rails-html-sanitizer 1.7.0 → 1.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1e73c95bdfd00d65afcc40a3ef436fe4bab7b7571e62b789a877ea2b201a2740
-  data.tar.gz: 9ac916682a1d0b3b6f45059f5509a1f7785349e0c08102fac6cb1539bff0db3f
+  metadata.gz: 1e57ccc4baea7e97018e7794845e4f95ca0beee76bbdeff5f377dc1d8385a170
+  data.tar.gz: 4b66dc1f9e7f0bfbcb8707c4c208ed6f9f3af50b521015d65e638e90296db066
 SHA512:
-  metadata.gz: d70c999e3775bb58adcc8b6b785c49b7f79ea14990042c2a96105cd36b09c8126f25a317e8f9ab920b0aeaaf107e61870443e0afff78ea291ad163e659b043e6
-  data.tar.gz: 440f779d178582a39723cc22191e7397becdbc2c2fbd36d3af7eac52f66ce722a9f9000f4cae43d46e36451da2e66249667a5a3d02c5914835a85fac6dd98331
+  metadata.gz: 5ba5bacc8b35f00909f62e68dbb21c30bce706d6e19865803a84119c5fb3ea6ac459719e5b14827f370d428e9fc22eb0cb507824f864855857abc9303175e46a
+  data.tar.gz: 395e935d2056f773fbf8324caa0852e070245dd02d7b6d69b205b4a4835fedc3951484f724ea20f69f6ae98578d80535eedc950be44cf149b440249bd1d58ee8

data/CHANGELOG.md

@@ -1,3 +1,18 @@
+## v1.7.1 / 2026-07-15
+
+* SVG reference elements now restrict both `href` and `xlink:href` to local references.
+
+  Previously `PermitScrubber` restricted only `xlink:href` on elements in `SVG_ALLOW_LOCAL_HREF`,
+  so a plain `href` attribute on those elements could reference an external document. Applications
+  are only affected if the allowed tags are overridden to include an SVG reference element such as
+  `use`; the default configuration is not affected.
+
+  This change addresses GHSA-cj75-f6xr-r4g7 (CVE requested). The minimum Loofah dependency is now
+  `~> 2.25, >= 2.25.2`.
+
+  *Mike Dalessio*
+
+
 ## v1.7.0 / 2026-02-24
 
 * Add `Rails::HTML::Sanitizer.allowed_uri?` which delegates to `Loofah::HTML5::Scrub.allowed_uri?`,

data/lib/rails/html/sanitizer/version.rb

@@ -3,7 +3,7 @@
 module Rails
   module HTML
     class Sanitizer
-      VERSION = "1.7.0"
+      VERSION = "1.7.1"
     end
   end
 end

data/lib/rails/html/scrubbers.rb

@@ -172,7 +172,7 @@ module Rails
             Loofah::HTML5::Scrub.scrub_attribute_that_allows_local_ref(attr_node)
           end
 
-          if Loofah::HTML5::SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) && attr_name == "xlink:href" && attr_node.value =~ /^\s*[^#\s].*/m
+          if Loofah::HTML5::SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) && Loofah::HTML5::SafeList::SVG_HREF_ATTRIBUTES.include?(attr_name) && attr_node.value =~ /^\s*[^#\s].*/m
             attr_node.remove
           end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-html-sanitizer
 version: !ruby/object:Gem::Version
-  version: 1.7.0
+  version: 1.7.1
 platform: ruby
 authors:
 - Rafael Mendonça França
@@ -18,6 +18,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.25'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.25.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -25,6 +28,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.25'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.25.2
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -109,18 +115,14 @@ files:
 - lib/rails/html/sanitizer.rb
 - lib/rails/html/sanitizer/version.rb
 - lib/rails/html/scrubbers.rb
-- test/rails_api_test.rb
-- test/sanitizer_test.rb
-- test/scrubbers_test.rb
-- test/test_helper.rb
 homepage: https://github.com/rails/rails-html-sanitizer
 licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails-html-sanitizer/issues
-  changelog_uri: https://github.com/rails/rails-html-sanitizer/blob/v1.7.0/CHANGELOG.md
-  documentation_uri: https://www.rubydoc.info/gems/rails-html-sanitizer/1.7.0
-  source_code_uri: https://github.com/rails/rails-html-sanitizer/tree/v1.7.0
+  changelog_uri: https://github.com/rails/rails-html-sanitizer/blob/v1.7.1/CHANGELOG.md
+  documentation_uri: https://www.rubydoc.info/gems/rails-html-sanitizer/1.7.1
+  source_code_uri: https://github.com/rails/rails-html-sanitizer/tree/v1.7.1
 rdoc_options: []
 require_paths:
 - lib
@@ -135,11 +137,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.10
 specification_version: 4
 summary: This gem is responsible to sanitize HTML fragments in Rails applications.
-test_files:
-- test/rails_api_test.rb
-- test/sanitizer_test.rb
-- test/scrubbers_test.rb
-- test/test_helper.rb
+test_files: []

data/test/rails_api_test.rb

@@ -1,101 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "test_helper"
-
-class RailsApiTest < Minitest::Test
-  def test_html_module_name_alias
-    assert_equal(Rails::Html, Rails::HTML)
-    assert_equal("Rails::HTML", Rails::Html.name)
-    assert_equal("Rails::HTML", Rails::HTML.name)
-  end
-
-  def test_html_scrubber_class_names
-    assert(Rails::Html::PermitScrubber)
-    assert(Rails::Html::TargetScrubber)
-    assert(Rails::Html::TextOnlyScrubber)
-    assert(Rails::Html::Sanitizer)
-  end
-
-  def test_best_supported_vendor_when_html5_is_not_supported_returns_html4
-    Rails::HTML::Sanitizer.stub(:html5_support?, false) do
-      assert_equal(Rails::HTML4::Sanitizer, Rails::HTML::Sanitizer.best_supported_vendor)
-    end
-  end
-
-  def test_best_supported_vendor_when_html5_is_supported_returns_html5
-    skip("no HTML5 support on this platform") unless Rails::HTML::Sanitizer.html5_support?
-
-    Rails::HTML::Sanitizer.stub(:html5_support?, true) do
-      assert_equal(Rails::HTML5::Sanitizer, Rails::HTML::Sanitizer.best_supported_vendor)
-    end
-  end
-
-  def test_html4_sanitizer_alias_full
-    assert_equal(Rails::HTML4::FullSanitizer, Rails::HTML::FullSanitizer)
-    assert_equal("Rails::HTML4::FullSanitizer", Rails::HTML::FullSanitizer.name)
-  end
-
-  def test_html4_sanitizer_alias_link
-    assert_equal(Rails::HTML4::LinkSanitizer, Rails::HTML::LinkSanitizer)
-    assert_equal("Rails::HTML4::LinkSanitizer", Rails::HTML::LinkSanitizer.name)
-  end
-
-  def test_html4_sanitizer_alias_safe_list
-    assert_equal(Rails::HTML4::SafeListSanitizer, Rails::HTML::SafeListSanitizer)
-    assert_equal("Rails::HTML4::SafeListSanitizer", Rails::HTML::SafeListSanitizer.name)
-  end
-
-  def test_html4_full_sanitizer
-    assert_equal(Rails::HTML4::FullSanitizer, Rails::HTML::Sanitizer.full_sanitizer)
-    assert_equal(Rails::HTML4::FullSanitizer, Rails::HTML4::Sanitizer.full_sanitizer)
-  end
-
-  def test_html4_link_sanitizer
-    assert_equal(Rails::HTML4::LinkSanitizer, Rails::HTML::Sanitizer.link_sanitizer)
-    assert_equal(Rails::HTML4::LinkSanitizer, Rails::HTML4::Sanitizer.link_sanitizer)
-  end
-
-  def test_html4_safe_list_sanitizer
-    assert_equal(Rails::HTML4::SafeListSanitizer, Rails::HTML::Sanitizer.safe_list_sanitizer)
-    assert_equal(Rails::HTML4::SafeListSanitizer, Rails::HTML4::Sanitizer.safe_list_sanitizer)
-  end
-
-  def test_html4_white_list_sanitizer
-    assert_equal(Rails::HTML4::SafeListSanitizer, Rails::HTML::Sanitizer.white_list_sanitizer)
-    assert_equal(Rails::HTML4::SafeListSanitizer, Rails::HTML4::Sanitizer.white_list_sanitizer)
-  end
-
-  def test_html5_full_sanitizer
-    skip("no HTML5 support on this platform") unless Rails::HTML::Sanitizer.html5_support?
-    assert_equal(Rails::HTML5::FullSanitizer, Rails::HTML5::Sanitizer.full_sanitizer)
-  end
-
-  def test_html5_link_sanitizer
-    skip("no HTML5 support on this platform") unless Rails::HTML::Sanitizer.html5_support?
-    assert_equal(Rails::HTML5::LinkSanitizer, Rails::HTML5::Sanitizer.link_sanitizer)
-  end
-
-  def test_html5_safe_list_sanitizer
-    skip("no HTML5 support on this platform") unless Rails::HTML::Sanitizer.html5_support?
-    assert_equal(Rails::HTML5::SafeListSanitizer, Rails::HTML5::Sanitizer.safe_list_sanitizer)
-  end
-
-  def test_html5_white_list_sanitizer
-    skip("no HTML5 support on this platform") unless Rails::HTML::Sanitizer.html5_support?
-    assert_equal(Rails::HTML5::SafeListSanitizer, Rails::HTML5::Sanitizer.white_list_sanitizer)
-  end
-
-  def test_allowed_uri_returns_true_for_allowed_protocols
-    assert(Rails::HTML::Sanitizer.allowed_uri?("https://example.com"))
-    assert(Rails::HTML::Sanitizer.allowed_uri?("http://example.com"))
-    assert(Rails::HTML::Sanitizer.allowed_uri?("mailto:user@example.com"))
-  end
-
-  def test_allowed_uri_returns_false_for_disallowed_protocols
-    refute(Rails::HTML::Sanitizer.allowed_uri?("javascript:alert(1)"))
-  end
-
-  def test_allowed_uri_returns_true_for_relative_uris
-    assert(Rails::HTML::Sanitizer.allowed_uri?("/relative/path"))
-  end
-end