rails-html-sanitizer 1.7.0 → 1.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1e73c95bdfd00d65afcc40a3ef436fe4bab7b7571e62b789a877ea2b201a2740
-  data.tar.gz: 9ac916682a1d0b3b6f45059f5509a1f7785349e0c08102fac6cb1539bff0db3f
+  metadata.gz: c54afd99a374f11c67eb4b1c8ff543d30bd3ca66781a8fa2452719d781c6a07e
+  data.tar.gz: 324612d662c1dba47139fba7e1b976384bdc3a616b0d51bf6779d9b343fad2e0
 SHA512:
-  metadata.gz: d70c999e3775bb58adcc8b6b785c49b7f79ea14990042c2a96105cd36b09c8126f25a317e8f9ab920b0aeaaf107e61870443e0afff78ea291ad163e659b043e6
-  data.tar.gz: 440f779d178582a39723cc22191e7397becdbc2c2fbd36d3af7eac52f66ce722a9f9000f4cae43d46e36451da2e66249667a5a3d02c5914835a85fac6dd98331
+  metadata.gz: df37a5efc973fbe8d95f53dc98f08590bf8454f5d0f2d4e0d549aba63181ca0d83ef541b9a451f0c074ce487d7d4bc6eb6c517a4df6d675015caa55fe3468d42
+  data.tar.gz: b70b403bb0f4ca342387ca91d454b2efc94da30c2dcc653853a6f2070ca05cbf1c832853022e6fb91bafb672b753e45c1b44d9d84ab3f67af2a41235d55f5f0c

data/CHANGELOG.md

@@ -1,3 +1,57 @@
+## next / unreleased
+
+
+## v1.7.2 / 2026-11-02
+
+* Deciding whether an SVG `href` or `xlink:href` is a local reference no longer takes quadratic time.
+
+  `PermitScrubber` matched the attribute value against a pattern that rescanned the value's
+  whitespace run from every line start, so an all-whitespace value took seconds to scrub. Only
+  Ruby 3.1 and earlier are affected, because Ruby 3.2 introduced linear-time regexp matching.
+  Through `PermitScrubber`, applications are only affected if the allowed tags are overridden to
+  include an SVG reference element such as `use`; the default configuration is not affected.
+
+  This change addresses GHSA-cpgf-5mjf-73p7. `PermitScrubber` now applies the html5lib attribute
+  value rules by calling `Loofah::HTML5::Scrub.scrub_attribute_value` rather than carrying its own
+  copy. The minimum Loofah dependency is now `~> 2.25, >= 2.25.3`.
+
+  *Mike Dalessio*
+
+* rails-html-sanitizer now requires Ruby >= 3.2, because Loofah 2.25.3 requires it.
+
+  The `1.6.x` and `1.5.x` release branches no longer receive security updates. Every Rails release
+  in security support accepts rails-html-sanitizer 1.7 and requires Ruby >= 3.2.
+
+  *Mike Dalessio*
+
+* `SafeListSanitizer` no longer shares a `PermitScrubber` across calls.
+
+  Previously one sanitizer instance reused a single `PermitScrubber`, assigning its `tags` and
+  `attributes` on every call. Action View memoizes one sanitizer per helper module, so two
+  concurrent `sanitize` calls with different `tags:` or `attributes:` options could interleave and
+  one call could be scrubbed with the other call's allowlist. Each call now builds its own
+  `PermitScrubber`.
+
+  This change addresses GHSA-h7wh-q2qr-458c.
+
+  *Mike Dalessio*
+
+
+## v1.7.1 / 2026-07-15
+
+* SVG reference elements now restrict both `href` and `xlink:href` to local references.
+
+  Previously `PermitScrubber` restricted only `xlink:href` on elements in `SVG_ALLOW_LOCAL_HREF`,
+  so a plain `href` attribute on those elements could reference an external document. Applications
+  are only affected if the allowed tags are overridden to include an SVG reference element such as
+  `use`; the default configuration is not affected.
+
+  This change addresses GHSA-cj75-f6xr-r4g7 (CVE requested). The minimum Loofah dependency is now
+  `~> 2.25, >= 2.25.2`.
+
+  *Mike Dalessio*
+
+
 ## v1.7.0 / 2026-02-24
 
 * Add `Rails::HTML::Sanitizer.allowed_uri?` which delegates to `Loofah::HTML5::Scrub.allowed_uri?`,

data/README.md

@@ -234,8 +234,9 @@ Or install it yourself as:
 
 | branch | ruby support | actively maintained | security support                       |
 |--------|--------------|---------------------|----------------------------------------|
-| 1.6.x  | >= 2.7       | yes                 | yes                                    |
-| 1.5.x  | >= 2.5       | no                  | while Rails 6.1 is in security support |
+| 1.7.x  | >= 3.2       | yes                 | yes                                    |
+| 1.6.x  | >= 2.7       | no                  | no                                     |
+| 1.5.x  | >= 2.5       | no                  | no                                     |
 | 1.4.x  | >= 1.8.7     | no                  | no                                     |
 
 

data/lib/rails/html/sanitizer/version.rb

@@ -3,7 +3,7 @@
 module Rails
   module HTML
     class Sanitizer
-      VERSION = "1.7.0"
+      VERSION = "1.7.2"
     end
   end
 end

data/lib/rails/html/sanitizer.rb

@@ -154,7 +154,7 @@ module Rails
           end
 
           def initialize(prune: false)
-            @permit_scrubber = PermitScrubber.new(prune: prune)
+            @prune = prune
           end
 
           def scrub(fragment, options = {})
@@ -162,9 +162,10 @@ module Rails
               # No duck typing, Loofah ensures subclass of Loofah::Scrubber
               fragment.scrub!(scrubber)
             elsif allowed_tags(options) || allowed_attributes(options)
-              @permit_scrubber.tags = allowed_tags(options)
-              @permit_scrubber.attributes = allowed_attributes(options)
-              fragment.scrub!(@permit_scrubber)
+              permit_scrubber = PermitScrubber.new(prune: @prune)
+              permit_scrubber.tags = allowed_tags(options)
+              permit_scrubber.attributes = allowed_attributes(options)
+              fragment.scrub!(permit_scrubber)
             else
               fragment.scrub!(:strip)
             end

data/lib/rails/html/scrubbers.rb

@@ -160,21 +160,9 @@ module Rails
         end
 
         def scrub_attribute(node, attr_node)
-          attr_name = if attr_node.namespace
-            "#{attr_node.namespace.prefix}:#{attr_node.node_name}"
-          else
-            attr_node.node_name
-          end
-
-          return if Loofah::HTML5::SafeList::ATTR_VAL_IS_URI.include?(attr_name) && Loofah::HTML5::Scrub.scrub_uri_attribute(attr_node)
+          attr_name = Loofah::HTML5::Scrub.prefixed_attribute_name(attr_node)
 
-          if Loofah::HTML5::SafeList::SVG_ATTR_VAL_ALLOWS_REF.include?(attr_name)
-            Loofah::HTML5::Scrub.scrub_attribute_that_allows_local_ref(attr_node)
-          end
-
-          if Loofah::HTML5::SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) && attr_name == "xlink:href" && attr_node.value =~ /^\s*[^#\s].*/m
-            attr_node.remove
-          end
+          return if Loofah::HTML5::Scrub.scrub_attribute_value(node, attr_node, attr_name)
 
           node.remove_attribute(attr_node.name) if attr_name == "src" && attr_node.value !~ /[^[:space:]]/
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-html-sanitizer
 version: !ruby/object:Gem::Version
-  version: 1.7.0
+  version: 1.7.2
 platform: ruby
 authors:
 - Rafael Mendonça França
@@ -18,6 +18,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.25'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.25.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -25,6 +28,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.25'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.25.3
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -109,18 +115,14 @@ files:
 - lib/rails/html/sanitizer.rb
 - lib/rails/html/sanitizer/version.rb
 - lib/rails/html/scrubbers.rb
-- test/rails_api_test.rb
-- test/sanitizer_test.rb
-- test/scrubbers_test.rb
-- test/test_helper.rb
 homepage: https://github.com/rails/rails-html-sanitizer
 licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails-html-sanitizer/issues
-  changelog_uri: https://github.com/rails/rails-html-sanitizer/blob/v1.7.0/CHANGELOG.md
-  documentation_uri: https://www.rubydoc.info/gems/rails-html-sanitizer/1.7.0
-  source_code_uri: https://github.com/rails/rails-html-sanitizer/tree/v1.7.0
+  changelog_uri: https://github.com/rails/rails-html-sanitizer/blob/v1.7.2/CHANGELOG.md
+  documentation_uri: https://www.rubydoc.info/gems/rails-html-sanitizer/1.7.2
+  source_code_uri: https://github.com/rails/rails-html-sanitizer/tree/v1.7.2
 rdoc_options: []
 require_paths:
 - lib
@@ -128,18 +130,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.20
 specification_version: 4
 summary: This gem is responsible to sanitize HTML fragments in Rails applications.
-test_files:
-- test/rails_api_test.rb
-- test/sanitizer_test.rb
-- test/scrubbers_test.rb
-- test/test_helper.rb
+test_files: []

data/test/rails_api_test.rb

@@ -1,101 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "test_helper"
-
-class RailsApiTest < Minitest::Test
-  def test_html_module_name_alias
-    assert_equal(Rails::Html, Rails::HTML)
-    assert_equal("Rails::HTML", Rails::Html.name)
-    assert_equal("Rails::HTML", Rails::HTML.name)
-  end
-
-  def test_html_scrubber_class_names
-    assert(Rails::Html::PermitScrubber)
-    assert(Rails::Html::TargetScrubber)
-    assert(Rails::Html::TextOnlyScrubber)
-    assert(Rails::Html::Sanitizer)
-  end
-
-  def test_best_supported_vendor_when_html5_is_not_supported_returns_html4
-    Rails::HTML::Sanitizer.stub(:html5_support?, false) do
-      assert_equal(Rails::HTML4::Sanitizer, Rails::HTML::Sanitizer.best_supported_vendor)
-    end
-  end
-
-  def test_best_supported_vendor_when_html5_is_supported_returns_html5
-    skip("no HTML5 support on this platform") unless Rails::HTML::Sanitizer.html5_support?
-
-    Rails::HTML::Sanitizer.stub(:html5_support?, true) do
-      assert_equal(Rails::HTML5::Sanitizer, Rails::HTML::Sanitizer.best_supported_vendor)
-    end
-  end
-
-  def test_html4_sanitizer_alias_full
-    assert_equal(Rails::HTML4::FullSanitizer, Rails::HTML::FullSanitizer)
-    assert_equal("Rails::HTML4::FullSanitizer", Rails::HTML::FullSanitizer.name)
-  end
-
-  def test_html4_sanitizer_alias_link
-    assert_equal(Rails::HTML4::LinkSanitizer, Rails::HTML::LinkSanitizer)
-    assert_equal("Rails::HTML4::LinkSanitizer", Rails::HTML::LinkSanitizer.name)
-  end
-
-  def test_html4_sanitizer_alias_safe_list
-    assert_equal(Rails::HTML4::SafeListSanitizer, Rails::HTML::SafeListSanitizer)
-    assert_equal("Rails::HTML4::SafeListSanitizer", Rails::HTML::SafeListSanitizer.name)
-  end
-
-  def test_html4_full_sanitizer
-    assert_equal(Rails::HTML4::FullSanitizer, Rails::HTML::Sanitizer.full_sanitizer)
-    assert_equal(Rails::HTML4::FullSanitizer, Rails::HTML4::Sanitizer.full_sanitizer)
-  end
-
-  def test_html4_link_sanitizer
-    assert_equal(Rails::HTML4::LinkSanitizer, Rails::HTML::Sanitizer.link_sanitizer)
-    assert_equal(Rails::HTML4::LinkSanitizer, Rails::HTML4::Sanitizer.link_sanitizer)
-  end
-
-  def test_html4_safe_list_sanitizer
-    assert_equal(Rails::HTML4::SafeListSanitizer, Rails::HTML::Sanitizer.safe_list_sanitizer)
-    assert_equal(Rails::HTML4::SafeListSanitizer, Rails::HTML4::Sanitizer.safe_list_sanitizer)
-  end
-
-  def test_html4_white_list_sanitizer
-    assert_equal(Rails::HTML4::SafeListSanitizer, Rails::HTML::Sanitizer.white_list_sanitizer)
-    assert_equal(Rails::HTML4::SafeListSanitizer, Rails::HTML4::Sanitizer.white_list_sanitizer)
-  end
-
-  def test_html5_full_sanitizer
-    skip("no HTML5 support on this platform") unless Rails::HTML::Sanitizer.html5_support?
-    assert_equal(Rails::HTML5::FullSanitizer, Rails::HTML5::Sanitizer.full_sanitizer)
-  end
-
-  def test_html5_link_sanitizer
-    skip("no HTML5 support on this platform") unless Rails::HTML::Sanitizer.html5_support?
-    assert_equal(Rails::HTML5::LinkSanitizer, Rails::HTML5::Sanitizer.link_sanitizer)
-  end
-
-  def test_html5_safe_list_sanitizer
-    skip("no HTML5 support on this platform") unless Rails::HTML::Sanitizer.html5_support?
-    assert_equal(Rails::HTML5::SafeListSanitizer, Rails::HTML5::Sanitizer.safe_list_sanitizer)
-  end
-
-  def test_html5_white_list_sanitizer
-    skip("no HTML5 support on this platform") unless Rails::HTML::Sanitizer.html5_support?
-    assert_equal(Rails::HTML5::SafeListSanitizer, Rails::HTML5::Sanitizer.white_list_sanitizer)
-  end
-
-  def test_allowed_uri_returns_true_for_allowed_protocols
-    assert(Rails::HTML::Sanitizer.allowed_uri?("https://example.com"))
-    assert(Rails::HTML::Sanitizer.allowed_uri?("http://example.com"))
-    assert(Rails::HTML::Sanitizer.allowed_uri?("mailto:user@example.com"))
-  end
-
-  def test_allowed_uri_returns_false_for_disallowed_protocols
-    refute(Rails::HTML::Sanitizer.allowed_uri?("javascript:alert(1)"))
-  end
-
-  def test_allowed_uri_returns_true_for_relative_uris
-    assert(Rails::HTML::Sanitizer.allowed_uri?("/relative/path"))
-  end
-end