relaton-render 1.2.0 → 1.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bfa59dd1186cb178a96316ffff00066b9c048a326f47dda9381424f4d805e79c
-  data.tar.gz: b6f23cf5a7190c5cbac9b57350cf3a3812da2fbf94cf45218d02c7f4a8bc026c
+  metadata.gz: ece7911d68f25665c109d3a9420e30aab669c880655c5bb15b4146c8acee4f43
+  data.tar.gz: 1ba627049f678c0b817da7a93af4420b74e34579965a65eeaeb0f80126abed02
 SHA512:
-  metadata.gz: 8a857436fbd6e62d3d0471efe0a8c0b4b2a77684a9346558d1912d51fdd84d353a8c40aa7a141f5bfd03da162dd97e0a6c5817e86dffaa3c139e2df0b7d638c8
-  data.tar.gz: 8701d33d12f8cad24ccb245c0804c4e3e886aa833a6a8da8d86866acd2b7db540c12221a47ec9ae234617744c8cc26bec40c1c2192900ec89ce1af002135d697
+  metadata.gz: 92ad5ab36726f3b857ff9d792cce3ae2ba3ba0b8adba21308b0596da88822f16e4131b92c7047b31105036c534c552815d12e10b3e0773cbf04634769713c8f5
+  data.tar.gz: 790abb7747575c3b990fdb6a4ed579c3fc2269d35b1e05f0d3ab6c0869686784b4b91dfd8c0f9d7a006516c681e1821604f6351e91918fd210df78c9f106e760

data/lib/relaton/render/parse/parse.rb

@@ -82,6 +82,13 @@ module Relaton
         end
       end
 
+      ALLOWED_INLINE_TAGS = %w[
+        em eref strong stem sub sup tt underline keyword ruby
+        strike smallcap xref br link hr pagebreak bookmark
+        image index index-xref concept add del span erefstack
+        date fn
+      ].freeze
+
       private
 
       def blank?(text)
@@ -93,6 +100,46 @@ module Relaton
         "<esc>#{text}</esc>"
       end
 
+      # Strip any tag not in ALLOWED_INLINE_TAGS, in both literal (<tag>) and
+      # entity-encoded (&lt;tag&gt;) forms. Used to defend Liquid template
+      # output against embedded structural markup (most commonly <title>) in
+      # bibliographic text fields, where relaton-bib may surface either form
+      # depending on lutaml-model serialisation behaviour.
+      #
+      # Authors embed inline markup either literally (<em>foo</em>) or
+      # entity-encoded (&lt;em&gt;foo&lt;/em&gt;); both are intended as
+      # markup, and downstream template rendering decodes entities anyway
+      # (see HTMLEntities.decode in template.rb), so we normalise the
+      # encoded form to literal up front and let a single Nokogiri-fragment
+      # walk handle both. Elements whose name is in the allow-list are
+      # preserved verbatim with their entire subtree, so wrappers that
+      # legitimately carry block content (notably <fn><p>…</p></fn>)
+      # round-trip intact rather than being shredded one tag at a time.
+      # Disallowed elements are unwrapped (tag dropped, children kept),
+      # recursing first so allowed wrappers nested inside disallowed
+      # wrappers still survive. Nokogiri re-escapes any genuine `<` left in
+      # text positions on serialisation, so plain prose like "5 < 10" is
+      # preserved correctly.
+      def sanitise_inline_markup(str)
+        blank?(str) and return str
+        normalised = str.gsub("&lt;", "<").gsub("&gt;", ">")
+        frag = Nokogiri::XML.fragment(normalised)
+        unwrap_disallowed(frag)
+        save_opts = Nokogiri::XML::Node::SaveOptions::AS_XML |
+                    Nokogiri::XML::Node::SaveOptions::NO_DECLARATION
+        frag.to_xml(encoding: "UTF-8", save_with: save_opts)
+      end
+
+      def unwrap_disallowed(node)
+        node.children.to_a.each do |child|
+          next unless child.element?
+          next if ALLOWED_INLINE_TAGS.include?(child.name)
+
+          unwrap_disallowed(child)
+          child.replace(child.children)
+        end
+      end
+
       def wrap_in_esc(obj)
         case obj
         when String then esc(obj)

data/lib/relaton/render/parse/parse_contributors.rb

@@ -4,15 +4,12 @@ module Relaton
       def content(node)
         node.nil? and return node
         node.is_a?(String) and
-          return node.strip.gsub("</title>", "").gsub("<title>", "")
+          return sanitise_inline_markup(node.strip)
             .gsub(/>\n\s*</, "><").gsub(/\n\s*/, " ")
         node.content.is_a?(Array) and return node.content.map { |x| content(x) }
-        ret = node.content.strip
-          .gsub("</title>", "").gsub("<title>", "")
+        ret = sanitise_inline_markup(node.content.strip)
         # safeguard against indented XML
         ret.gsub(/>\n\s*</, "><").gsub(/\n\s*/, " ")
-        # node.children.map { |n| n.text? ? n.content : n.to_xml }.join
-        # node.text? ? node.content.strip : node.to_xml.strip
       end
 
       def extract_orgname(org)

data/lib/relaton/render/version.rb

@@ -1,5 +1,5 @@
 module Relaton
   module Render
-    VERSION = "1.2.0".freeze
+    VERSION = "1.2.2".freeze
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: relaton-render
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.2.2
 platform: ruby
 authors:
 - Ribose Inc.
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-05-11 00:00:00.000000000 Z
+date: 2026-05-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler