sanitize 1.2.1 → 1.2.2.dev.20100822

data/HISTORY

@@ -1,6 +1,18 @@
 Sanitize History
 ================================================================================
 
+Version 1.2.? (git)
+  * The environment hash passed into transformers now includes an
+    :allowed_elements Hash to facilitate faster lookups when attempting to
+    determine whether an element is in the whitelist. [Suggested by Nicholas
+    Evans]
+  * The environment hash passed into transformers now includes a
+    :whitelist_nodes Array, so transformers now have insight into what nodes
+    have been whitelisted by other transformers. [Suggested by Nicholas Evans]
+  * Added a workaround for a bug in Nokogiri 1.4.2 and higher (issue #315) that
+    causes "</body></html>" to be appended to the CDATA inside unterminated
+    script and style elements.
+
 Version 1.2.1 (2010-04-20)
   * Added a :remove_contents config setting. If set to true, Sanitize will
     remove the contents of all non-whitelisted elements in addition to the

data/README.rdoc

@@ -14,7 +14,7 @@ of fragile regular expressions, Sanitize has no trouble dealing with malformed
 or maliciously-formed HTML, and will always output valid HTML or XHTML.
 
 *Author*::    Ryan Grove (mailto:ryan@wonko.com)
-*Version*::   1.2.1 (2010-04-20)
+*Version*::   1.2.? (git)
 *Copyright*:: Copyright (c) 2010 Ryan Grove. All rights reserved.
 *License*::   MIT License (http://opensource.org/licenses/mit-license.php)
 *Website*::   http://github.com/rgrove/sanitize
@@ -194,6 +194,10 @@ Each registered transformer's <code>call()</code> method will be called once for
 each element node in the HTML, and will receive as an argument an environment
 Hash that contains the following items:
 
+[<code>:allowed_elements</code>]
+  Hash with whitelisted element names as keys, to facilitate fast lookups of
+  whitelisted elements.
+
 [<code>:config</code>]
   The current Sanitize configuration Hash.
 
@@ -203,6 +207,10 @@ Hash that contains the following items:
 [<code>:node_name</code>]
   The name of the current HTML node, always lowercase (e.g. "div" or "span").
 
+[<code>:whitelist_nodes</code>]
+  Array of Nokogiri::XML::Node instances that have already been whitelisted by
+  previous transformers, if any.
+
 ==== Processing
 
 Each transformer has full access to the Nokogiri::XML::Node that's passed into
@@ -301,9 +309,11 @@ by just whitelisting all <code><object></code>, <code><embed></code>, and
 The following lovely people have contributed to Sanitize in the form of patches
 or ideas that later became code:
 
+* Ryan Grove <ryan@wonko.com>
+* Wilson Bilkovich <wilson@supremetyrant.com>
 * Peter Cooper <git@peterc.org>
 * Gabe da Silveira <gabe@websaviour.com>
-* Ryan Grove <ryan@wonko.com>
+* Nicholas Evans <owlmanatt@gmail.com>
 * Adam Hooper <adam@adamhooper.com>
 * Mutwin Kraus <mutle@blogage.de>
 * Dev Purkayastha <dev.purkayastha@gmail.com>

data/lib/sanitize/transformers/fix_fragment_cdata.rb

@@ -0,0 +1,27 @@
+class Sanitize; module Transformers
+
+  # Nokogiri 1.4.2 and higher contain a fragment parsing bug that causes the
+  # string "</body></html>" to be appended to the CDATA inside an unterminated
+  # <script> or <style> element. This transformer works around this bug by
+  # finding affected elements and removing the spurious text.
+  #
+  # See http://github.com/tenderlove/nokogiri/issues#issue/315
+  FIX_FRAGMENT_CDATA = lambda do |env|
+    node_name = env[:node_name]
+
+    if node_name == 'script' || node_name == 'style'
+      node = env[:node]
+
+      unless node.children.empty?
+        last_child = node.children.last
+
+        if last_child.text? && last_child.content =~ %r|</body></html>$|
+          last_child.content = last_child.content.chomp('</body></html>')
+        end
+      end
+    end
+
+    nil
+  end
+
+end; end

data/lib/sanitize/version.rb

@@ -1,3 +1,3 @@
 class Sanitize
-  VERSION = '1.2.1'
+  VERSION = '1.2.2.dev.20100822'
 end

data/lib/sanitize.rb

@@ -27,6 +27,7 @@ require 'sanitize/config'
 require 'sanitize/config/restricted'
 require 'sanitize/config/basic'
 require 'sanitize/config/relaxed'
+require 'sanitize/transformers/fix_fragment_cdata'
 
 class Sanitize
   attr_reader :config
@@ -90,12 +91,22 @@ class Sanitize
     # is generated at runtime by transformers, and is cleared before and after
     # a fragment is cleaned (so it applies only to a specific fragment).
     @whitelist_nodes = []
+
+    # Workaround for a fragment parsing bug in Nokogiri >= 1.4.2. The naïve
+    # version check is fine here; there are no side effects for unaffected
+    # versions except slightly worse performance, and I plan to remove this hack
+    # as soon as Nokogiri fixes the bug on their end.
+    if Nokogiri::VERSION > '1.4.1'
+      @config[:transformers] << Transformers::FIX_FRAGMENT_CDATA
+    end
   end
 
   # Returns a sanitized copy of _html_.
   def clean(html)
-    dupe = html.dup
-    clean!(dupe) || dupe
+    if html
+      dupe = html.dup
+      clean!(dupe) || dupe
+    end
   end
 
   # Performs clean in place, returning _html_, or +nil+ if no changes were
@@ -215,9 +226,11 @@ class Sanitize
 
     @config[:transformers].inject(node) do |transformer_node, transformer|
       transform = transformer.call({
-        :config    => @config,
-        :node      => transformer_node,
-        :node_name => transformer_node.name.downcase
+        :allowed_elements => @allowed_elements,
+        :config           => @config,
+        :node             => transformer_node,
+        :node_name        => transformer_node.name.downcase,
+        :whitelist_nodes  => @whitelist_nodes
       })
 
       if transform.nil?

metadata

@@ -1,7 +1,14 @@
 --- !ruby/object:Gem::Specification 
 name: sanitize
 version: !ruby/object:Gem::Version 
-  version: 1.2.1
+  prerelease: true
+  segments: 
+  - 1
+  - 2
+  - 2
+  - dev
+  - 20100822
+  version: 1.2.2.dev.20100822
 platform: ruby
 authors: 
 - Ryan Grove
@@ -9,39 +16,54 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2010-04-20 00:00:00 -07:00
+date: 2010-08-22 00:00:00 -07:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
   name: nokogiri
-  type: :runtime
-  version_requirement: 
-  version_requirements: !ruby/object:Gem::Requirement 
+  prerelease: false
+  requirement: &id001 !ruby/object:Gem::Requirement 
+    none: false
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
+        segments: 
+        - 1
+        - 4
+        - 1
         version: 1.4.1
-    version: 
+  type: :runtime
+  version_requirements: *id001
 - !ruby/object:Gem::Dependency 
   name: bacon
-  type: :development
-  version_requirement: 
-  version_requirements: !ruby/object:Gem::Requirement 
+  prerelease: false
+  requirement: &id002 !ruby/object:Gem::Requirement 
+    none: false
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
+        segments: 
+        - 1
+        - 1
+        - 0
         version: 1.1.0
-    version: 
+  type: :development
+  version_requirements: *id002
 - !ruby/object:Gem::Dependency 
   name: rake
-  type: :development
-  version_requirement: 
-  version_requirements: !ruby/object:Gem::Requirement 
+  prerelease: false
+  requirement: &id003 !ruby/object:Gem::Requirement 
+    none: false
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
+        segments: 
+        - 0
+        - 8
+        - 0
         version: 0.8.0
-    version: 
+  type: :development
+  version_requirements: *id003
 description: 
 email: ryan@wonko.com
 executables: []
@@ -58,6 +80,7 @@ files:
 - lib/sanitize/config/relaxed.rb
 - lib/sanitize/config/restricted.rb
 - lib/sanitize/config.rb
+- lib/sanitize/transformers/fix_fragment_cdata.rb
 - lib/sanitize/version.rb
 - lib/sanitize.rb
 has_rdoc: true
@@ -70,21 +93,29 @@ rdoc_options: []
 require_paths: 
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement 
+  none: false
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
+      segments: 
+      - 1
+      - 8
+      - 6
       version: 1.8.6
-  version: 
 required_rubygems_version: !ruby/object:Gem::Requirement 
+  none: false
   requirements: 
-  - - ">="
+  - - ">"
     - !ruby/object:Gem::Version 
-      version: "0"
-  version: 
+      segments: 
+      - 1
+      - 3
+      - 1
+      version: 1.3.1
 requirements: []
 
 rubyforge_project: riposte
-rubygems_version: 1.3.5
+rubygems_version: 1.3.7
 signing_key: 
 specification_version: 3
 summary: Whitelist-based HTML sanitizer.