sanitize 6.1.3 → 7.0.1

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: sanitize
 version: !ruby/object:Gem::Version
-  version: 6.1.3
+  version: 7.0.1
 platform: ruby
 authors:
 - Ryan Grove
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-08-14 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: crass
@@ -16,65 +15,38 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.0.2
+        version: 1.0.8
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.0.2
+        version: 1.0.8
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.12.0
+        version: 1.16.8
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.12.0
-- !ruby/object:Gem::Dependency
-  name: minitest
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '5.15'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '5.15'
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 13.0.6
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 13.0.6
-description: Sanitize is an allowlist-based HTML and CSS sanitizer. It removes all
-  HTML and/or CSS from a string except the elements, attributes, and properties you
+        version: 1.16.8
+description: |
+  Sanitize is an allowlist-based HTML and CSS sanitizer. It removes all HTML
+  and/or CSS from a string except the elements, attributes, and properties you
   choose to allow.
 email: ryan@wonko.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- HISTORY.md
+- CHANGELOG.md
 - LICENSE
 - README.md
 - lib/sanitize.rb
@@ -90,25 +62,13 @@ files:
 - lib/sanitize/transformers/clean_doctype.rb
 - lib/sanitize/transformers/clean_element.rb
 - lib/sanitize/version.rb
-- test/common.rb
-- test/test_clean_comment.rb
-- test/test_clean_css.rb
-- test/test_clean_doctype.rb
-- test/test_clean_element.rb
-- test/test_config.rb
-- test/test_malicious_css.rb
-- test/test_malicious_html.rb
-- test/test_parser.rb
-- test/test_sanitize.rb
-- test/test_sanitize_css.rb
-- test/test_transformers.rb
 homepage: https://github.com/rgrove/sanitize/
 licenses:
 - MIT
 metadata:
-  changelog_uri: https://github.com/rgrove/sanitize/blob/main/HISTORY.md
+  changelog_uri: https://github.com/rgrove/sanitize/blob/main/CHANGELOG.md
   documentation_uri: https://rubydoc.info/github/rgrove/sanitize
-post_install_message:
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib
@@ -116,15 +76,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.5.0
+      version: 3.1.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 1.2.0
+      version: '0'
 requirements: []
-rubygems_version: 3.5.11
-signing_key:
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Allowlist-based HTML and CSS sanitizer.
 test_files: []

data/test/common.rb

@@ -1,3 +0,0 @@
-# encoding: utf-8
-require 'minitest/autorun'
-require_relative '../lib/sanitize'

data/test/test_clean_comment.rb

@@ -1,47 +0,0 @@
-# encoding: utf-8
-require_relative 'common'
-
-describe 'Sanitize::Transformers::CleanComment' do
-  make_my_diffs_pretty!
-  parallelize_me!
-
-  describe 'when :allow_comments is false' do
-    before do
-      @s = Sanitize.new(:allow_comments => false, :elements => ['div'])
-    end
-
-    it 'should remove comments' do
-      _(@s.fragment('foo <!-- comment --> bar')).must_equal 'foo  bar'
-      _(@s.fragment('foo <!-- ')).must_equal 'foo '
-      _(@s.fragment('foo <!-- - -> bar')).must_equal 'foo '
-      _(@s.fragment("foo <!--\n\n\n\n-->bar")).must_equal 'foo bar'
-      _(@s.fragment("foo <!-- <!-- <!-- --> --> -->bar")).must_equal 'foo  --&gt; --&gt;bar'
-      _(@s.fragment("foo <div <!-- comment -->>bar</div>")).must_equal 'foo <div>&gt;bar</div>'
-
-      # Special case: the comment markup is inside a <script>, which makes it
-      # text content and not an actual HTML comment.
-      _(@s.fragment("<script><!-- comment --></script>")).must_equal ''
-
-      _(Sanitize.fragment("<script><!-- comment --></script>", :allow_comments => false, :elements => ['script']))
-        .must_equal '<script><!-- comment --></script>'
-    end
-  end
-
-  describe 'when :allow_comments is true' do
-    before do
-      @s = Sanitize.new(:allow_comments => true, :elements => ['div'])
-    end
-
-    it 'should allow comments' do
-      _(@s.fragment('foo <!-- comment --> bar')).must_equal 'foo <!-- comment --> bar'
-      _(@s.fragment('foo <!-- ')).must_equal 'foo <!-- -->'
-      _(@s.fragment('foo <!-- - -> bar')).must_equal 'foo <!-- - -> bar-->'
-      _(@s.fragment("foo <!--\n\n\n\n-->bar")).must_equal "foo <!--\n\n\n\n-->bar"
-      _(@s.fragment("foo <!-- <!-- <!-- --> --> -->bar")).must_equal 'foo <!-- <!-- <!-- --> --&gt; --&gt;bar'
-      _(@s.fragment("foo <div <!-- comment -->>bar</div>")).must_equal 'foo <div>&gt;bar</div>'
-
-      _(Sanitize.fragment("<script><!-- comment --></script>", :allow_comments => true, :elements => ['script']))
-        .must_equal '<script><!-- comment --></script>'
-    end
-  end
-end

data/test/test_clean_css.rb

@@ -1,67 +0,0 @@
-# encoding: utf-8
-require_relative 'common'
-
-describe 'Sanitize::Transformers::CSS::CleanAttribute' do
-  make_my_diffs_pretty!
-  parallelize_me!
-
-  before do
-    @s = Sanitize.new(Sanitize::Config::RELAXED)
-  end
-
-  it 'should sanitize CSS properties in style attributes' do
-    _(@s.fragment(%[
-      <div style="color: #fff; width: expression(alert(1)); /* <-- evil! */"></div>
-    ].strip)).must_equal %[
-      <div style="color: #fff;  /* <-- evil! */"></div>
-    ].strip
-  end
-
-  it 'should remove the style attribute if the sanitized CSS is empty' do
-    _(@s.fragment('<div style="width: expression(alert(1))"></div>')).
-      must_equal '<div></div>'
-  end
-end
-
-describe 'Sanitize::Transformers::CSS::CleanElement' do
-  make_my_diffs_pretty!
-  parallelize_me!
-
-  before do
-    @s = Sanitize.new(Sanitize::Config::RELAXED)
-  end
-
-  it 'should sanitize CSS stylesheets in <style> elements' do
-    html = %[
-      <style>@import url(evil.css);
-      /* Yay CSS! */
-      .foo { color: #fff; }
-      #bar { background: url(yay.jpg); bogus: wtf; }
-      .evil { width: expression(xss()); }
-
-      @media screen (max-width:480px) {
-        .foo { width: 400px; }
-        #bar:not(.baz) { height: 100px; }
-      }
-      </style>
-    ].strip
-
-    _(@s.fragment(html)).must_equal %[
-      <style>
-      /* Yay CSS! */
-      .foo { color: #fff; }
-      #bar { background: url(yay.jpg);  }
-      .evil {  }
-
-      @media screen (max-width:480px) {
-        .foo { width: 400px; }
-        #bar:not(.baz) { height: 100px; }
-      }
-      </style>
-    ].strip
-  end
-
-  it 'should remove the <style> element if the sanitized CSS is empty' do
-    _(@s.fragment('<style></style>')).must_equal ''
-  end
-end

data/test/test_clean_doctype.rb

@@ -1,71 +0,0 @@
-# encoding: utf-8
-require_relative 'common'
-
-describe 'Sanitize::Transformers::CleanDoctype' do
-  make_my_diffs_pretty!
-  parallelize_me!
-
-  describe 'when :allow_doctype is false' do
-    before do
-      @s = Sanitize.new(:allow_doctype => false, :elements => ['html'])
-    end
-
-    it 'should remove doctype declarations' do
-      _(@s.document('<!DOCTYPE html><html>foo</html>')).must_equal "<html>foo</html>"
-      _(@s.fragment('<!DOCTYPE html>foo')).must_equal 'foo'
-    end
-
-    it 'should not allow doctype definitions in fragments' do
-      _(@s.fragment('<!DOCTYPE html><html>foo</html>'))
-        .must_equal "foo"
-
-      _(@s.fragment('<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"><html>foo</html>'))
-        .must_equal "foo"
-
-      _(@s.fragment("<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\"\n    \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\"><html>foo</html>"))
-        .must_equal "foo"
-    end
-  end
-
-  describe 'when :allow_doctype is true' do
-    before do
-      @s = Sanitize.new(:allow_doctype => true, :elements => ['html'])
-    end
-
-    it 'should allow doctype declarations in documents' do
-      _(@s.document('<!DOCTYPE html><html>foo</html>'))
-        .must_equal "<!DOCTYPE html><html>foo</html>"
-
-      _(@s.document('<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"><html>foo</html>'))
-        .must_equal "<!DOCTYPE html><html>foo</html>"
-
-      _(@s.document("<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\"\n    \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\"><html>foo</html>"))
-        .must_equal "<!DOCTYPE html><html>foo</html>"
-    end
-
-    it 'should not allow obviously invalid doctype declarations in documents' do
-      _(@s.document('<!DOCTYPE blah blah blah><html>foo</html>'))
-        .must_equal "<!DOCTYPE html><html>foo</html>"
-
-      _(@s.document('<!DOCTYPE blah><html>foo</html>'))
-        .must_equal "<!DOCTYPE html><html>foo</html>"
-
-      _(@s.document('<!DOCTYPE html BLAH "-//W3C//DTD HTML 4.01//EN"><html>foo</html>'))
-        .must_equal "<!DOCTYPE html><html>foo</html>"
-
-      _(@s.document('<!whatever><html>foo</html>'))
-        .must_equal "<html>foo</html>"
-    end
-
-    it 'should not allow doctype definitions in fragments' do
-      _(@s.fragment('<!DOCTYPE html><html>foo</html>'))
-        .must_equal "foo"
-
-      _(@s.fragment('<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"><html>foo</html>'))
-        .must_equal "foo"
-
-      _(@s.fragment("<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\"\n    \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\"><html>foo</html>"))
-        .must_equal "foo"
-    end
-  end
-end