sanitize 1.2.2.dev.20100822 → 1.2.2.dev.20101028
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of sanitize might be problematic. Click here for more details.
- data/HISTORY +3 -1
- data/README.rdoc +7 -1
- data/lib/sanitize/config.rb +9 -3
- data/lib/sanitize/version.rb +1 -1
- data/lib/sanitize.rb +1 -1
- metadata +3 -3
data/HISTORY
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
Sanitize History
|
2
2
|
================================================================================
|
3
3
|
|
4
|
-
Version 1.2
|
4
|
+
Version 1.2.2 (git)
|
5
5
|
* The environment hash passed into transformers now includes an
|
6
6
|
:allowed_elements Hash to facilitate faster lookups when attempting to
|
7
7
|
determine whether an element is in the whitelist. [Suggested by Nicholas
|
@@ -9,6 +9,8 @@ Version 1.2.? (git)
|
|
9
9
|
* The environment hash passed into transformers now includes a
|
10
10
|
:whitelist_nodes Array, so transformers now have insight into what nodes
|
11
11
|
have been whitelisted by other transformers. [Suggested by Nicholas Evans]
|
12
|
+
* Added a :process_text_nodes config setting. If set to true, Sanitize will
|
13
|
+
pass text nodes to transformers. The default is false. [Ardie Saeidi]
|
12
14
|
* Added a workaround for a bug in Nokogiri 1.4.2 and higher (issue #315) that
|
13
15
|
causes "</body></html>" to be appended to the CDATA inside unterminated
|
14
16
|
script and style elements.
|
data/README.rdoc
CHANGED
@@ -14,7 +14,7 @@ of fragile regular expressions, Sanitize has no trouble dealing with malformed
|
|
14
14
|
or maliciously-formed HTML, and will always output valid HTML or XHTML.
|
15
15
|
|
16
16
|
*Author*:: Ryan Grove (mailto:ryan@wonko.com)
|
17
|
-
*Version*:: 1.2
|
17
|
+
*Version*:: 1.2.2 (git)
|
18
18
|
*Copyright*:: Copyright (c) 2010 Ryan Grove. All rights reserved.
|
19
19
|
*License*:: MIT License (http://opensource.org/licenses/mit-license.php)
|
20
20
|
*Website*:: http://github.com/rgrove/sanitize
|
@@ -142,6 +142,11 @@ defaulting to <code>:xhtml</code>.
|
|
142
142
|
|
143
143
|
Character encoding to use for HTML output. Default is <code>'utf-8'</code>.
|
144
144
|
|
145
|
+
==== :process_text_nodes (Boolean)
|
146
|
+
|
147
|
+
Whether or not to process text nodes. Enabling this will allow text nodes to be
|
148
|
+
processed by transformers. The default is <code>false</code>.
|
149
|
+
|
145
150
|
==== :protocols (Hash)
|
146
151
|
|
147
152
|
URL protocols to allow in specific attributes. If an attribute is listed here
|
@@ -318,6 +323,7 @@ or ideas that later became code:
|
|
318
323
|
* Mutwin Kraus <mutle@blogage.de>
|
319
324
|
* Dev Purkayastha <dev.purkayastha@gmail.com>
|
320
325
|
* David Reese <work@whatcould.com>
|
326
|
+
* Ardie Saeidi <ardalan.saeidi@gmail.com>
|
321
327
|
* Rafael Souza <me@rafaelss.com>
|
322
328
|
* Ben Wanicur <bwanicur@verticalresponse.com>
|
323
329
|
|
data/lib/sanitize/config.rb
CHANGED
@@ -1,16 +1,16 @@
|
|
1
1
|
#--
|
2
2
|
# Copyright (c) 2010 Ryan Grove <ryan@wonko.com>
|
3
|
-
#
|
3
|
+
#
|
4
4
|
# Permission is hereby granted, free of charge, to any person obtaining a copy
|
5
5
|
# of this software and associated documentation files (the 'Software'), to deal
|
6
6
|
# in the Software without restriction, including without limitation the rights
|
7
7
|
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
8
8
|
# copies of the Software, and to permit persons to whom the Software is
|
9
9
|
# furnished to do so, subject to the following conditions:
|
10
|
-
#
|
10
|
+
#
|
11
11
|
# The above copyright notice and this permission notice shall be included in all
|
12
12
|
# copies or substantial portions of the Software.
|
13
|
-
#
|
13
|
+
#
|
14
14
|
# THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
15
15
|
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
16
16
|
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
@@ -23,6 +23,7 @@
|
|
23
23
|
class Sanitize
|
24
24
|
module Config
|
25
25
|
DEFAULT = {
|
26
|
+
|
26
27
|
# Whether or not to allow HTML comments. Allowing comments is strongly
|
27
28
|
# discouraged, since IE allows script execution within conditional
|
28
29
|
# comments.
|
@@ -47,6 +48,10 @@ class Sanitize
|
|
47
48
|
# Character encoding to use for HTML output. Default is 'utf-8'.
|
48
49
|
:output_encoding => 'utf-8',
|
49
50
|
|
51
|
+
# Whether or not to process text nodes. Enabling this will allow text
|
52
|
+
# nodes to be processed by transformers.
|
53
|
+
:process_text_nodes => false,
|
54
|
+
|
50
55
|
# URL handling protocols to allow in specific attributes. By default, no
|
51
56
|
# protocols are allowed. Use :relative in place of a protocol if you want
|
52
57
|
# to allow relative URLs sans protocol.
|
@@ -65,6 +70,7 @@ class Sanitize
|
|
65
70
|
# Transformers allow you to filter or alter nodes using custom logic. See
|
66
71
|
# README.rdoc for details and examples.
|
67
72
|
:transformers => []
|
73
|
+
|
68
74
|
}
|
69
75
|
end
|
70
76
|
end
|
data/lib/sanitize/version.rb
CHANGED
data/lib/sanitize.rb
CHANGED
@@ -138,7 +138,7 @@ class Sanitize
|
|
138
138
|
@whitelist_nodes = []
|
139
139
|
|
140
140
|
node.traverse do |child|
|
141
|
-
if child.element?
|
141
|
+
if child.element? || (child.text? && @config[:process_text_nodes])
|
142
142
|
clean_element!(child)
|
143
143
|
elsif child.comment?
|
144
144
|
child.unlink unless @config[:allow_comments]
|
metadata
CHANGED
@@ -7,8 +7,8 @@ version: !ruby/object:Gem::Version
|
|
7
7
|
- 2
|
8
8
|
- 2
|
9
9
|
- dev
|
10
|
-
-
|
11
|
-
version: 1.2.2.dev.
|
10
|
+
- 20101028
|
11
|
+
version: 1.2.2.dev.20101028
|
12
12
|
platform: ruby
|
13
13
|
authors:
|
14
14
|
- Ryan Grove
|
@@ -16,7 +16,7 @@ autorequire:
|
|
16
16
|
bindir: bin
|
17
17
|
cert_chain: []
|
18
18
|
|
19
|
-
date: 2010-
|
19
|
+
date: 2010-10-28 00:00:00 -07:00
|
20
20
|
default_executable:
|
21
21
|
dependencies:
|
22
22
|
- !ruby/object:Gem::Dependency
|