sanitize 1.0.4 → 1.0.5

data/HISTORY

@@ -1,6 +1,13 @@
 Sanitize History
 ================================================================================
 
+Version 1.0.5 (2009-02-05)
+  * Fixed a bug introduced in version 1.0.3 that prevented non-whitelisted
+    protocols from being cleaned when relative URLs were allowed. [Reported by
+    Dev Purkayastha]
+  * Fixed "undefined method `parent='" exceptions caused by parser changes in
+    edge Hpricot.
+
 Version 1.0.4 (2009-01-16)
   * Fixed a bug that made it possible to sneak a non-whitelisted element through
     by repeating it several times in a row. All versions of Sanitize prior to

data/README.rdoc

@@ -15,7 +15,7 @@ or maliciously-formed HTML. When in doubt, Sanitize always errs on the side of
 caution.
 
 *Author*::    Ryan Grove (mailto:ryan@wonko.com)
-*Version*::   1.0.4 (2009-01-16)
+*Version*::   1.0.5 (2009-02-05)
 *Copyright*:: Copyright (c) 2009 Ryan Grove. All rights reserved.
 *License*::   MIT License (http://opensource.org/licenses/mit-license.php)
 *Website*::   http://github.com/rgrove/sanitize

data/lib/sanitize.rb

@@ -40,11 +40,11 @@ require 'sanitize/monkeypatch/hpricot'
 class Sanitize
 
   # Matches an attribute value that could be treated by a browser as a URL
-  # with a protocol prefix, such as "http:" or "javascript:". Any string of one
+  # with a protocol prefix, such as "http:" or "javascript:". Any string of zero
   # or more characters followed by a colon is considered a match, even if the
   # colon is encoded as an entity and even if it's an incomplete entity (which
   # IE6 and Opera will still parse).
-  REGEX_PROTOCOL = /^([^:]+)(?:\:|&#0*58|&#x0*3a)(?:[^0-9a-f]|$)/i
+  REGEX_PROTOCOL = /^([^:]*)(?:\:|&#0*58|&#x0*3a)/i
 
   #--
   # Class Methods
@@ -86,18 +86,18 @@ class Sanitize
 
     fragment.search('*') do |node|
       if node.bogusetag? || node.doctype? || node.procins? || node.xmldecl?
-        node.swap('')
+        node.parent.replace_child(node, '')
         next
       end
 
       if node.comment?
-        node.swap('') unless @config[:allow_comments]
+        node.parent.replace_child(node, '') unless @config[:allow_comments]
       elsif node.elem?
         name = node.name.to_s.downcase
 
         # Delete any element that isn't in the whitelist.
         unless @config[:elements].include?(name)
-          node.parent.replace_child(node, node.children)
+          node.parent.replace_child(node, node.children || '')
           next
         end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: sanitize
 version: !ruby/object:Gem::Version 
-  version: 1.0.4
+  version: 1.0.5
 platform: ruby
 authors: 
 - Ryan Grove
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2009-01-16 00:00:00 -08:00
+date: 2009-02-05 00:00:00 -08:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency