rails-html-sanitizer 1.4.1 → 1.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 38acab5c0aaf09ef2f52189de3445647192a0625e7bf530f8e08edb60ce7f17b
-  data.tar.gz: ba0f051dbdf277df8f135dce164d90cbc2acee95b9965986bdc00742ea0a0553
+  metadata.gz: 85be608ca4422813683df971eb55217f0a70d9bb3d6398efad913ddb90d2c3c5
+  data.tar.gz: cdc86ec92f2698f49d73d37e58622b97f4115330e084a2bc6ea46fc711926e94
 SHA512:
-  metadata.gz: 3c73a294fed5e28ab21b9fbade61fc722c2876c79215f4c84fa618d99c356e532584746d7178c1a2cc08354699eb986a741a2011b0c268cf8b3cc1bfa6a56994
-  data.tar.gz: 561a2601cd732428f89a662e53076bc557e591892f952b46770f10b014cbbd5cf1192a5a70de5f44f296be3a9f4820c6a5412c36464f939b4ca51a70fdf33c69
+  metadata.gz: b748cab99a7c9bdda776b5aaf76a55e16ff59b6aa10f4ee1fd9b97b7f5a6a897a8a2e0e1fe31cdd741207130d34ccdff2debb4437b0b03b87896ab9c16537f4b
+  data.tar.gz: 35f4c0c12c555feb73623df3bc09d19069c48b9ee91539dc247b6a599dc091adb08b56f43041014dfacd6f46183f7b6d68355104716a1feeaef58c3319be6bea

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 1.4.2 / 2021-08-23
+
+* Slightly improve performance.
+
+  Assuming elements are more common than comments, make one less method call per node.
+
+  *Mike Dalessio*
+
 ## 1.4.1 / 2021-08-18
 
 * Fix regression in v1.4.0 that did not pass comment nodes to the scrubber.

data/lib/rails/html/sanitizer/version.rb

@@ -1,7 +1,7 @@
 module Rails
   module Html
     class Sanitizer
-      VERSION = "1.4.1"
+      VERSION = "1.4.2"
     end
   end
 end

data/lib/rails/html/scrubbers.rb

@@ -68,7 +68,7 @@ module Rails
         end
         return CONTINUE if skip_node?(node)
 
-        unless (node.comment? || node.element?) && keep_node?(node)
+        unless (node.element? || node.comment?) && keep_node?(node)
           return STOP if scrub_node(node) == STOP
         end
 

data/test/scrubbers_test.rb

@@ -41,6 +41,16 @@ class PermitScrubberTest < ScrubberTest
     assert_scrubbed '<tag>hello</tag>', 'hello'
   end
 
+  def test_default_scrub_removes_comments
+    assert_scrubbed('<div>one</div><!-- two --><span>three</span>',
+                    '<div>one</div><span>three</span>')
+  end
+
+  def test_default_scrub_removes_processing_instructions
+    assert_scrubbed('<div>one</div><?div two><span>three</span>',
+                    '<div>one</div><span>three</span>')
+  end
+
   def test_default_attributes_removal_behavior
     assert_scrubbed '<p cooler="hello">hello</p>', '<p>hello</p>'
   end
@@ -56,6 +66,12 @@ class PermitScrubberTest < ScrubberTest
     assert_scrubbed html, '<tag>leave me now</tag>'
   end
 
+  def test_leaves_comments_when_supplied_as_tag
+    @scrubber.tags = %w(div comment)
+    assert_scrubbed('<div>one</div><!-- two --><span>three</span>',
+                    '<div>one</div><!-- two -->three')
+  end
+
   def test_leaves_only_supplied_tags_nested
     html = '<tag>leave <em>me <span>now</span></em></tag>'
     @scrubber.tags = %w(tag)
@@ -112,50 +128,6 @@ class PermitScrubberTest < ScrubberTest
   end
 end
 
-class PermitScrubberSubclassTest < ScrubberTest
-  def setup
-    @scrubber = Class.new(::Rails::Html::PermitScrubber) do
-      attr :nodes_seen
-
-      def initialize
-        super()
-        @nodes_seen = []
-      end
-
-      def keep_node?(node)
-        @nodes_seen << node.name
-        super(node)
-      end
-    end.new
-  end
-
-  def test_elements_are_checked
-    html = %Q("<div></div><a></a><tr></tr>")
-    Loofah.scrub_fragment(html, @scrubber)
-    assert_includes(@scrubber.nodes_seen, "div")
-    assert_includes(@scrubber.nodes_seen, "a")
-    assert_includes(@scrubber.nodes_seen, "tr")
-  end
-
-  def test_comments_are_checked
-    # this passes in v1.3.0 but fails in v1.4.0
-    html = %Q("<div></div><!-- ohai --><tr></tr>")
-    Loofah.scrub_fragment(html, @scrubber)
-    assert_includes(@scrubber.nodes_seen, "div")
-    assert_includes(@scrubber.nodes_seen, "comment")
-    assert_includes(@scrubber.nodes_seen, "tr")
-  end
-
-  def test_craftily_named_processing_instructions_are_not_checked
-    # this fails in v1.3.0 but passes in v1.4.0
-    html = %Q("<div></div><?a content><tr></tr>")
-    Loofah.scrub_fragment(html, @scrubber)
-    assert_includes(@scrubber.nodes_seen, "div")
-    refute_includes(@scrubber.nodes_seen, "a")
-    assert_includes(@scrubber.nodes_seen, "tr")
-  end
-end
-
 class TargetScrubberTest < ScrubberTest
   def setup
     @scrubber = Rails::Html::TargetScrubber.new

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-html-sanitizer
 version: !ruby/object:Gem::Version
-  version: 1.4.1
+  version: 1.4.2
 platform: ruby
 authors:
 - Rafael Mendonça França
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-08-18 00:00:00.000000000 Z
+date: 2021-08-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: loofah
@@ -103,9 +103,9 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails-html-sanitizer/issues
-  changelog_uri: https://github.com/rails/rails-html-sanitizer/blob/v1.4.1/CHANGELOG.md
-  documentation_uri: https://www.rubydoc.info/gems/rails-html-sanitizer/1.4.1
-  source_code_uri: https://github.com/rails/rails-html-sanitizer/tree/v1.4.1
+  changelog_uri: https://github.com/rails/rails-html-sanitizer/blob/v1.4.2/CHANGELOG.md
+  documentation_uri: https://www.rubydoc.info/gems/rails-html-sanitizer/1.4.2
+  source_code_uri: https://github.com/rails/rails-html-sanitizer/tree/v1.4.2
 post_install_message: 
 rdoc_options: []
 require_paths: