sanitize 6.0.2 → 7.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 93adca1e155370d138ccb7c500b618e2ed218297d21593ec8937638f4d99731b
-  data.tar.gz: 740b6d84113a0945928601b6cad03e36b4ee76f7c3098c72ddb1a1b01ec5d0ec
+  metadata.gz: c7ec07b16780ba818a5fdbb0570fb6c84245c60b2656388cab0b03b0d00bbc6a
+  data.tar.gz: 650c2a0c59fd4af1d305051e5488bcacee3f5a638a96960163f6677b838a9661
 SHA512:
-  metadata.gz: 4d3e9852ec92ac961c2e35d4a04e7d967dd2eac364e656837b93daf95c1b653da53d4ef7f104af83887e46d08237ddca1efa945facde3efbfcfce0164c0fe334
-  data.tar.gz: 05a56334e5cdbbee7b165b19245b90a8acdd82bcd72bbc9f84e2780d914f8b040d19d9ff71934b0c1bd71df4b55f407f460c76dffdbd275b183ecaffb2fa6c38
+  metadata.gz: ec33f841766422dda2ee1d889d2e3f42f6b3b479c2cf557cad80de0311969a4e132e02a5a33dda296af2e2a5fec8791aa6ba8eacd6ea370428cc40ff3f08a720
+  data.tar.gz: f4cf669dba8e416c38fb4b9eae30b86e9c7816718e80cc32eac1f536f1e2023c59cb74df7e701af717a157e1fe1ccc902a89b26992488a85400e4dc0c089d07a

data/{HISTORY.md → CHANGELOG.md}

@@ -1,4 +1,56 @@
-# Sanitize History
+# Sanitize Changelog
+
+All notable changes to Sanitize are documented in this file. The format (since version 7.0.0) is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## 7.0.0 (2024-12-29)
+
+Sanitize has no breaking API changes in this release, but the major version number has been incremented because we've dropped support for end-of-life versions of Ruby. As long as you're using Ruby 3.1.0 or later, this should be a painless upgrade!
+
+### Added
+
+- Added over 100 new CSS properties to the relaxed config, representing all properties that are listed with a status of "Working Draft" or better in the latest [W3C "All Properties" list](https://www.w3.org/Style/CSS/all-properties.en.html).
+
+- Added the `@container` CSS at-rule to the relaxed config.
+
+- Added the `-webkit-text-fill-color` CSS property to the relaxed config. [@radar - #244](https://github.com/rgrove/sanitize/pull/244)
+
+### Changed
+
+- Ruby 3.1.0 is now the oldest supported Ruby version.
+
+- Sanitize now requires Nokogiri 1.16.8 or higher.
+
+## 6.1.3 (2024-08-14)
+
+### Bug Fixes
+
+* The CSS URL protocol allowlist is now enforced on the nonstandard `-webkit-image-set` CSS function. [@ltk - #242][242]
+
+[242]:https://github.com/rgrove/sanitize/pull/242
+
+## 6.1.2 (2024-07-27)
+
+### Bug Fixes
+
+* The CSS URL protocol allowlist is now properly enforced in [CSS Images Module Level 4](https://drafts.csswg.org/css-images-4/) `image` and `image-set` functions. [@ltk - #240][240]
+
+[240]:https://github.com/rgrove/sanitize/pull/240
+
+## 6.1.1 (2024-06-12)
+
+### Bug Fixes
+
+* Proactively fixed a compatibility issue with libxml >= 2.13.0 (which will be used in an upcoming version of Nokogiri) that caused HTML doctype sanitization to fail. [@flavorjones - #238][238]
+
+[238]:https://github.com/rgrove/sanitize/pull/238
+
+## 6.1.0 (2023-09-14)
+
+### Features
+
+* Added the `text-decoration-skip-ink` and `text-decoration-thickness` CSS properties to the relaxed config. [@martineriksson - #228][228]
+
+[228]:https://github.com/rgrove/sanitize/pull/228
 
 ## 6.0.2 (2023-07-06)
 
@@ -247,8 +299,6 @@ review the changes below carefully.
   Many thanks to the Shopify Application Security Team for responsibly reporting
   this issue.
 
-[176]:https://github.com/rgrove/sanitize/issues/176
-
 ## 4.6.2 (2018-03-19)
 
 * Reduced string allocations to optimize memory usage. [@janklimo - #175][175]
@@ -586,7 +636,7 @@ Sanitize.fragment(html, Sanitize::Config.merge(Sanitize::Config::BASIC,
 ## 2.0.4 (2013-06-12)
 
 * Added `Sanitize.clean_document`, which sanitizes a full HTML document rather
-  than just a fragment. [Ben Anderson]
+  than just a fragment. \[Ben Anderson]
 
 * Nokogiri dependency bumped to 1.6.x.
 
@@ -609,7 +659,7 @@ Sanitize.fragment(html, Sanitize::Config.merge(Sanitize::Config::BASIC,
 ## 2.0.1 (2011-03-16)
 
 * Updated the protocol regex to anchor at the beginning of the string rather
-  than the beginning of a line. [Eaden McKee]
+  than the beginning of a line. \[Eaden McKee]
 
 
 ## 2.0.0 (2011-01-15)
@@ -655,7 +705,7 @@ Sanitize.fragment(html, Sanitize::Config.merge(Sanitize::Config::BASIC,
   remove the contents of all non-allowlisted elements in addition to the
   elements themselves. If set to an array of element names, Sanitize will
   remove the contents of only those elements (when filtered), and leave the
-  contents of other filtered elements. [Thanks to Rafael Souza for the array
+  contents of other filtered elements. \[Thanks to Rafael Souza for the array
   option]
 
 * Added an `:output_encoding` config setting to allow the character encoding
@@ -680,27 +730,27 @@ Sanitize.fragment(html, Sanitize::Config.merge(Sanitize::Config::BASIC,
 * Added `Sanitize.clean_node!`, which sanitizes a `Nokogiri::XML::Node` and
   all its children.
 
-* Added elements `<h1>` through `<h6>` to the Relaxed allowlist. [Suggested by
+* Added elements `<h1>` through `<h6>` to the Relaxed allowlist. \[Suggested by
   David Reese]
 
 
 ## 1.1.0 (2009-10-11)
 
-* Migrated from Hpricot to Nokogiri. Requires libxml2 >= 2.7.2 [Adam Hooper]
+* Migrated from Hpricot to Nokogiri. Requires libxml2 >= 2.7.2 \[Adam Hooper]
 
 * Added an `:output` config setting to allow the output format to be
   specified. Supported formats are `:xhtml` (the default) and `:html` (which
   outputs HTML4).
 
 * Changed protocol regex to ensure Sanitize doesn't kill URLs with colons in
-  path segments. [Peter Cooper]
+  path segments. \[Peter Cooper]
 
 
 ## 1.0.8 (2009-04-23)
 
 * Added a workaround for an Hpricot bug that prevents attribute names from
   being downcased in recent versions of Hpricot. This was exploitable to
-  prevent non-allowlisted protocols from being cleaned. [Reported by Ben
+  prevent non-allowlisted protocols from being cleaned. \[Reported by Ben
   Wanicur]
 
 
@@ -709,7 +759,7 @@ Sanitize.fragment(html, Sanitize::Config.merge(Sanitize::Config::BASIC,
 * Requires Hpricot 0.8.1+, which is finally compatible with Ruby 1.9.1.
 
 * Fixed a bug that caused named character entities containing digits (like
-  `&sup2;`) to be escaped when they shouldn't have been. [Reported by
+  `&sup2;`) to be escaped when they shouldn't have been. \[Reported by
   Sebastian Steinmetz]
 
 
@@ -724,14 +774,14 @@ Sanitize.fragment(html, Sanitize::Config.merge(Sanitize::Config::BASIC,
   problems in IE6.
 
 * You can now specify the symbol `:all` in place of an element name in the
-  attributes config hash to allow certain attributes on all elements. [Thanks
+  attributes config hash to allow certain attributes on all elements. \[Thanks
   to Mutwin Kraus]
 
 
 ## 1.0.5 (2009-02-05)
 
 * Fixed a bug introduced in version 1.0.3 that prevented non-allowlisted
-  protocols from being cleaned when relative URLs were allowed. [Reported by
+  protocols from being cleaned when relative URLs were allowed. \[Reported by
   Dev Purkayastha]
 
 * Fixed "undefined method `parent='" exceptions caused by parser changes in
@@ -742,7 +792,7 @@ Sanitize.fragment(html, Sanitize::Config.merge(Sanitize::Config::BASIC,
 
 * Fixed a bug that made it possible to sneak a non-allowlisted element through
   by repeating it several times in a row. All versions of Sanitize prior to
-  1.0.4 are vulnerable. [Reported by Cristobal]
+  1.0.4 are vulnerable. \[Reported by Cristobal]
 
 
 ## 1.0.3 (2009-01-15)

data/LICENSE

@@ -1,4 +1,6 @@
-Copyright (c) 2021 Ryan Grove <ryan@wonko.com>
+MIT License
+
+Copyright Ryan Grove <ryan@wonko.com>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the 'Software'), to deal in