sanitize 6.1.3 → 7.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8811451060f77afcf698da8e589994af3c5683d08a0032a279f76b3b556b5f33
-  data.tar.gz: d2617a785428b5b99717ef1743cc75dc1f8c53bda53fea59050725a1218b5fe8
+  metadata.gz: 694fdddd1e40857325f7fac61ee5679e6a9fca926413c1b035062ab7449b92c7
+  data.tar.gz: 426f1b4ece2fe0514139b661ba77ca7b9a6196481a0759a3ac81a9f446996e3d
 SHA512:
-  metadata.gz: 33b4b13b4369ba159031a1298bd5965b9dbe15921121b58d55155d3e717dd7cadf3495e10683613cd1439055f6d5a57249e540824fd9f98a11ae62db08167573
-  data.tar.gz: 40f149e0e3c51283b72332efb4598a81263fba029ea121ede31bb578634de339ed5c162fd49355601568c5cbc08f617879f058bcdfe5ce35afa6322e155cff8b
+  metadata.gz: 3e58a303bb8a1285fbc75ab93acfd896444dc125d3b9b13884868366720bc451e5c69409b9a852014394604bc932e0ffbeeb7c1b7192eb3cd0a673ec10a79df2
+  data.tar.gz: 8a4b8ca81da4bc4bb070941fab4b08f8e6d36a10487d0d90820e762155fe5717acfbc919c2676650d490cd7d9cac82f7a2f4ec21bc0f373f837938a23a670d6d

data/{HISTORY.md → CHANGELOG.md}

@@ -1,4 +1,42 @@
-# Sanitize History
+# Sanitize Changelog
+
+All notable changes to Sanitize are documented in this file. The format (since version 7.0.0) is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## 7.0.1 (2026-10-21)
+
+### Security
+
+- CSS properties that contain a `{}` block anywhere in their value are now removed. Browsers that support [CSS nesting](https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_nesting) reparse an invalid declaration containing a `{}` block as a nested style rule, so a value like `color:hover{position:fixed}` could previously be used to smuggle disallowed properties and URLs past Sanitize in a stylesheet or `<style>` element. (GHSA-wgw9-qhqg-8hv5)
+
+- The contents of at-rules such as `@media` and `@supports` that appear in a list of declarations (inside a style rule, inside an at-rule like `@font-face`, or in CSS sanitized with `Sanitize::CSS.properties`) are now sanitized as declarations rather than as rules, matching how browsers that support CSS nesting parse them. Previously, a stylesheet like `p{@media all{position:fixed;a{}}}` could be used to smuggle disallowed properties and URLs past Sanitize, since Sanitize treated `position:fixed;a` as a style rule's selector. The same was true of CSS sanitized with `Sanitize::CSS.properties` if the result was later embedded in a style rule. Style rules nested inside these at-rules are now removed, just as style rules nested directly inside other style rules already were. (GHSA-wgw9-qhqg-8hv5)
+
+- CSS properties, style rules, and at-rules that contain blocks or functions nested more deeply than Crass's maximum nesting depth (25 levels by default) are now removed. (GHSA-wgw9-qhqg-8hv5)
+
+- Hardened CSS sanitization against tokenizer differentials involving bad URLs. CSS properties that contain a bad URL anywhere inside a simple block (such as `[...]` or `(...)`) are now removed, as are style rules whose selectors contain a bad URL and at-rules whose preludes contain a bad URL. URLs inside simple blocks are now also validated against the configured protocol allowlist. Previously, a bug in Crass (fixed in Crass 1.0.8) could be exploited to smuggle CSS declarations, rules, or at-rules past Sanitize by hiding them in a bad URL in one of these locations.
+
+- CSS style rules whose selectors contain a semicolon are now removed, as a defense in depth measure. A semicolon is never valid in a selector, but when a style rule appears where a browser that supports CSS nesting expects declarations, the browser treats everything before the semicolon as a declaration. This could be used to smuggle disallowed properties past `Sanitize::CSS.tree!` when it was given a list of declarations rather than a list of rules (though this isn't something Sanitize itself does).
+
+### Fixed
+
+- Removed an unused `require "cgi"` that caused a warning on Ruby 4.0, since the CGI library is no longer part of Ruby's standard library.
+
+## 7.0.0 (2024-12-29)
+
+Sanitize has no breaking API changes in this release, but the major version number has been incremented because we've dropped support for end-of-life versions of Ruby. As long as you're using Ruby 3.1.0 or later, this should be a painless upgrade!
+
+### Added
+
+- Added over 100 new CSS properties to the relaxed config, representing all properties that are listed with a status of "Working Draft" or better in the latest [W3C "All Properties" list](https://www.w3.org/Style/CSS/all-properties.en.html).
+
+- Added the `@container` CSS at-rule to the relaxed config.
+
+- Added the `-webkit-text-fill-color` CSS property to the relaxed config. [@radar - #244](https://github.com/rgrove/sanitize/pull/244)
+
+### Changed
+
+- Ruby 3.1.0 is now the oldest supported Ruby version.
+
+- Sanitize now requires Nokogiri 1.16.8 or higher.
 
 ## 6.1.3 (2024-08-14)
 
@@ -279,8 +317,6 @@ review the changes below carefully.
   Many thanks to the Shopify Application Security Team for responsibly reporting
   this issue.
 
-[176]:https://github.com/rgrove/sanitize/issues/176
-
 ## 4.6.2 (2018-03-19)
 
 * Reduced string allocations to optimize memory usage. [@janklimo - #175][175]
@@ -618,7 +654,7 @@ Sanitize.fragment(html, Sanitize::Config.merge(Sanitize::Config::BASIC,
 ## 2.0.4 (2013-06-12)
 
 * Added `Sanitize.clean_document`, which sanitizes a full HTML document rather
-  than just a fragment. [Ben Anderson]
+  than just a fragment. \[Ben Anderson]
 
 * Nokogiri dependency bumped to 1.6.x.
 
@@ -641,7 +677,7 @@ Sanitize.fragment(html, Sanitize::Config.merge(Sanitize::Config::BASIC,
 ## 2.0.1 (2011-03-16)
 
 * Updated the protocol regex to anchor at the beginning of the string rather
-  than the beginning of a line. [Eaden McKee]
+  than the beginning of a line. \[Eaden McKee]
 
 
 ## 2.0.0 (2011-01-15)
@@ -687,7 +723,7 @@ Sanitize.fragment(html, Sanitize::Config.merge(Sanitize::Config::BASIC,
   remove the contents of all non-allowlisted elements in addition to the
   elements themselves. If set to an array of element names, Sanitize will
   remove the contents of only those elements (when filtered), and leave the
-  contents of other filtered elements. [Thanks to Rafael Souza for the array
+  contents of other filtered elements. \[Thanks to Rafael Souza for the array
   option]
 
 * Added an `:output_encoding` config setting to allow the character encoding
@@ -712,27 +748,27 @@ Sanitize.fragment(html, Sanitize::Config.merge(Sanitize::Config::BASIC,
 * Added `Sanitize.clean_node!`, which sanitizes a `Nokogiri::XML::Node` and
   all its children.
 
-* Added elements `<h1>` through `<h6>` to the Relaxed allowlist. [Suggested by
+* Added elements `<h1>` through `<h6>` to the Relaxed allowlist. \[Suggested by
   David Reese]
 
 
 ## 1.1.0 (2009-10-11)
 
-* Migrated from Hpricot to Nokogiri. Requires libxml2 >= 2.7.2 [Adam Hooper]
+* Migrated from Hpricot to Nokogiri. Requires libxml2 >= 2.7.2 \[Adam Hooper]
 
 * Added an `:output` config setting to allow the output format to be
   specified. Supported formats are `:xhtml` (the default) and `:html` (which
   outputs HTML4).
 
 * Changed protocol regex to ensure Sanitize doesn't kill URLs with colons in
-  path segments. [Peter Cooper]
+  path segments. \[Peter Cooper]
 
 
 ## 1.0.8 (2009-04-23)
 
 * Added a workaround for an Hpricot bug that prevents attribute names from
   being downcased in recent versions of Hpricot. This was exploitable to
-  prevent non-allowlisted protocols from being cleaned. [Reported by Ben
+  prevent non-allowlisted protocols from being cleaned. \[Reported by Ben
   Wanicur]
 
 
@@ -741,7 +777,7 @@ Sanitize.fragment(html, Sanitize::Config.merge(Sanitize::Config::BASIC,
 * Requires Hpricot 0.8.1+, which is finally compatible with Ruby 1.9.1.
 
 * Fixed a bug that caused named character entities containing digits (like
-  `&sup2;`) to be escaped when they shouldn't have been. [Reported by
+  `&sup2;`) to be escaped when they shouldn't have been. \[Reported by
   Sebastian Steinmetz]
 
 
@@ -756,14 +792,14 @@ Sanitize.fragment(html, Sanitize::Config.merge(Sanitize::Config::BASIC,
   problems in IE6.
 
 * You can now specify the symbol `:all` in place of an element name in the
-  attributes config hash to allow certain attributes on all elements. [Thanks
+  attributes config hash to allow certain attributes on all elements. \[Thanks
   to Mutwin Kraus]
 
 
 ## 1.0.5 (2009-02-05)
 
 * Fixed a bug introduced in version 1.0.3 that prevented non-allowlisted
-  protocols from being cleaned when relative URLs were allowed. [Reported by
+  protocols from being cleaned when relative URLs were allowed. \[Reported by
   Dev Purkayastha]
 
 * Fixed "undefined method `parent='" exceptions caused by parser changes in
@@ -774,7 +810,7 @@ Sanitize.fragment(html, Sanitize::Config.merge(Sanitize::Config::BASIC,
 
 * Fixed a bug that made it possible to sneak a non-allowlisted element through
   by repeating it several times in a row. All versions of Sanitize prior to
-  1.0.4 are vulnerable. [Reported by Cristobal]
+  1.0.4 are vulnerable. \[Reported by Cristobal]
 
 
 ## 1.0.3 (2009-01-15)

data/LICENSE

@@ -1,4 +1,6 @@
-Copyright (c) 2021 Ryan Grove <ryan@wonko.com>
+MIT License
+
+Copyright Ryan Grove <ryan@wonko.com>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the 'Software'), to deal in