sanitize 6.0.1 → 6.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 819d713b2d4a78519e8bd4f2f853d6558d93ffd2d0481e10d012d8f74afbb555
-  data.tar.gz: 04a48476bf940cfffc12654e71d60a95fd93c0576b6bec6870c2defb5b72fa90
+  metadata.gz: 10cf123f7eaed8a285ff4e7bae8505fb8a9af67dc523c3b5e4bd12a4dced17d6
+  data.tar.gz: bdf948795e0ddd9dd1ab4c725395e91e2862b7fd5a38260c41c698774a6c04c4
 SHA512:
-  metadata.gz: ed59ea47cc4a620ccf61be3443ef97036a877903bbc90fa855936e57446e34b92f5b9eb41ed9a026e17779fa473ce10d066986c1dd986c58381dae22bb7c9905
-  data.tar.gz: 27b40d2033ecd346c299bb77a7788b5325b79edd39c4767c9e5bf27486cf29bf2a5f3b34f96def645bbefd325b0e51a27182b75f187d2eb00931542769cd8c37
+  metadata.gz: 19865991970865b794d40c357464b40a34bc405a9c5e5426a7ea69d6435b38ece6bdeeca9e3c12c0abdd1869a7a3a814b11bd937d445c3d003a0174d22c80969
+  data.tar.gz: 641dbdbccc41c7e7d6765e8f1abdea8c16ace06e79233cca757a0a7018827340084f6417ec24469b8fab23363e82894526b3d9523e4dfc8cf089fcb5e164ec55

data/HISTORY.md

@@ -1,5 +1,30 @@
 # Sanitize History
 
+## 6.1.0 (2023-09-14)
+
+### Features
+
+* Added the `text-decoration-skip-ink` and `text-decoration-thickness` CSS properties to the relaxed config. [@martineriksson - #228][228]
+
+[228]:https://github.com/rgrove/sanitize/pull/228
+
+## 6.0.2 (2023-07-06)
+
+### Bug Fixes
+
+* CVE-2023-36823: Fixed an HTML+CSS sanitization bypass that could allow XSS
+  (cross-site scripting). This issue affects Sanitize versions 3.0.0 through
+  6.0.1.
+
+  When using Sanitize's relaxed config or a custom config that allows `<style>`
+  elements and one or more CSS at-rules, carefully crafted input could be used
+  to sneak arbitrary HTML through Sanitize.
+
+  See the following security advisory for additional details:
+  [GHSA-f5ww-cq3m-q3g7](https://github.com/rgrove/sanitize/security/advisories/GHSA-f5ww-cq3m-q3g7)
+
+  Thanks to @cure53 for finding this issue.
+
 ## 6.0.1 (2023-01-27)
 
 ### Bug Fixes

data/lib/sanitize/config/relaxed.rb

@@ -666,7 +666,9 @@ class Sanitize
           text-decoration-color
           text-decoration-line
           text-decoration-skip
+          text-decoration-skip-ink
           text-decoration-style
+          text-decoration-thickness
           text-emphasis
           text-emphasis-color
           text-emphasis-position

data/lib/sanitize/transformers/clean_css.rb

@@ -48,6 +48,7 @@ class CleanElement
     if css.strip.empty?
       node.unlink
     else
+      css.gsub!('</', '<\/')
       node.children.unlink
       node << Nokogiri::XML::Text.new(css, node.document)
     end

data/lib/sanitize/version.rb

@@ -1,5 +1,3 @@
-# encoding: utf-8
-
 class Sanitize
-  VERSION = '6.0.1'
+  VERSION = '6.1.0'
 end

data/test/test_malicious_css.rb

@@ -39,4 +39,17 @@ describe 'Malicious CSS' do
   it 'should not allow behaviors' do
     _(@s.properties(%[behavior: url(xss.htc);])).must_equal ''
   end
+
+  describe 'sanitization bypass via CSS at-rule in HTML <style> element' do
+    before do
+      @s = Sanitize.new(Sanitize::Config::RELAXED)
+    end
+
+    it 'is not possible to prematurely end a <style> element' do
+      assert_equal(
+        %[<style>@media<\\/style><iframe srcdoc='<script>alert(document.domain)<\\/script>'>{}</style>],
+        @s.fragment(%[<style>@media</sty/**/le><iframe srcdoc='<script>alert(document.domain)</script>'></style>])
+      )
+    end
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sanitize
 version: !ruby/object:Gem::Version
-  version: 6.0.1
+  version: 6.1.0
 platform: ruby
 authors:
 - Ryan Grove
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-01-27 00:00:00.000000000 Z
+date: 2023-09-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: crass
@@ -121,7 +121,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.2.0
 requirements: []
-rubygems_version: 3.4.1
+rubygems_version: 3.4.10
 signing_key:
 specification_version: 4
 summary: Allowlist-based HTML and CSS sanitizer.