sanitize 6.1.1 → 6.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ed64268ea99d49841046ad5977df0d4e622abe58a6374244bc9223631ee0ed95
-  data.tar.gz: eb614786ac3167798532bdfef07c2abd65d5a72928af487432c775d9c878024d
+  metadata.gz: 8811451060f77afcf698da8e589994af3c5683d08a0032a279f76b3b556b5f33
+  data.tar.gz: d2617a785428b5b99717ef1743cc75dc1f8c53bda53fea59050725a1218b5fe8
 SHA512:
-  metadata.gz: 176c443206f2880a84bca7d84a32a631e4237f5f3de4d69f45a9dcd80ba31999c7c7424c1ace1a09aa4566834a699e7ff149e956383ec91c2c98e7c63c01f3c6
-  data.tar.gz: f492268ae71a8109b4857f9dced29d3ed4e3897b39fe2cb4d12cd1459395b58197179b2e9cdd32175e281a5aea04a13fa741809040289dbe47391b7367e1397d
+  metadata.gz: 33b4b13b4369ba159031a1298bd5965b9dbe15921121b58d55155d3e717dd7cadf3495e10683613cd1439055f6d5a57249e540824fd9f98a11ae62db08167573
+  data.tar.gz: 40f149e0e3c51283b72332efb4598a81263fba029ea121ede31bb578634de339ed5c162fd49355601568c5cbc08f617879f058bcdfe5ce35afa6322e155cff8b

data/HISTORY.md

@@ -1,5 +1,21 @@
 # Sanitize History
 
+## 6.1.3 (2024-08-14)
+
+### Bug Fixes
+
+* The CSS URL protocol allowlist is now enforced on the nonstandard `-webkit-image-set` CSS function. [@ltk - #242][242]
+
+[242]:https://github.com/rgrove/sanitize/pull/242
+
+## 6.1.2 (2024-07-27)
+
+### Bug Fixes
+
+* The CSS URL protocol allowlist is now properly enforced in [CSS Images Module Level 4](https://drafts.csswg.org/css-images-4/) `image` and `image-set` functions. [@ltk - #240][240]
+
+[240]:https://github.com/rgrove/sanitize/pull/240
+
 ## 6.1.1 (2024-06-12)
 
 ### Bug Fixes

data/lib/sanitize/css.rb

@@ -229,6 +229,12 @@ class Sanitize; class CSS
     rule
   end
 
+  # Returns `true` if the given CSS function name is an image-related function
+  # that may contain image URLs that need to be validated.
+  def image_function?(name)
+    ['image', 'image-set', '-webkit-image-set'].include?(name)
+  end
+
   # Passes the URL value of an @import rule to a block to ensure
   # it's an allowed URL
   def import_url_allowed?(rule)
@@ -272,6 +278,10 @@ class Sanitize; class CSS
             return nil unless valid_url?(child)
           end
 
+          if image_function?(name)
+            return nil unless valid_image?(child)
+          end
+
           combined_value << name
           return nil if name == 'expression' || combined_value == 'expression'
         end
@@ -345,4 +355,27 @@ class Sanitize; class CSS
     false
   end
 
+  # Returns `true` if the given node is an image-related function and contains
+  # only strings that use an allowlisted protocol.
+  def valid_image?(node)
+    return false unless node[:node] == :function
+    return false unless node.key?(:name) && image_function?(node[:name].downcase)
+    return false unless Array === node[:value]
+
+    node[:value].each do |token|
+        return false unless Hash === token
+
+        case token[:node]
+          when :string
+            if token[:value] =~ Sanitize::REGEX_PROTOCOL
+              return false unless @config[:protocols].include?($1.downcase)
+            else
+              return false unless @config[:protocols].include?(:relative)
+            end
+          else
+            next
+        end
+      end
+  end
+
 end; end

data/lib/sanitize/version.rb

@@ -1,3 +1,3 @@
 class Sanitize
-  VERSION = '6.1.1'
+  VERSION = '6.1.3'
 end

data/test/test_sanitize_css.rb

@@ -29,6 +29,15 @@ describe 'Sanitize::CSS' do
           "background: url('ht\\tp://example.com/http.jpg')",
           "background: url(https://example.com/https.jpg)",
           "background: url('https://example.com/https.jpg')",
+          "background: image-set('relative.jpg' 1x, 'relative-2x.jpg' 2x)",
+          "background: image-set('https://example.com/https.jpg' 1x, 'https://example.com/https-2x.jpg' 2x)",
+          "background: image-set('https://example.com/https.jpg' type('image/jpeg'), 'https://example.com/https.avif' type('image/avif'))",
+          "background: -webkit-image-set('relative.jpg' 1x, 'relative-2x.jpg' 2x)",
+          "background: -webkit-image-set('https://example.com/https.jpg' 1x, 'https://example.com/https-2x.jpg' 2x)",
+          "background: -webkit-image-set('https://example.com/https.jpg' type('image/jpeg'), 'https://example.com/https.avif' type('image/avif'))",
+          "background: image('relative.jpg');",
+          "background: image('https://example.com/https.jpg');",
+          "background: image(rtl 'https://example.com/https.jpg');"
         ].each do |css|
           _(@default.properties(css)).must_equal ''
           _(@relaxed.properties(css)).must_equal css

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sanitize
 version: !ruby/object:Gem::Version
-  version: 6.1.1
+  version: 6.1.3
 platform: ruby
 authors:
 - Ryan Grove
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-06-13 00:00:00.000000000 Z
+date: 2024-08-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: crass