sanitize 6.1.3 → 7.0.1

data/lib/sanitize/css.rb

@@ -1,331 +1,428 @@
-# encoding: utf-8
-
-require 'crass'
-require 'set'
-
-class Sanitize; class CSS
-  attr_reader :config
-
-  # -- Class Methods -----------------------------------------------------------
-
-  # Sanitizes inline CSS style properties.
-  #
-  # This is most useful for sanitizing non-stylesheet fragments of CSS like you
-  # would find in the `style` attribute of an HTML element. To sanitize a full
-  # CSS stylesheet, use {.stylesheet}.
-  #
-  # @example
-  #   Sanitize::CSS.properties("background: url(foo.png); color: #fff;")
-  #
-  # @return [String] Sanitized CSS properties.
-  def self.properties(css, config = {})
-    self.new(config).properties(css)
-  end
+# frozen_string_literal: true
+
+require "crass"
+require "set"
+
+class Sanitize
+  class CSS
+    attr_reader :config
+
+    # -- Class Methods ---------------------------------------------------------
+
+    # Sanitizes inline CSS style properties.
+    #
+    # This is most useful for sanitizing non-stylesheet fragments of CSS like
+    # you would find in the `style` attribute of an HTML element. To sanitize a
+    # full CSS stylesheet, use {.stylesheet}.
+    #
+    # @example
+    #   Sanitize::CSS.properties("background: url(foo.png); color: #fff;")
+    #
+    # @return [String] Sanitized CSS properties.
+    def self.properties(css, config = {})
+      new(config).properties(css)
+    end
 
-  # Sanitizes a full CSS stylesheet.
-  #
-  # A stylesheet may include selectors, at-rules, and comments. To sanitize only
-  # inline style properties such as the contents of an HTML `style` attribute,
-  # use {.properties}.
-  #
-  # @example
-  #   css = %[
-  #     .foo {
-  #       background: url(foo.png);
-  #       color: #fff;
-  #     }
-  #
-  #     #bar {
-  #       font: 42pt 'Comic Sans MS';
-  #     }
-  #   ]
-  #
-  #   Sanitize::CSS.stylesheet(css, Sanitize::Config::RELAXED)
-  #
-  # @return [String] Sanitized CSS stylesheet.
-  def self.stylesheet(css, config = {})
-    self.new(config).stylesheet(css)
-  end
+    # Sanitizes a full CSS stylesheet.
+    #
+    # A stylesheet may include selectors, at-rules, and comments. To sanitize
+    # only inline style properties such as the contents of an HTML `style`
+    # attribute, use {.properties}.
+    #
+    # @example
+    #   css = %[
+    #     .foo {
+    #       background: url(foo.png);
+    #       color: #fff;
+    #     }
+    #
+    #     #bar {
+    #       font: 42pt 'Comic Sans MS';
+    #     }
+    #   ]
+    #
+    #   Sanitize::CSS.stylesheet(css, Sanitize::Config::RELAXED)
+    #
+    # @return [String] Sanitized CSS stylesheet.
+    def self.stylesheet(css, config = {})
+      new(config).stylesheet(css)
+    end
 
-  # Sanitizes the given Crass CSS parse tree and all its children, modifying it
-  # in place.
-  #
-  # @example
-  #   css = %[
-  #     .foo {
-  #       background: url(foo.png);
-  #       color: #fff;
-  #     }
-  #
-  #     #bar {
-  #       font: 42pt 'Comic Sans MS';
-  #     }
-  #   ]
-  #
-  #   tree = Crass.parse(css)
-  #   Sanitize::CSS.tree!(tree, Sanitize::Config::RELAXED)
-  #
-  # @return [Array] Sanitized Crass CSS parse tree.
-  def self.tree!(tree, config = {})
-    self.new(config).tree!(tree)
-  end
+    # Sanitizes the given Crass CSS parse tree and all its children, modifying
+    # it in place.
+    #
+    # @example
+    #   css = %[
+    #     .foo {
+    #       background: url(foo.png);
+    #       color: #fff;
+    #     }
+    #
+    #     #bar {
+    #       font: 42pt 'Comic Sans MS';
+    #     }
+    #   ]
+    #
+    #   tree = Crass.parse(css)
+    #   Sanitize::CSS.tree!(tree, Sanitize::Config::RELAXED)
+    #
+    # The tree must be a list of rules, such as the tree returned by
+    # `Crass.parse`. To sanitize a list of declarations, such as the contents
+    # of an HTML `style` attribute, use {.properties}.
+    #
+    # @return [Array] Sanitized Crass CSS parse tree.
+    def self.tree!(tree, config = {})
+      new(config).tree!(tree)
+    end
 
-  # -- Instance Methods --------------------------------------------------------
+    # -- Instance Methods ------------------------------------------------------
 
-  # Returns a new Sanitize::CSS object initialized with the settings in
-  # _config_.
-  def initialize(config = {})
-    @config = Config.merge(Config::DEFAULT[:css], config[:css] || config)
+    # Returns a new Sanitize::CSS object initialized with the settings in
+    # _config_.
+    def initialize(config = {})
+      @config = Config.merge(Config::DEFAULT[:css], config[:css] || config)
 
-    @at_rules                 = Set.new(@config[:at_rules])
-    @at_rules_with_properties = Set.new(@config[:at_rules_with_properties])
-    @at_rules_with_styles     = Set.new(@config[:at_rules_with_styles])
-    @import_url_validator     = @config[:import_url_validator]
-  end
+      @at_rules = Set.new(@config[:at_rules])
+      @at_rules_with_properties = Set.new(@config[:at_rules_with_properties])
+      @at_rules_with_styles = Set.new(@config[:at_rules_with_styles])
+      @import_url_validator = @config[:import_url_validator]
 
-  # Sanitizes inline CSS style properties.
-  #
-  # This is most useful for sanitizing non-stylesheet fragments of CSS like you
-  # would find in the `style` attribute of an HTML element. To sanitize a full
-  # CSS stylesheet, use {#stylesheet}.
-  #
-  # @example
-  #   scss = Sanitize::CSS.new(Sanitize::Config::RELAXED)
-  #   scss.properties("background: url(foo.png); color: #fff;")
-  #
-  # @return [String] Sanitized CSS properties.
-  def properties(css)
-    tree = Crass.parse_properties(css,
-      :preserve_comments => @config[:allow_comments],
-      :preserve_hacks    => @config[:allow_hacks])
-
-    tree!(tree)
-    Crass::Parser.stringify(tree)
-  end
+      @parse_options = {
+        preserve_comments: @config[:allow_comments],
+        preserve_hacks: @config[:allow_hacks]
+      }.freeze
+    end
 
-  # Sanitizes a full CSS stylesheet.
-  #
-  # A stylesheet may include selectors, at-rules, and comments. To sanitize only
-  # inline style properties such as the contents of an HTML `style` attribute,
-  # use {#properties}.
-  #
-  # @example
-  #   css = %[
-  #     .foo {
-  #       background: url(foo.png);
-  #       color: #fff;
-  #     }
-  #
-  #     #bar {
-  #       font: 42pt 'Comic Sans MS';
-  #     }
-  #   ]
-  #
-  #   scss = Sanitize::CSS.new(Sanitize::Config::RELAXED)
-  #   scss.stylesheet(css)
-  #
-  # @return [String] Sanitized CSS stylesheet.
-  def stylesheet(css)
-    tree = Crass.parse(css,
-      :preserve_comments => @config[:allow_comments],
-      :preserve_hacks    => @config[:allow_hacks])
-
-    tree!(tree)
-    Crass::Parser.stringify(tree)
-  end
+    # Sanitizes inline CSS style properties.
+    #
+    # This is most useful for sanitizing non-stylesheet fragments of CSS like
+    # you would find in the `style` attribute of an HTML element. To sanitize a
+    # full CSS stylesheet, use {#stylesheet}.
+    #
+    # @example
+    #   scss = Sanitize::CSS.new(Sanitize::Config::RELAXED)
+    #   scss.properties("background: url(foo.png); color: #fff;")
+    #
+    # @return [String] Sanitized CSS properties.
+    def properties(css)
+      tree = Crass.parse_properties(css, @parse_options)
+      sanitize_tree!(tree, declarations: true)
+      Crass::Parser.stringify(tree)
+    end
 
-  # Sanitizes the given Crass CSS parse tree and all its children, modifying it
-  # in place.
-  #
-  # @example
-  #   css = %[
-  #     .foo {
-  #       background: url(foo.png);
-  #       color: #fff;
-  #     }
-  #
-  #     #bar {
-  #       font: 42pt 'Comic Sans MS';
-  #     }
-  #   ]
-  #
-  #   scss = Sanitize::CSS.new(Sanitize::Config::RELAXED)
-  #   tree = Crass.parse(css)
-  #
-  #   scss.tree!(tree)
-  #
-  # @return [Array] Sanitized Crass CSS parse tree.
-  def tree!(tree)
-    preceded_by_property = false
-
-    tree.map! do |node|
-      next nil if node.nil?
-
-      case node[:node]
-      when :at_rule
-        preceded_by_property = false
-        next at_rule!(node)
-
-      when :comment
-        next node if @config[:allow_comments]
-
-      when :property
-        prop = property!(node)
-        preceded_by_property = !prop.nil?
-        next prop
-
-      when :semicolon
-        # Only preserve the semicolon if it was preceded by an allowlisted
-        # property. Otherwise, omit it in order to prevent redundant semicolons.
-        if preceded_by_property
-          preceded_by_property = false
-          next node
+    # Sanitizes a full CSS stylesheet.
+    #
+    # A stylesheet may include selectors, at-rules, and comments. To sanitize
+    # only inline style properties such as the contents of an HTML `style`
+    # attribute, use {#properties}.
+    #
+    # @example
+    #   css = %[
+    #     .foo {
+    #       background: url(foo.png);
+    #       color: #fff;
+    #     }
+    #
+    #     #bar {
+    #       font: 42pt 'Comic Sans MS';
+    #     }
+    #   ]
+    #
+    #   scss = Sanitize::CSS.new(Sanitize::Config::RELAXED)
+    #   scss.stylesheet(css)
+    #
+    # @return [String] Sanitized CSS stylesheet.
+    def stylesheet(css)
+      tree = Crass.parse(css, @parse_options)
+      tree!(tree)
+      Crass::Parser.stringify(tree)
+    end
+
+    # Sanitizes the given Crass CSS parse tree and all its children, modifying
+    # it in place.
+    #
+    # @example
+    #   css = %[
+    #     .foo {
+    #       background: url(foo.png);
+    #       color: #fff;
+    #     }
+    #
+    #     #bar {
+    #       font: 42pt 'Comic Sans MS';
+    #     }
+    #   ]
+    #
+    #   scss = Sanitize::CSS.new(Sanitize::Config::RELAXED)
+    #   tree = Crass.parse(css)
+    #
+    #   scss.tree!(tree)
+    #
+    # The tree must be a list of rules, such as the tree returned by
+    # `Crass.parse`. To sanitize a list of declarations, such as the contents
+    # of an HTML `style` attribute, use {#properties}.
+    #
+    # @return [Array] Sanitized Crass CSS parse tree.
+    def tree!(tree)
+      sanitize_tree!(tree, declarations: false)
+    end
+
+    # -- Protected Instance Methods --------------------------------------------
+    protected
+
+    # Sanitizes a CSS at-rule node. Returns the sanitized node, or `nil` if the
+    # current config doesn't allow this at-rule.
+    #
+    # If _declarations_ is `true`, the at-rule appears in a list of
+    # declarations (such as the contents of a style rule) rather than in a list
+    # of rules.
+    def at_rule!(rule, declarations:)
+      name = rule[:name].downcase
+
+      return nil if contains_invalid_node?(rule[:prelude])
+
+      if @at_rules_with_styles.include?(name)
+        # Browsers that support CSS nesting parse the block of an at-rule like
+        # `@media` that appears in a list of declarations as more declarations
+        # rather than as rules, so it must be sanitized as declarations.
+        # Otherwise a declaration like `position:fixed;a{}` would be parsed as
+        # a style rule with the selector `position:fixed;a` and would bypass
+        # the property allowlist.
+        styles = if declarations
+          Crass::Parser.parse_properties(rule[:block], @parse_options)
+        else
+          Crass::Parser.parse_rules(rule[:block], @parse_options)
         end
 
-      when :style_rule
-        preceded_by_property = false
-        tree!(node[:children])
-        next node
+        rule[:block] = sanitize_tree!(styles, declarations: declarations)
+
+      elsif @at_rules_with_properties.include?(name)
+        props = Crass::Parser.parse_properties(rule[:block], @parse_options)
+        rule[:block] = sanitize_tree!(props, declarations: true)
 
-      when :whitespace
-        next node
+      elsif @at_rules.include?(name)
+        return nil if name == "import" && !import_url_allowed?(rule)
+        return nil if rule.has_key?(:block)
+      else
+        return nil
       end
 
-      nil
+      rule
     end
 
-    tree
-  end
-
-  # -- Protected Instance Methods ----------------------------------------------
-  protected
+    # Returns `true` if the given array of Crass nodes contains an invalid node
+    # (see {#invalid_node?}) at any depth.
+    def contains_invalid_node?(nodes)
+      contains_node?(nodes) { |node| invalid_node?(node) }
+    end
 
-  # Sanitizes a CSS at-rule node. Returns the sanitized node, or `nil` if the
-  # current config doesn't allow this at-rule.
-  def at_rule!(rule)
-    name = rule[:name].downcase
+    # Returns `true` if the given array of Crass nodes contains a node at any
+    # depth for which the given block returns a truthy value.
+    def contains_node?(nodes)
+      return false unless Array === nodes
 
-    if @at_rules_with_styles.include?(name)
-      styles = Crass::Parser.parse_rules(rule[:block],
-        :preserve_comments => @config[:allow_comments],
-        :preserve_hacks    => @config[:allow_hacks])
+      stack = nodes.dup
 
-      rule[:block] = tree!(styles)
+      until stack.empty?
+        node = stack.pop
+        next unless Hash === node
+        return true if yield(node)
 
-    elsif @at_rules_with_properties.include?(name)
-      props = Crass::Parser.parse_properties(rule[:block],
-        :preserve_comments => @config[:allow_comments],
-        :preserve_hacks    => @config[:allow_hacks])
+        value = node[:value]
+        stack.concat(value) if Array === value
+      end
 
-      rule[:block] = tree!(props)
+      false
+    end
 
-    elsif @at_rules.include?(name)
-      return nil if name == "import" && !import_url_allowed?(rule)
-      return nil if rule.has_key?(:block)
-    else
-      return nil
+    # Returns `true` if the given CSS function name is an image-related function
+    # that may contain image URLs that need to be validated.
+    def image_function?(name)
+      ["image", "image-set", "-webkit-image-set"].include?(name)
     end
 
-    rule
-  end
+    # Passes the URL value of an @import rule to a block to ensure
+    # it's an allowed URL
+    def import_url_allowed?(rule)
+      return true unless @import_url_validator
 
-  # Returns `true` if the given CSS function name is an image-related function
-  # that may contain image URLs that need to be validated.
-  def image_function?(name)
-    ['image', 'image-set', '-webkit-image-set'].include?(name)
-  end
+      url_token = rule[:tokens].detect { |t| t[:node] == :url || t[:node] == :string }
+
+      # don't allow @imports with no URL value
+      return false unless url_token && (import_url = url_token[:value])
 
-  # Passes the URL value of an @import rule to a block to ensure
-  # it's an allowed URL
-  def import_url_allowed?(rule)
-    return true unless @import_url_validator
+      @import_url_validator.call(import_url)
+    end
 
-    url_token = rule[:tokens].detect { |t| t[:node] == :url || t[:node] == :string }
+    # Returns `true` if the given Crass node is a `:bad_url` or `:error` node.
+    #
+    # A bad URL is invalid CSS that a browser will discard, but a parser that
+    # disagrees with the browser about where a bad URL ends could be tricked
+    # into hiding CSS inside it.
+    #
+    # An `:error` node is CSS that Crass couldn't or wouldn't parse, such as a
+    # block nested more deeply than Crass's maximum nesting depth. Its contents
+    # are never inspected, but they're preserved verbatim when the tree is
+    # stringified, so a browser would still see them.
+    #
+    # It's safest to reject any construct that contains either one.
+    def invalid_node?(node)
+      node[:node] == :bad_url || node[:node] == :error
+    end
 
-    # don't allow @imports with no URL value
-    return false unless url_token && (import_url = url_token[:value])
+    # Sanitizes a CSS property node. Returns the sanitized node, or `nil` if the
+    # current config doesn't allow this property.
+    def property!(prop)
+      name = prop[:name].downcase
 
-    @import_url_validator.call(import_url)
-  end
+      # Preserve IE * and _ hacks if desired.
+      if @config[:allow_hacks]
+        name.slice!(0) if /\A[*_]/.match?(name)
+      end
 
-  # Sanitizes a CSS property node. Returns the sanitized node, or `nil` if the
-  # current config doesn't allow this property.
-  def property!(prop)
-    name = prop[:name].downcase
+      return nil unless @config[:properties].include?(name)
 
-    # Preserve IE * and _ hacks if desired.
-    if @config[:allow_hacks]
-      name.slice!(0) if name =~ /\A[*_]/
-    end
+      nodes = prop[:children].dup
+      combined_value = +""
 
-    return nil unless @config[:properties].include?(name)
+      nodes.each do |child|
+        # Reject properties that contain an invalid node at any depth.
+        return nil if invalid_node?(child)
 
-    nodes          = prop[:children].dup
-    combined_value = String.new
+        value = child[:value]
 
-    nodes.each do |child|
-      value = child[:value]
+        case child[:node]
+        when :ident
+          combined_value << value.downcase if String === value
 
-      case child[:node]
-      when :ident
-        combined_value << value.downcase if String === value
+        when :function
+          if child.key?(:name)
+            name = child[:name].downcase
 
-      when :function
-        if child.key?(:name)
-          name = child[:name].downcase
+            if name == "url"
+              return nil unless valid_url?(child)
+            end
+
+            if image_function?(name)
+              return nil unless valid_image?(child)
+            end
 
-          if name == 'url'
-            return nil unless valid_url?(child)
+            combined_value << name
+            return nil if name == "expression" || combined_value == "expression"
           end
 
-          if image_function?(name)
-            return nil unless valid_image?(child)
+          if Array === value
+            nodes.concat(value)
+          elsif String === value
+            lowercase_value = value.downcase
+            combined_value << lowercase_value
+            return nil if lowercase_value == "expression" || combined_value == "expression"
           end
 
-          combined_value << name
-          return nil if name == 'expression' || combined_value == 'expression'
+        when :url
+          return nil unless valid_url?(child)
+
+        when :simple_block
+          # Reject properties that contain a `{}` block at any depth.
+          #
+          # A `{}` block isn't valid in a standard property value, and browsers
+          # that support CSS nesting will reparse an invalid declaration that
+          # contains one as a nested style rule (e.g.
+          # `color:hover{position:fixed}` becomes the rule
+          # `color:hover { position: fixed }`), which would allow disallowed
+          # properties to be smuggled past the sanitizer.
+          return nil if child[:start] == "{"
+
+          nodes.concat(value) if Array === value
         end
+      end
 
-        if Array === value
-          nodes.concat(value)
-        elsif String === value
-          lowercase_value = value.downcase
-          combined_value << lowercase_value
-          return nil if lowercase_value == 'expression' || combined_value == 'expression'
-        end
+      prop
+    end
 
-      when :url
-        return nil unless valid_url?(child)
+    # Sanitizes the given Crass CSS parse tree and all its children, modifying
+    # it in place. See {#tree!}.
+    #
+    # If _declarations_ is `true`, the tree is a list of declarations (such as
+    # the contents of a style rule) rather than a list of rules.
+    def sanitize_tree!(tree, declarations:)
+      preceded_by_property = false
 
-      when :bad_url
-        return nil
+      tree.map! do |node|
+        next nil if node.nil?
+
+        case node[:node]
+        when :at_rule
+          preceded_by_property = false
+          next at_rule!(node, declarations: declarations)
+
+        when :comment
+          next node if @config[:allow_comments]
+
+        when :property
+          prop = property!(node)
+          preceded_by_property = !prop.nil?
+          next prop
+
+        when :semicolon
+          # Only preserve the semicolon if it was preceded by an allowlisted
+          # property. Otherwise, omit it in order to prevent redundant
+          # semicolons.
+          if preceded_by_property
+            preceded_by_property = false
+            next node
+          end
+
+        when :style_rule
+          preceded_by_property = false
+
+          # Reject style rules whose selectors contain an invalid node (see
+          # {#invalid_node?}) or a semicolon at any depth.
+          #
+          # A semicolon is never valid in a selector, but if a style rule
+          # appears where a browser expects declarations (such as the contents
+          # of an `@media` rule in a list of declarations), the browser will
+          # treat everything before the semicolon as a declaration. For
+          # example, `position:fixed;a{}` would be treated as the declaration
+          # `position:fixed` followed by the style rule `a{}`.
+          next nil if contains_node?(node.dig(:selector, :tokens)) { |token|
+            invalid_node?(token) || token[:node] == :semicolon
+          }
+
+          sanitize_tree!(node[:children], declarations: true)
+          next node
+
+        when :whitespace
+          next node
+        end
+
+        nil
       end
-    end
 
-    prop
-  end
+      tree
+    end
 
-  # Returns `true` if the given node (which may be of type `:url` or
-  # `:function`, since the CSS syntax can produce both) uses an allowlisted
-  # protocol.
-  def valid_url?(node)
-    type = node[:node]
+    # Returns `true` if the given node (which may be of type `:url` or
+    # `:function`, since the CSS syntax can produce both) uses an allowlisted
+    # protocol.
+    def valid_url?(node)
+      type = node[:node]
 
-    if type == :function
-      return false unless node.key?(:name) && node[:name].downcase == 'url'
-      return false unless Array === node[:value]
+      if type == :function
+        return false unless node.key?(:name) && node[:name].downcase == "url"
+        return false unless Array === node[:value]
 
-      # A URL function's `:value` should be an array containing no more than one
-      # `:string` node and any number of `:whitespace` nodes.
-      #
-      # If it contains more than one `:string` node, or if it contains any other
-      # nodes except `:whitespace` nodes, it's not valid.
-      url_string_node = nil
+        # A URL function's `:value` should be an array containing no more than
+        # one `:string` node and any number of `:whitespace` nodes.
+        #
+        # If it contains more than one `:string` node, or if it contains any
+        # other nodes except `:whitespace` nodes, it's not valid.
+        url_string_node = nil
 
-      node[:value].each do |token|
-        return false unless Hash === token
+        node[:value].each do |token|
+          return false unless Hash === token
 
-        case token[:node]
+          case token[:node]
           when :string
             return false unless url_string_node.nil?
             url_string_node = token
@@ -335,47 +432,45 @@ class Sanitize; class CSS
 
           else
             return false
+          end
         end
-      end
 
-      return false if url_string_node.nil?
-      url = url_string_node[:value]
-    elsif type == :url
-      url = node[:value]
-    else
-      return false
-    end
+        return false if url_string_node.nil?
+        url = url_string_node[:value]
+      elsif type == :url
+        url = node[:value]
+      else
+        return false
+      end
 
-    if url =~ Sanitize::REGEX_PROTOCOL
-      return @config[:protocols].include?($1.downcase)
-    else
-      return @config[:protocols].include?(:relative)
+      if url =~ Sanitize::REGEX_PROTOCOL
+        @config[:protocols].include?($1.downcase)
+      else
+        @config[:protocols].include?(:relative)
+      end
     end
 
-    false
-  end
-
-  # Returns `true` if the given node is an image-related function and contains
-  # only strings that use an allowlisted protocol.
-  def valid_image?(node)
-    return false unless node[:node] == :function
-    return false unless node.key?(:name) && image_function?(node[:name].downcase)
-    return false unless Array === node[:value]
+    # Returns `true` if the given node is an image-related function and contains
+    # only strings that use an allowlisted protocol.
+    def valid_image?(node)
+      return false unless node[:node] == :function
+      return false unless node.key?(:name) && image_function?(node[:name].downcase)
+      return false unless Array === node[:value]
 
-    node[:value].each do |token|
+      node[:value].each do |token|
         return false unless Hash === token
 
         case token[:node]
-          when :string
-            if token[:value] =~ Sanitize::REGEX_PROTOCOL
-              return false unless @config[:protocols].include?($1.downcase)
-            else
-              return false unless @config[:protocols].include?(:relative)
-            end
+        when :string
+          if token[:value] =~ Sanitize::REGEX_PROTOCOL
+            return false unless @config[:protocols].include?($1.downcase)
           else
-            next
+            return false unless @config[:protocols].include?(:relative)
+          end
+        else
+          next
         end
       end
+    end
   end
-
-end; end
+end