RubyGems - sanitize - Versions diffs - 6.1.3 → 7.0.0 - Mend

sanitize 6.1.3 → 7.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (30) hide show

checksums.yaml +4 -4
data/{HISTORY.md → CHANGELOG.md} +32 -14
data/LICENSE +3 -1
data/README.md +120 -238
data/lib/sanitize/config/basic.rb +15 -15
data/lib/sanitize/config/default.rb +45 -45
data/lib/sanitize/config/relaxed.rb +136 -32
data/lib/sanitize/config/restricted.rb +2 -2
data/lib/sanitize/config.rb +12 -14
data/lib/sanitize/css.rb +308 -308
data/lib/sanitize/transformers/clean_cdata.rb +9 -9
data/lib/sanitize/transformers/clean_comment.rb +9 -9
data/lib/sanitize/transformers/clean_css.rb +59 -55
data/lib/sanitize/transformers/clean_doctype.rb +15 -15
data/lib/sanitize/transformers/clean_element.rb +220 -237
data/lib/sanitize/version.rb +3 -1
data/lib/sanitize.rb +38 -38
data/test/common.rb +4 -3
data/test/test_clean_comment.rb +26 -25
data/test/test_clean_css.rb +14 -13
data/test/test_clean_doctype.rb +21 -20
data/test/test_clean_element.rb +258 -273
data/test/test_config.rb +22 -21
data/test/test_malicious_css.rb +20 -19
data/test/test_malicious_html.rb +100 -99
data/test/test_parser.rb +26 -25
data/test/test_sanitize.rb +70 -69
data/test/test_sanitize_css.rb +149 -114
data/test/test_transformers.rb +81 -83
metadata +14 -43

data/lib/sanitize/transformers/clean_cdata.rb CHANGED Viewed

@@ -1,13 +1,13 @@
-# encoding: utf-8
+# frozen_string_literal: true
-class Sanitize; module Transformers
+class Sanitize
+  module Transformers
+    CleanCDATA = lambda do |env|
+      node = env[:node]
-  CleanCDATA = lambda do |env|
-    node = env[:node]
-    if node.type == Nokogiri::XML::Node::CDATA_SECTION_NODE
-      node.replace(Nokogiri::XML::Text.new(node.text, node.document))
+      if node.type == Nokogiri::XML::Node::CDATA_SECTION_NODE
+        node.replace(Nokogiri::XML::Text.new(node.text, node.document))
+      end
     end
   end
-end; end
+end

data/lib/sanitize/transformers/clean_comment.rb CHANGED Viewed

@@ -1,13 +1,13 @@
-# encoding: utf-8
+# frozen_string_literal: true
-class Sanitize; module Transformers
+class Sanitize
+  module Transformers
+    CleanComment = lambda do |env|
+      node = env[:node]
-  CleanComment = lambda do |env|
-    node = env[:node]
-    if node.type == Nokogiri::XML::Node::COMMENT_NODE
-      node.unlink unless env[:is_allowlisted]
+      if node.type == Nokogiri::XML::Node::COMMENT_NODE
+        node.unlink unless env[:is_allowlisted]
+      end
     end
   end
-end; end
+end

data/lib/sanitize/transformers/clean_css.rb CHANGED Viewed

@@ -1,58 +1,62 @@
-class Sanitize; module Transformers; module CSS
-# Enforces a CSS allowlist on the contents of `style` attributes.
-class CleanAttribute
-  def initialize(sanitizer_or_config)
-    if Sanitize::CSS === sanitizer_or_config
-      @scss = sanitizer_or_config
-    else
-      @scss = Sanitize::CSS.new(sanitizer_or_config)
-    end
-  end
-  def call(env)
-    node = env[:node]
-    return unless node.type == Nokogiri::XML::Node::ELEMENT_NODE &&
-        node.key?('style') && !env[:is_allowlisted]
-    attr = node.attribute('style')
-    css  = @scss.properties(attr.value)
-    if css.strip.empty?
-      attr.unlink
-    else
-      attr.value = css
+# frozen_string_literal: true
+class Sanitize
+  module Transformers
+    module CSS
+      # Enforces a CSS allowlist on the contents of `style` attributes.
+      class CleanAttribute
+        def initialize(sanitizer_or_config)
+          @scss = if Sanitize::CSS === sanitizer_or_config
+            sanitizer_or_config
+          else
+            Sanitize::CSS.new(sanitizer_or_config)
+          end
+        end
+        def call(env)
+          node = env[:node]
+          return unless node.type == Nokogiri::XML::Node::ELEMENT_NODE &&
+            node.key?("style") && !env[:is_allowlisted]
+          attr = node.attribute("style")
+          css = @scss.properties(attr.value)
+          if css.strip.empty?
+            attr.unlink
+          else
+            attr.value = css
+          end
+        end
+      end
+      # Enforces a CSS allowlist on the contents of `<style>` elements.
+      class CleanElement
+        def initialize(sanitizer_or_config)
+          @scss = if Sanitize::CSS === sanitizer_or_config
+            sanitizer_or_config
+          else
+            Sanitize::CSS.new(sanitizer_or_config)
+          end
+        end
+        def call(env)
+          node = env[:node]
+          return unless node.type == Nokogiri::XML::Node::ELEMENT_NODE &&
+            env[:node_name] == "style"
+          css = @scss.stylesheet(node.content)
+          if css.strip.empty?
+            node.unlink
+          else
+            css.gsub!("</", '<\/')
+            node.children.unlink
+            node << Nokogiri::XML::Text.new(css, node.document)
+          end
+        end
+      end
     end
   end
 end
-# Enforces a CSS allowlist on the contents of `<style>` elements.
-class CleanElement
-  def initialize(sanitizer_or_config)
-    if Sanitize::CSS === sanitizer_or_config
-      @scss = sanitizer_or_config
-    else
-      @scss = Sanitize::CSS.new(sanitizer_or_config)
-    end
-  end
-  def call(env)
-    node = env[:node]
-    return unless node.type == Nokogiri::XML::Node::ELEMENT_NODE &&
-        env[:node_name] == 'style'
-    css = @scss.stylesheet(node.content)
-    if css.strip.empty?
-      node.unlink
-    else
-      css.gsub!('</', '<\/')
-      node.children.unlink
-      node << Nokogiri::XML::Text.new(css, node.document)
-    end
-  end
-end
-end; end; end

data/lib/sanitize/transformers/clean_doctype.rb CHANGED Viewed

@@ -1,23 +1,23 @@
-# encoding: utf-8
+# frozen_string_literal: true
-class Sanitize; module Transformers
+class Sanitize
+  module Transformers
+    CleanDoctype = lambda do |env|
+      return if env[:is_allowlisted]
-  CleanDoctype = lambda do |env|
-    return if env[:is_allowlisted]
+      node = env[:node]
-    node = env[:node]
-    if node.type == Nokogiri::XML::Node::DTD_NODE
-      if env[:config][:allow_doctype]
-        if node.name != "html"
-          document = node.document
+      if node.type == Nokogiri::XML::Node::DTD_NODE
+        if env[:config][:allow_doctype]
+          if node.name != "html"
+            document = node.document
+            node.unlink
+            document.create_internal_subset("html", nil, nil)
+          end
+        else
           node.unlink
-          document.create_internal_subset("html", nil, nil)
         end
-      else
-        node.unlink
       end
     end
   end
-end; end
+end