-    assert_equal(Rails::Html, Rails::HTML)
-    assert_equal("Rails::HTML", Rails::Html.name)
-    assert_equal("Rails::HTML", Rails::HTML.name)
-  end
-
-  def test_html_scrubber_class_names
-    assert(Rails::Html::PermitScrubber)
-    assert(Rails::Html::TargetScrubber)
-    assert(Rails::Html::TextOnlyScrubber)
-    assert(Rails::Html::Sanitizer)
-  end
-
-  def test_best_supported_vendor_when_html5_is_not_supported_returns_html4
-    Rails::HTML::Sanitizer.stub(:html5_support?, false) do
-      assert_equal(Rails::HTML4::Sanitizer, Rails::HTML::Sanitizer.best_supported_vendor)
-    end
-  end
-
-  def test_best_supported_vendor_when_html5_is_supported_returns_html5
-    skip("no HTML5 support on this platform") unless Rails::HTML::Sanitizer.html5_support?
-
-    Rails::HTML::Sanitizer.stub(:html5_support?, true) do
-      assert_equal(Rails::HTML5::Sanitizer, Rails::HTML::Sanitizer.best_supported_vendor)
-    end
-  end
-
-  def test_html4_sanitizer_alias_full
-    assert_equal(Rails::HTML4::FullSanitizer, Rails::HTML::FullSanitizer)
-    assert_equal("Rails::HTML4::FullSanitizer", Rails::HTML::FullSanitizer.name)
-  end
-
-  def test_html4_sanitizer_alias_link
-    assert_equal(Rails::HTML4::LinkSanitizer, Rails::HTML::LinkSanitizer)
-    assert_equal("Rails::HTML4::LinkSanitizer", Rails::HTML::LinkSanitizer.name)
-  end
-
-  def test_html4_sanitizer_alias_safe_list
-    assert_equal(Rails::HTML4::SafeListSanitizer, Rails::HTML::SafeListSanitizer)
-    assert_equal("Rails::HTML4::SafeListSanitizer", Rails::HTML::SafeListSanitizer.name)
-  end
-
-  def test_html4_full_sanitizer
-    assert_equal(Rails::HTML4::FullSanitizer, Rails::HTML::Sanitizer.full_sanitizer)
-    assert_equal(Rails::HTML4::FullSanitizer, Rails::HTML4::Sanitizer.full_sanitizer)
-  end
-
-  def test_html4_link_sanitizer
-    assert_equal(Rails::HTML4::LinkSanitizer, Rails::HTML::Sanitizer.link_sanitizer)
-    assert_equal(Rails::HTML4::LinkSanitizer, Rails::HTML4::Sanitizer.link_sanitizer)
-  end
-
-  def test_html4_safe_list_sanitizer
-    assert_equal(Rails::HTML4::SafeListSanitizer, Rails::HTML::Sanitizer.safe_list_sanitizer)
-    assert_equal(Rails::HTML4::SafeListSanitizer, Rails::HTML4::Sanitizer.safe_list_sanitizer)
-  end
-
-  def test_html4_white_list_sanitizer
-    assert_equal(Rails::HTML4::SafeListSanitizer, Rails::HTML::Sanitizer.white_list_sanitizer)
-    assert_equal(Rails::HTML4::SafeListSanitizer, Rails::HTML4::Sanitizer.white_list_sanitizer)
-  end
-
-  def test_html5_full_sanitizer
-    skip("no HTML5 support on this platform") unless Rails::HTML::Sanitizer.html5_support?
-    assert_equal(Rails::HTML5::FullSanitizer, Rails::HTML5::Sanitizer.full_sanitizer)
-  end
-
-  def test_html5_link_sanitizer
-    skip("no HTML5 support on this platform") unless Rails::HTML::Sanitizer.html5_support?
-    assert_equal(Rails::HTML5::LinkSanitizer, Rails::HTML5::Sanitizer.link_sanitizer)
-  end
-
-  def test_html5_safe_list_sanitizer
-    skip("no HTML5 support on this platform") unless Rails::HTML::Sanitizer.html5_support?
-    assert_equal(Rails::HTML5::SafeListSanitizer, Rails::HTML5::Sanitizer.safe_list_sanitizer)
-  end
-
-  def test_html5_white_list_sanitizer
-    skip("no HTML5 support on this platform") unless Rails::HTML::Sanitizer.html5_support?
-    assert_equal(Rails::HTML5::SafeListSanitizer, Rails::HTML5::Sanitizer.white_list_sanitizer)
-  end
-end