sanitize 4.1.0 → 4.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: db5b47018757eca02968cca236fae793558f28a3
-  data.tar.gz: 2556f1ebfb26b038190f334a39aff61315cd57b0
+SHA256:
+  metadata.gz: db18b3287fbfa069e318719e3cc99a3b60adc96c31824bb8953aba9f05cd1a48
+  data.tar.gz: ff8199fdae234ad4657a26d8f47708a9ce349b189170c9df15be39b2ea8e7e45
 SHA512:
-  metadata.gz: 2ddad668c07d8440a7e3bd4ccf4a066f6c1f0a7d9aeb8a0f43bd04569c8b5dd7959130d50c0725f902fa6f1bf8ed930b4d00ee4fa977f3364702d53387463b39
-  data.tar.gz: 677279ef0d92a8e1d96e1ac28cfa12a5e4934887952a75dc891a5f37014352b8369f5effc1e480a10ae10363724840dbb1a9b5ec7b60b317a501ec370811d5b4
+  metadata.gz: d3b9492b4443779688f09d6a56c730261ccf82af47601dc4dbc525d243626eaf615355a01b5e05a808749c52ac0f6b9a433ad1906a023c2a57c5a8b588bc1c74
+  data.tar.gz: 03bdf142b612acb05ffe7560443594fef0bcbe24b68b93e8e89f4b3460e8ce70abcabb7f8a08e7ec8a57036bd73eb37579452a811240560690d400f60f436b7b

data/HISTORY.md

@@ -1,5 +1,50 @@
 # Sanitize History
 
+## 4.6.0 (2018-01-29)
+
+* Loosened the Nokogumbo dependency to allow installing semver-compatible
+  versions greater than or equal to v1.4. [@rafbm - #171][171]
+
+[171]:https://github.com/rgrove/sanitize/pull/171
+
+## 4.5.0 (2017-06-04)
+
+* Added SVG-related CSS properties to the relaxed config. See [the diff][161]
+  for the full list of added properties. [@louim - #161][161]
+
+* Fixed: Sanitize now strips null bytes (`\u0000`) before passing input to
+  Nokogumbo, since they can cause recent versions to crash with a failed
+  assertion in the Gumbo parser.
+
+[161]:https://github.com/rgrove/sanitize/pull/161
+
+## 4.4.0 (2016-09-29)
+
+* Added `srcset` to the attribute whitelist for `img` elements in the relaxed
+  config. [@ejtttje - #156][156]
+
+[156]:https://github.com/rgrove/sanitize/pull/156
+
+
+## 4.3.0 (2016-09-20)
+
+* Methods can now be used as transformers. [@Skipants - #155][155]
+
+[155]:https://github.com/rgrove/sanitize/pull/155
+
+
+## 4.2.0 (2016-08-22)
+
+* Added `-webkit-font-smoothing` to the relaxed CSS config. [@louim - #154][154]
+
+* Fixed: Nokogumbo >=1.4.9 changed its behavior in a way that allowed invalid
+  doctypes (like `<!DOCTYPE nonsense>`) when the `:allow_doctype` config setting
+  was `true`. Invalid doctypes are now coerced to valid ones as they were prior
+  to this Nokogumbo change.
+
+[154]:https://github.com/rgrove/sanitize/pull/154
+
+
 ## 4.1.0 (2016-06-17)
 
 * Added a new CSS config setting, `:import_url_validator`. This is a Proc or

data/lib/sanitize/config/relaxed.rb

@@ -19,7 +19,7 @@ class Sanitize
         'colgroup' => %w[span width],
         'data'     => %w[value],
         'del'      => %w[cite datetime],
-        'img'      => %w[align alt border height src width],
+        'img'      => %w[align alt border height src srcset width],
         'ins'      => %w[cite datetime],
         'li'       => %w[value],
         'ol'       => %w[reversed start type],
@@ -254,6 +254,7 @@ class Sanitize
           -webkit-flow-from
           -webkit-flow-into
           -webkit-font-size-delta
+          -webkit-font-smoothing
           -webkit-grid-area
           -webkit-grid-auto-columns
           -webkit-grid-auto-flow
@@ -430,7 +431,10 @@ class Sanitize
           clip-path
           clip-rule
           color
+          color-interpolation
           color-interpolation-filters
+          color-profile
+          color-rendering
           column-count
           column-fill
           column-gap
@@ -459,6 +463,10 @@ class Sanitize
           dominant-baseline
           elevation
           empty-cells
+          enable-background
+          fill
+          fill-opacity
+          fill-rule
           filter
           flex
           flex-basis
@@ -491,6 +499,8 @@ class Sanitize
           font-variant-numeric
           font-variant-position
           font-weight
+          glyph-orientation-horizontal
+          glyph-orientation-vertical
           grid
           grid-area
           grid-auto-columns
@@ -519,6 +529,7 @@ class Sanitize
           justify-content
           justify-items
           justify-self
+          kerning
           left
           letter-spacing
           lighting-color
@@ -540,8 +551,12 @@ class Sanitize
           margin-left
           margin-right
           margin-top
+          marker
+          marker-end
+          marker-mid
           marker-offset
           marker-side
+          marker-start
           marks
           mask
           mask-box
@@ -601,6 +616,7 @@ class Sanitize
           pitch
           pitch-range
           play-during
+          pointer-events
           position
           presentation-level
           quotes
@@ -619,6 +635,7 @@ class Sanitize
           shape-image-threshold
           shape-margin
           shape-outside
+          shape-rendering
           size
           speak
           speak-as
@@ -626,12 +643,23 @@ class Sanitize
           speak-numeral
           speak-punctuation
           speech-rate
+          stop-color
+          stop-opacity
           stress
           string-set
+          stroke
+          stroke-dasharray
+          stroke-dashoffset
+          stroke-linecap
+          stroke-linejoin
+          stroke-miterlimit
+          stroke-opacity
+          stroke-width
           tab-size
           table-layout
           text-align
           text-align-last
+          text-anchor
           text-combine-horizontal
           text-combine-upright
           text-decoration

data/lib/sanitize/config.rb

@@ -52,7 +52,7 @@ class Sanitize
     # Returns `true` if `dup` may be safely called on _value_, `false`
     # otherwise.
     def self.can_dupe?(value)
-      !(true == value || false == value || value.nil? || Numeric === value || Symbol === value)
+      !(true == value || false == value || value.nil? || Method === value || Numeric === value || Symbol === value)
     end
     private_class_method :can_dupe?
 

data/lib/sanitize/transformers/clean_doctype.rb

@@ -3,10 +3,16 @@
 class Sanitize; module Transformers
 
   CleanDoctype = lambda do |env|
+    return if env[:is_whitelisted]
+
     node = env[:node]
 
     if node.type == Nokogiri::XML::Node::DTD_NODE
-      node.unlink unless env[:is_whitelisted]
+      if env[:config][:allow_doctype]
+        node.name = 'html'
+      else
+        node.unlink
+      end
     end
   end
 

data/lib/sanitize/version.rb

@@ -1,5 +1,5 @@
 # encoding: utf-8
 
 class Sanitize
-  VERSION = '4.1.0'
+  VERSION = '4.6.0'
 end

data/lib/sanitize.rb

@@ -30,7 +30,7 @@ class Sanitize
   # it to the parser.
   #
   # http://www.w3.org/TR/unicode-xml/#Charlist
-  REGEX_UNSUITABLE_CHARS = /[\u0340\u0341\u17a3\u17d3\u2028\u2029\u202a-\u202e\u206a-\u206f\ufff9-\ufffb\ufeff\ufffc\u{1d173}-\u{1d17a}\u{e0000}-\u{e007f}]/u
+  REGEX_UNSUITABLE_CHARS = /[\u0000\u0340\u0341\u17a3\u17d3\u2028\u2029\u202a-\u202e\u206a-\u206f\ufff9-\ufffb\ufeff\ufffc\u{1d173}-\u{1d17a}\u{e0000}-\u{e007f}]/u
 
   #--
   # Class Methods
@@ -77,12 +77,11 @@ class Sanitize
   def initialize(config = {})
     @config = Config.merge(Config::DEFAULT, config)
 
-    @transformers = Array(@config[:transformers].dup)
+    @transformers = Array(@config[:transformers]).dup
 
     # Default transformers always run at the end of the chain, after any custom
     # transformers.
     @transformers << Transformers::CleanComment unless @config[:allow_comments]
-    @transformers << Transformers::CleanDoctype unless @config[:allow_doctype]
 
     if @config[:elements].include?('style')
       scss = Sanitize::CSS.new(config)
@@ -95,6 +94,7 @@ class Sanitize
     end
 
     @transformers <<
+        Transformers::CleanDoctype <<
         Transformers::CleanCDATA <<
         Transformers::CleanElement.new(@config)
   end

data/test/test_sanitize.rb

@@ -2,6 +2,17 @@
 require_relative 'common'
 
 describe 'Sanitize' do
+  describe 'initializer' do
+    it 'should not modify a transformers array in the given config' do
+      transformers = [
+        lambda {}
+      ]
+
+      Sanitize.new({ :transformers => transformers })
+      transformers.length.must_equal(1)
+    end
+  end
+
   describe 'instance methods' do
     before do
       @s = Sanitize.new

data/test/test_transformers.rb

@@ -77,6 +77,12 @@ describe 'Transformers' do
     called.must_equal true
   end
 
+  it 'should accept a method transformer' do
+    def transformer(env); end
+    Sanitize.fragment('<div>foo</div>', :transformers => method(:transformer))
+      .must_equal(' foo ')
+  end
+
   describe 'Image whitelist transformer' do
     require 'uri'
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sanitize
 version: !ruby/object:Gem::Version
-  version: 4.1.0
+  version: 4.6.0
 platform: ruby
 authors:
 - Ryan Grove
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-07-17 00:00:00.000000000 Z
+date: 2018-01-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: crass
@@ -44,70 +44,42 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.4.1
+        version: '1.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.4.1
+        version: '1.4'
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 5.6.0
+        version: 5.10.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 5.6.0
+        version: 5.10.2
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 10.4.2
+        version: 12.0.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 10.4.2
-- !ruby/object:Gem::Dependency
-  name: redcarpet
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 3.2.3
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 3.2.3
-- !ruby/object:Gem::Dependency
-  name: yard
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.8.7
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.8.7
+        version: 12.0.0
 description: Sanitize is a whitelist-based HTML and CSS sanitizer. Given a list of
   acceptable elements, attributes, and CSS properties, Sanitize will remove all unacceptable
   HTML and/or CSS from a string.
@@ -165,9 +137,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: 1.2.0
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.1
+rubygems_version: 2.7.3
 signing_key: 
 specification_version: 4
 summary: Whitelist-based HTML and CSS sanitizer.
 test_files: []
-has_rdoc: