rails-html-sanitizer 1.7.1 → 1.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1e57ccc4baea7e97018e7794845e4f95ca0beee76bbdeff5f377dc1d8385a170
-  data.tar.gz: 4b66dc1f9e7f0bfbcb8707c4c208ed6f9f3af50b521015d65e638e90296db066
+  metadata.gz: c54afd99a374f11c67eb4b1c8ff543d30bd3ca66781a8fa2452719d781c6a07e
+  data.tar.gz: 324612d662c1dba47139fba7e1b976384bdc3a616b0d51bf6779d9b343fad2e0
 SHA512:
-  metadata.gz: 5ba5bacc8b35f00909f62e68dbb21c30bce706d6e19865803a84119c5fb3ea6ac459719e5b14827f370d428e9fc22eb0cb507824f864855857abc9303175e46a
-  data.tar.gz: 395e935d2056f773fbf8324caa0852e070245dd02d7b6d69b205b4a4835fedc3951484f724ea20f69f6ae98578d80535eedc950be44cf149b440249bd1d58ee8
+  metadata.gz: df37a5efc973fbe8d95f53dc98f08590bf8454f5d0f2d4e0d549aba63181ca0d83ef541b9a451f0c074ce487d7d4bc6eb6c517a4df6d675015caa55fe3468d42
+  data.tar.gz: b70b403bb0f4ca342387ca91d454b2efc94da30c2dcc653853a6f2070ca05cbf1c832853022e6fb91bafb672b753e45c1b44d9d84ab3f67af2a41235d55f5f0c

data/CHANGELOG.md

@@ -1,3 +1,42 @@
+## next / unreleased
+
+
+## v1.7.2 / 2026-11-02
+
+* Deciding whether an SVG `href` or `xlink:href` is a local reference no longer takes quadratic time.
+
+  `PermitScrubber` matched the attribute value against a pattern that rescanned the value's
+  whitespace run from every line start, so an all-whitespace value took seconds to scrub. Only
+  Ruby 3.1 and earlier are affected, because Ruby 3.2 introduced linear-time regexp matching.
+  Through `PermitScrubber`, applications are only affected if the allowed tags are overridden to
+  include an SVG reference element such as `use`; the default configuration is not affected.
+
+  This change addresses GHSA-cpgf-5mjf-73p7. `PermitScrubber` now applies the html5lib attribute
+  value rules by calling `Loofah::HTML5::Scrub.scrub_attribute_value` rather than carrying its own
+  copy. The minimum Loofah dependency is now `~> 2.25, >= 2.25.3`.
+
+  *Mike Dalessio*
+
+* rails-html-sanitizer now requires Ruby >= 3.2, because Loofah 2.25.3 requires it.
+
+  The `1.6.x` and `1.5.x` release branches no longer receive security updates. Every Rails release
+  in security support accepts rails-html-sanitizer 1.7 and requires Ruby >= 3.2.
+
+  *Mike Dalessio*
+
+* `SafeListSanitizer` no longer shares a `PermitScrubber` across calls.
+
+  Previously one sanitizer instance reused a single `PermitScrubber`, assigning its `tags` and
+  `attributes` on every call. Action View memoizes one sanitizer per helper module, so two
+  concurrent `sanitize` calls with different `tags:` or `attributes:` options could interleave and
+  one call could be scrubbed with the other call's allowlist. Each call now builds its own
+  `PermitScrubber`.
+
+  This change addresses GHSA-h7wh-q2qr-458c.
+
+  *Mike Dalessio*
+
+
 ## v1.7.1 / 2026-07-15
 
 * SVG reference elements now restrict both `href` and `xlink:href` to local references.

data/README.md

@@ -234,8 +234,9 @@ Or install it yourself as:
 
 | branch | ruby support | actively maintained | security support                       |
 |--------|--------------|---------------------|----------------------------------------|
-| 1.6.x  | >= 2.7       | yes                 | yes                                    |
-| 1.5.x  | >= 2.5       | no                  | while Rails 6.1 is in security support |
+| 1.7.x  | >= 3.2       | yes                 | yes                                    |
+| 1.6.x  | >= 2.7       | no                  | no                                     |
+| 1.5.x  | >= 2.5       | no                  | no                                     |
 | 1.4.x  | >= 1.8.7     | no                  | no                                     |
 
 

data/lib/rails/html/sanitizer/version.rb

@@ -3,7 +3,7 @@
 module Rails
   module HTML
     class Sanitizer
-      VERSION = "1.7.1"
+      VERSION = "1.7.2"
     end
   end
 end

data/lib/rails/html/sanitizer.rb

@@ -154,7 +154,7 @@ module Rails
           end
 
           def initialize(prune: false)
-            @permit_scrubber = PermitScrubber.new(prune: prune)
+            @prune = prune
           end
 
           def scrub(fragment, options = {})
@@ -162,9 +162,10 @@ module Rails
               # No duck typing, Loofah ensures subclass of Loofah::Scrubber
               fragment.scrub!(scrubber)
             elsif allowed_tags(options) || allowed_attributes(options)
-              @permit_scrubber.tags = allowed_tags(options)
-              @permit_scrubber.attributes = allowed_attributes(options)
-              fragment.scrub!(@permit_scrubber)
+              permit_scrubber = PermitScrubber.new(prune: @prune)
+              permit_scrubber.tags = allowed_tags(options)
+              permit_scrubber.attributes = allowed_attributes(options)
+              fragment.scrub!(permit_scrubber)
             else
               fragment.scrub!(:strip)
             end

data/lib/rails/html/scrubbers.rb

@@ -160,21 +160,9 @@ module Rails
         end
 
         def scrub_attribute(node, attr_node)
-          attr_name = if attr_node.namespace
-            "#{attr_node.namespace.prefix}:#{attr_node.node_name}"
-          else
-            attr_node.node_name
-          end
-
-          return if Loofah::HTML5::SafeList::ATTR_VAL_IS_URI.include?(attr_name) && Loofah::HTML5::Scrub.scrub_uri_attribute(attr_node)
+          attr_name = Loofah::HTML5::Scrub.prefixed_attribute_name(attr_node)
 
-          if Loofah::HTML5::SafeList::SVG_ATTR_VAL_ALLOWS_REF.include?(attr_name)
-            Loofah::HTML5::Scrub.scrub_attribute_that_allows_local_ref(attr_node)
-          end
-
-          if Loofah::HTML5::SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) && Loofah::HTML5::SafeList::SVG_HREF_ATTRIBUTES.include?(attr_name) && attr_node.value =~ /^\s*[^#\s].*/m
-            attr_node.remove
-          end
+          return if Loofah::HTML5::Scrub.scrub_attribute_value(node, attr_node, attr_name)
 
           node.remove_attribute(attr_node.name) if attr_name == "src" && attr_node.value !~ /[^[:space:]]/
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-html-sanitizer
 version: !ruby/object:Gem::Version
-  version: 1.7.1
+  version: 1.7.2
 platform: ruby
 authors:
 - Rafael Mendonça França
@@ -20,7 +20,7 @@ dependencies:
         version: '2.25'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.25.2
+        version: 2.25.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -30,7 +30,7 @@ dependencies:
         version: '2.25'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.25.2
+        version: 2.25.3
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -120,9 +120,9 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails-html-sanitizer/issues
-  changelog_uri: https://github.com/rails/rails-html-sanitizer/blob/v1.7.1/CHANGELOG.md
-  documentation_uri: https://www.rubydoc.info/gems/rails-html-sanitizer/1.7.1
-  source_code_uri: https://github.com/rails/rails-html-sanitizer/tree/v1.7.1
+  changelog_uri: https://github.com/rails/rails-html-sanitizer/blob/v1.7.2/CHANGELOG.md
+  documentation_uri: https://www.rubydoc.info/gems/rails-html-sanitizer/1.7.2
+  source_code_uri: https://github.com/rails/rails-html-sanitizer/tree/v1.7.2
 rdoc_options: []
 require_paths:
 - lib
@@ -130,14 +130,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.20
 specification_version: 4
 summary: This gem is responsible to sanitize HTML fragments in Rails applications.
 test_files: []