rgrove-sanitize 1.0.8 → 1.0.8.2

data/HISTORY

@@ -1,6 +1,11 @@
 Sanitize History
 ================================================================================
 
+Version 1.0.8.2 (git)
+  * Migrated from Hpricot to Nokogiri. Requires libxml2 >= 2.7.2 [Adam Hooper]
+  * Changed protocol regex to ensure Sanitize doesn't kill URLs with colons in 
+    path segments. [Peter Cooper]
+
 Version 1.0.8 (2009-04-23)
   * Added a workaround for an Hpricot bug that prevents attribute names from
     being downcased in recent versions of Hpricot. This was exploitable to

data/README.rdoc

@@ -9,13 +9,13 @@ elements, certain attributes within those elements, and even certain URL
 protocols within attributes that contain URLs. Any HTML elements or attributes
 that you don't explicitly allow will be removed.
 
-Because it's based on Hpricot, a full-fledged HTML parser, rather than a bunch
+Because it's based on Nokogiri, a full-fledged HTML parser, rather than a bunch
 of fragile regular expressions, Sanitize has no trouble dealing with malformed
 or maliciously-formed HTML. When in doubt, Sanitize always errs on the side of
 caution.
 
 *Author*::    Ryan Grove (mailto:ryan@wonko.com)
-*Version*::   1.0.8 (2009-04-23)
+*Version*::   1.0.8.2 (git)
 *Copyright*:: Copyright (c) 2009 Ryan Grove. All rights reserved.
 *License*::   MIT License (http://opensource.org/licenses/mit-license.php)
 *Website*::   http://github.com/rgrove/sanitize
@@ -23,7 +23,8 @@ caution.
 == Requires
 
 * RubyGems
-* Hpricot 0.6+
+* Nokogiri
+* libxml2 >= 2.7.2
 
 == Usage
 
@@ -141,6 +142,7 @@ include the symbol <code>:relative</code> in the protocol array:
 The following lovely people have contributed to Sanitize in the form of patches
 or ideas that later became code:
 
+* Peter Cooper <git@peterc.org>
 * Ryan Grove <ryan@wonko.com>
 * Adam Hooper <adam@adamhooper.com>
 * Mutwin Kraus <mutle@blogage.de>

data/lib/sanitize.rb

@@ -26,9 +26,9 @@ $:.uniq!
 
 require 'rubygems'
 
-gem 'hpricot', '~> 0.8.1'
+gem 'nokogiri', '~> 1.3.3'
 
-require 'hpricot'
+require 'nokogiri'
 require 'sanitize/config'
 require 'sanitize/config/restricted'
 require 'sanitize/config/basic'
@@ -53,7 +53,7 @@ class Sanitize
   # or more characters followed by a colon is considered a match, even if the
   # colon is encoded as an entity and even if it's an incomplete entity (which
   # IE6 and Opera will still parse).
-  REGEX_PROTOCOL = /^([^:]*)(?:\:|&#0*58|&#x0*3a)/i
+  REGEX_PROTOCOL = /^([A-Za-z0-9\+\-\.\&\;\#\s]*?)(?:\:|&#0*58|&#x0*3a)/i
 
   #--
   # Instance Methods
@@ -73,78 +73,65 @@ class Sanitize
   # Performs clean in place, returning _html_, or +nil+ if no changes were
   # made.
   def clean!(html)
-    fragment = Hpricot(html)
-
-    fragment.search('*') do |node|
-      if node.bogusetag? || node.doctype? || node.procins? || node.xmldecl?
-        node.parent.replace_child(node, '')
-        next
-      end
+    fragment = Nokogiri::HTML::DocumentFragment.parse(html)
 
+    fragment.traverse do |node|
       if node.comment?
-        node.parent.replace_child(node, '') unless @config[:allow_comments]
-      elsif node.elem?
+        node.unlink unless @config[:allow_comments]
+      elsif node.element?
         name = node.name.to_s.downcase
 
         # Delete any element that isn't in the whitelist.
         unless @config[:elements].include?(name)
-          node.parent.replace_child(node, node.children || '')
+          node.children.each { |n| node.add_previous_sibling(n) }
+          node.unlink
           next
         end
 
-        node.raw_attributes ||= {}
-
         attr_whitelist = ((@config[:attributes][name] || []) +
             (@config[:attributes][:all] || [])).uniq
 
         if attr_whitelist.empty?
           # Delete all attributes from elements with no whitelisted
           # attributes.
-          node.raw_attributes = {}
+          node.attribute_nodes.each { |attr| attr.remove }
         else
           # Delete any attribute that isn't in the whitelist for this element.
-          node.raw_attributes.delete_if do |key, value|
-            !attr_whitelist.include?(key.to_s.downcase)
+          node.attribute_nodes.each do |attr|
+            attr.unlink unless attr_whitelist.include?(attr.name.downcase)
           end
 
           # Delete remaining attributes that use unacceptable protocols.
           if @config[:protocols].has_key?(name)
             protocol = @config[:protocols][name]
 
-            node.raw_attributes.delete_if do |key, value|
-              key = key.to_s.downcase
-              next false unless protocol.has_key?(key)
-              next true if value.nil?
+            node.attribute_nodes.each do |attr|
+              attr_name = attr.name.downcase
+              next false unless protocol.has_key?(attr_name)
 
-              if value.to_s.downcase =~ REGEX_PROTOCOL
-                !protocol[key].include?($1.downcase)
+              del = if attr.value.to_s.downcase =~ REGEX_PROTOCOL
+                !protocol[attr_name].include?($1.downcase)
               else
-                !protocol[key].include?(:relative)
+                !protocol[attr_name].include?(:relative)
               end
+
+              attr.unlink if del
             end
           end
         end
 
         # Add required attributes.
         if @config[:add_attributes].has_key?(name)
-          node.raw_attributes.merge!(@config[:add_attributes][name])
-        end
-
-        # Escape special chars in attribute values.
-        node.raw_attributes.each do |key, value|
-          node.raw_attributes[key] = Sanitize.encode_html(value)
+          @config[:add_attributes][name].each do |key, val|
+            node[key] = val
+          end
         end
+      elsif node.cdata?
+        node.replace(Nokogiri::XML::Text.new(node.text, node.document))
       end
     end
 
-    # Make one last pass through the fragment and encode all special HTML chars
-    # as entities. This eliminates certain types of maliciously-malformed nested
-    # tags.
-    fragment.search('*') do |node|
-      node.swap(Sanitize.encode_html(node.to_original_html)) if node.text?
-    end
-
-    result = fragment.to_s
+    result = fragment.to_xhtml(:encoding => 'UTF-8', :indent => 0).gsub(/>\n/, '>')
     return result == html ? nil : html[0, html.length] = result
   end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: rgrove-sanitize
 version: !ruby/object:Gem::Version 
-  version: 1.0.8
+  version: 1.0.8.2
 platform: ruby
 authors: 
 - Ryan Grove
@@ -9,18 +9,18 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2009-04-08 00:00:00 -07:00
+date: 2009-05-16 00:00:00 -07:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
-  name: hpricot
+  name: nokogiri
   type: :runtime
   version_requirement: 
   version_requirements: !ruby/object:Gem::Requirement 
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        version: 0.8.1
+        version: 1.3.3
     version: 
 description: 
 email: ryan@wonko.com