relaton-render 1.2.0 → 1.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bfa59dd1186cb178a96316ffff00066b9c048a326f47dda9381424f4d805e79c
-  data.tar.gz: b6f23cf5a7190c5cbac9b57350cf3a3812da2fbf94cf45218d02c7f4a8bc026c
+  metadata.gz: 4bcf0448a633329d256fee9e297e7c50182a5e214014a7cb78a9d3ab7ec3147f
+  data.tar.gz: 766c8ddbb23a88334eaf2d3be35894ffe62ce300126c7cdded5af90e8341a7a6
 SHA512:
-  metadata.gz: 8a857436fbd6e62d3d0471efe0a8c0b4b2a77684a9346558d1912d51fdd84d353a8c40aa7a141f5bfd03da162dd97e0a6c5817e86dffaa3c139e2df0b7d638c8
-  data.tar.gz: 8701d33d12f8cad24ccb245c0804c4e3e886aa833a6a8da8d86866acd2b7db540c12221a47ec9ae234617744c8cc26bec40c1c2192900ec89ce1af002135d697
+  metadata.gz: 9ff2d1381a4075e7c0c5b46a5fb174b1190621b25760600928f2b49da2379eea21006f17468d74c89e9c1f30cd8abb49f591bd5361e5ab57e029a6de04d09c57
+  data.tar.gz: 18b0f1710c29a3e8ce67f055d3dcdefeaf62191ff7711beaa296bf95f669f49699186868172a617a429765c9544de52eb30669b98c2b63f41a46c76b36b91b65

data/lib/relaton/render/parse/parse.rb

@@ -82,6 +82,8 @@ module Relaton
         end
       end
 
+      ALLOWED_INLINE_TAGS = %w[em strong sub sup a smallcap].freeze
+
       private
 
       def blank?(text)
@@ -93,6 +95,19 @@ module Relaton
         "<esc>#{text}</esc>"
       end
 
+      # Strip any tag not in ALLOWED_INLINE_TAGS, in both literal (<tag>) and
+      # entity-encoded (&lt;tag&gt;) forms. Used to defend Liquid template
+      # output against embedded structural markup (most commonly <title>) in
+      # bibliographic text fields, where relaton-bib may surface either form
+      # depending on lutaml-model serialisation behaviour.
+      def sanitise_inline_markup(str)
+        blank?(str) and return str
+        allowed = ALLOWED_INLINE_TAGS.join("|")
+        literal = %r{</?(?!(?:#{allowed})\b)[A-Za-z][\w:-]*(?:\s[^>]*)?/?>}
+        encoded = %r{&lt;/?(?!(?:#{allowed})\b)[A-Za-z][\w:-]*(?:\s[^&]*?)?/?&gt;}
+        str.gsub(literal, "").gsub(encoded, "")
+      end
+
       def wrap_in_esc(obj)
         case obj
         when String then esc(obj)

data/lib/relaton/render/parse/parse_contributors.rb

@@ -4,15 +4,12 @@ module Relaton
       def content(node)
         node.nil? and return node
         node.is_a?(String) and
-          return node.strip.gsub("</title>", "").gsub("<title>", "")
+          return sanitise_inline_markup(node.strip)
             .gsub(/>\n\s*</, "><").gsub(/\n\s*/, " ")
         node.content.is_a?(Array) and return node.content.map { |x| content(x) }
-        ret = node.content.strip
-          .gsub("</title>", "").gsub("<title>", "")
+        ret = sanitise_inline_markup(node.content.strip)
         # safeguard against indented XML
         ret.gsub(/>\n\s*</, "><").gsub(/\n\s*/, " ")
-        # node.children.map { |n| n.text? ? n.content : n.to_xml }.join
-        # node.text? ? node.content.strip : node.to_xml.strip
       end
 
       def extract_orgname(org)

data/lib/relaton/render/version.rb

@@ -1,5 +1,5 @@
 module Relaton
   module Render
-    VERSION = "1.2.0".freeze
+    VERSION = "1.2.1".freeze
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: relaton-render
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.2.1
 platform: ruby
 authors:
 - Ribose Inc.
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-05-11 00:00:00.000000000 Z
+date: 2026-05-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler