rails-html-sanitizer 1.6.2 → 1.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d5507b24d4d93d6efebf2e327d04980dd114cd491732b5c71a7e1a3294c846a9
-  data.tar.gz: dd7a5070b04bf6a97b96df01d65fce9d52790e62dc6631b31fb72ecc2a6d16ed
+  metadata.gz: 1e73c95bdfd00d65afcc40a3ef436fe4bab7b7571e62b789a877ea2b201a2740
+  data.tar.gz: 9ac916682a1d0b3b6f45059f5509a1f7785349e0c08102fac6cb1539bff0db3f
 SHA512:
-  metadata.gz: 912e9d41629bd93de8a14352757add81fde36e394e7907923a88dbebc39da85722fc13a01fa23973421a11e715b41fb78cec3f0379ccf5a97ab0f0ee3ed3dc5a
-  data.tar.gz: e03d92f6289ef71e4039a64b89bce79c5d5a9d628632c84b2b54235fbe69384578de92f7b2db114c13d041c4d589672dd09e23758a043e675eb37f961a858f67
+  metadata.gz: d70c999e3775bb58adcc8b6b785c49b7f79ea14990042c2a96105cd36b09c8126f25a317e8f9ab920b0aeaaf107e61870443e0afff78ea291ad163e659b043e6
+  data.tar.gz: 440f779d178582a39723cc22191e7397becdbc2c2fbd36d3af7eac52f66ce722a9f9000f4cae43d46e36451da2e66249667a5a3d02c5914835a85fac6dd98331

data/CHANGELOG.md

@@ -1,3 +1,13 @@
+## v1.7.0 / 2026-02-24
+
+* Add `Rails::HTML::Sanitizer.allowed_uri?` which delegates to `Loofah::HTML5::Scrub.allowed_uri?`,
+  allowing the Rails framework to check URI safety without a direct dependency on Loofah.
+
+  The minimum Loofah dependency is now `~> 2.25`.
+
+  *Mike Dalessio*
+
+
 ## v1.6.2 / 2024-12-12
 
 * `PermitScrubber` fully supports frozen "allowed tags".

data/lib/rails/html/sanitizer/version.rb

@@ -3,7 +3,7 @@
 module Rails
   module HTML
     class Sanitizer
-      VERSION = "1.6.2"
+      VERSION = "1.7.0"
     end
   end
 end

data/lib/rails/html/sanitizer.rb

@@ -13,6 +13,10 @@ module Rails
         def best_supported_vendor
           html5_support? ? Rails::HTML5::Sanitizer : Rails::HTML4::Sanitizer
         end
+
+        def allowed_uri?(uri_string)
+          Loofah::HTML5::Scrub.allowed_uri?(uri_string)
+        end
       end
 
       def sanitize(html, options = {})

data/test/rails_api_test.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
-require "minitest/autorun"
-require "rails-html-sanitizer"
+require_relative "test_helper"
 
 class RailsApiTest < Minitest::Test
   def test_html_module_name_alias
@@ -85,4 +84,18 @@ class RailsApiTest < Minitest::Test
     skip("no HTML5 support on this platform") unless Rails::HTML::Sanitizer.html5_support?
     assert_equal(Rails::HTML5::SafeListSanitizer, Rails::HTML5::Sanitizer.white_list_sanitizer)
   end
+
+  def test_allowed_uri_returns_true_for_allowed_protocols
+    assert(Rails::HTML::Sanitizer.allowed_uri?("https://example.com"))
+    assert(Rails::HTML::Sanitizer.allowed_uri?("http://example.com"))
+    assert(Rails::HTML::Sanitizer.allowed_uri?("mailto:user@example.com"))
+  end
+
+  def test_allowed_uri_returns_false_for_disallowed_protocols
+    refute(Rails::HTML::Sanitizer.allowed_uri?("javascript:alert(1)"))
+  end
+
+  def test_allowed_uri_returns_true_for_relative_uris
+    assert(Rails::HTML::Sanitizer.allowed_uri?("/relative/path"))
+  end
 end

data/test/sanitizer_test.rb

@@ -1,10 +1,6 @@
 # frozen_string_literal: true
 
-require "minitest/autorun"
-require "rails-html-sanitizer"
-
-puts "nokogiri version info: #{Nokogiri::VERSION_INFO}"
-puts "html5 support: #{Rails::HTML::Sanitizer.html5_support?}"
+require_relative "test_helper"
 
 #
 #  NOTE that many of these tests contain multiple acceptable results.

data/test/scrubbers_test.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
-require "minitest/autorun"
-require "rails-html-sanitizer"
+require_relative "test_helper"
 
 class ScrubberTest < Minitest::Test
   protected

data/test/test_helper.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+require "minitest/autorun"
+require "rails-html-sanitizer"
+
+puts "nokogiri version info: #{Nokogiri::VERSION_INFO}"
+puts "html5 support: #{Rails::HTML::Sanitizer.html5_support?}"

metadata

@@ -1,16 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: rails-html-sanitizer
 version: !ruby/object:Gem::Version
-  version: 1.6.2
+  version: 1.7.0
 platform: ruby
 authors:
 - Rafael Mendonça França
 - Kasper Timm Hansen
 - Mike Dalessio
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-12-12 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: loofah
@@ -18,14 +17,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.21'
+        version: '2.25'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.21'
+        version: '2.25'
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -113,15 +112,15 @@ files:
 - test/rails_api_test.rb
 - test/sanitizer_test.rb
 - test/scrubbers_test.rb
+- test/test_helper.rb
 homepage: https://github.com/rails/rails-html-sanitizer
 licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails-html-sanitizer/issues
-  changelog_uri: https://github.com/rails/rails-html-sanitizer/blob/v1.6.2/CHANGELOG.md
-  documentation_uri: https://www.rubydoc.info/gems/rails-html-sanitizer/1.6.2
-  source_code_uri: https://github.com/rails/rails-html-sanitizer/tree/v1.6.2
-post_install_message:
+  changelog_uri: https://github.com/rails/rails-html-sanitizer/blob/v1.7.0/CHANGELOG.md
+  documentation_uri: https://www.rubydoc.info/gems/rails-html-sanitizer/1.7.0
+  source_code_uri: https://github.com/rails/rails-html-sanitizer/tree/v1.7.0
 rdoc_options: []
 require_paths:
 - lib
@@ -136,11 +135,11 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.22
-signing_key:
+rubygems_version: 4.0.3
 specification_version: 4
 summary: This gem is responsible to sanitize HTML fragments in Rails applications.
 test_files:
 - test/rails_api_test.rb
 - test/sanitizer_test.rb
 - test/scrubbers_test.rb
+- test/test_helper.rb