sanitize 1.2.2.dev.20101028 → 1.2.2.dev.20101118
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of sanitize might be problematic. Click here for more details.
- data/HISTORY +3 -3
- data/lib/sanitize/version.rb +1 -1
- data/lib/sanitize.rb +0 -9
- metadata +5 -6
- data/lib/sanitize/transformers/fix_fragment_cdata.rb +0 -27
data/HISTORY
CHANGED
@@ -11,9 +11,9 @@ Version 1.2.2 (git)
|
|
11
11
|
have been whitelisted by other transformers. [Suggested by Nicholas Evans]
|
12
12
|
* Added a :process_text_nodes config setting. If set to true, Sanitize will
|
13
13
|
pass text nodes to transformers. The default is false. [Ardie Saeidi]
|
14
|
-
*
|
15
|
-
|
16
|
-
script and style elements.
|
14
|
+
* Bumped minimum Nokogiri version to 1.4.4 to avoid a bug in 1.4.2+ (issue
|
15
|
+
#315) that caused "</body></html>" to be appended to the CDATA inside
|
16
|
+
unterminated script and style elements.
|
17
17
|
|
18
18
|
Version 1.2.1 (2010-04-20)
|
19
19
|
* Added a :remove_contents config setting. If set to true, Sanitize will
|
data/lib/sanitize/version.rb
CHANGED
data/lib/sanitize.rb
CHANGED
@@ -27,7 +27,6 @@ require 'sanitize/config'
|
|
27
27
|
require 'sanitize/config/restricted'
|
28
28
|
require 'sanitize/config/basic'
|
29
29
|
require 'sanitize/config/relaxed'
|
30
|
-
require 'sanitize/transformers/fix_fragment_cdata'
|
31
30
|
|
32
31
|
class Sanitize
|
33
32
|
attr_reader :config
|
@@ -91,14 +90,6 @@ class Sanitize
|
|
91
90
|
# is generated at runtime by transformers, and is cleared before and after
|
92
91
|
# a fragment is cleaned (so it applies only to a specific fragment).
|
93
92
|
@whitelist_nodes = []
|
94
|
-
|
95
|
-
# Workaround for a fragment parsing bug in Nokogiri >= 1.4.2. The naïve
|
96
|
-
# version check is fine here; there are no side effects for unaffected
|
97
|
-
# versions except slightly worse performance, and I plan to remove this hack
|
98
|
-
# as soon as Nokogiri fixes the bug on their end.
|
99
|
-
if Nokogiri::VERSION > '1.4.1'
|
100
|
-
@config[:transformers] << Transformers::FIX_FRAGMENT_CDATA
|
101
|
-
end
|
102
93
|
end
|
103
94
|
|
104
95
|
# Returns a sanitized copy of _html_.
|
metadata
CHANGED
@@ -7,8 +7,8 @@ version: !ruby/object:Gem::Version
|
|
7
7
|
- 2
|
8
8
|
- 2
|
9
9
|
- dev
|
10
|
-
-
|
11
|
-
version: 1.2.2.dev.
|
10
|
+
- 20101118
|
11
|
+
version: 1.2.2.dev.20101118
|
12
12
|
platform: ruby
|
13
13
|
authors:
|
14
14
|
- Ryan Grove
|
@@ -16,7 +16,7 @@ autorequire:
|
|
16
16
|
bindir: bin
|
17
17
|
cert_chain: []
|
18
18
|
|
19
|
-
date: 2010-
|
19
|
+
date: 2010-11-18 00:00:00 -08:00
|
20
20
|
default_executable:
|
21
21
|
dependencies:
|
22
22
|
- !ruby/object:Gem::Dependency
|
@@ -30,8 +30,8 @@ dependencies:
|
|
30
30
|
segments:
|
31
31
|
- 1
|
32
32
|
- 4
|
33
|
-
-
|
34
|
-
version: 1.4.
|
33
|
+
- 4
|
34
|
+
version: 1.4.4
|
35
35
|
type: :runtime
|
36
36
|
version_requirements: *id001
|
37
37
|
- !ruby/object:Gem::Dependency
|
@@ -80,7 +80,6 @@ files:
|
|
80
80
|
- lib/sanitize/config/relaxed.rb
|
81
81
|
- lib/sanitize/config/restricted.rb
|
82
82
|
- lib/sanitize/config.rb
|
83
|
-
- lib/sanitize/transformers/fix_fragment_cdata.rb
|
84
83
|
- lib/sanitize/version.rb
|
85
84
|
- lib/sanitize.rb
|
86
85
|
has_rdoc: true
|
@@ -1,27 +0,0 @@
|
|
1
|
-
class Sanitize; module Transformers
|
2
|
-
|
3
|
-
# Nokogiri 1.4.2 and higher contain a fragment parsing bug that causes the
|
4
|
-
# string "</body></html>" to be appended to the CDATA inside an unterminated
|
5
|
-
# <script> or <style> element. This transformer works around this bug by
|
6
|
-
# finding affected elements and removing the spurious text.
|
7
|
-
#
|
8
|
-
# See http://github.com/tenderlove/nokogiri/issues#issue/315
|
9
|
-
FIX_FRAGMENT_CDATA = lambda do |env|
|
10
|
-
node_name = env[:node_name]
|
11
|
-
|
12
|
-
if node_name == 'script' || node_name == 'style'
|
13
|
-
node = env[:node]
|
14
|
-
|
15
|
-
unless node.children.empty?
|
16
|
-
last_child = node.children.last
|
17
|
-
|
18
|
-
if last_child.text? && last_child.content =~ %r|</body></html>$|
|
19
|
-
last_child.content = last_child.content.chomp('</body></html>')
|
20
|
-
end
|
21
|
-
end
|
22
|
-
end
|
23
|
-
|
24
|
-
nil
|
25
|
-
end
|
26
|
-
|
27
|
-
end; end
|