sanitize 7.0.0 → 7.0.2

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: sanitize
 version: !ruby/object:Gem::Version
-  version: 7.0.0
+  version: 7.0.2
 platform: ruby
 authors:
 - Ryan Grove
 bindir: bin
 cert_chain: []
-date: 2024-12-30 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: crass
@@ -15,32 +15,32 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.0.2
+        version: 1.0.8
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.0.2
+        version: 1.0.8
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.16.8
+        version: 1.19.7
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.16.8
+        version: 1.19.7
 description: |
   Sanitize is an allowlist-based HTML and CSS sanitizer. It removes all HTML
   and/or CSS from a string except the elements, attributes, and properties you
-  choose to allow.'
+  choose to allow.
 email: ryan@wonko.com
 executables: []
 extensions: []
@@ -62,18 +62,6 @@ files:
 - lib/sanitize/transformers/clean_doctype.rb
 - lib/sanitize/transformers/clean_element.rb
 - lib/sanitize/version.rb
-- test/common.rb
-- test/test_clean_comment.rb
-- test/test_clean_css.rb
-- test/test_clean_doctype.rb
-- test/test_clean_element.rb
-- test/test_config.rb
-- test/test_malicious_css.rb
-- test/test_malicious_html.rb
-- test/test_parser.rb
-- test/test_sanitize.rb
-- test/test_sanitize_css.rb
-- test/test_transformers.rb
 homepage: https://github.com/rgrove/sanitize/
 licenses:
 - MIT
@@ -88,14 +76,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.1.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Allowlist-based HTML and CSS sanitizer.
 test_files: []

data/test/common.rb

@@ -1,4 +0,0 @@
-# frozen_string_literal: true
-
-require "minitest/autorun"
-require "sanitize"

data/test/test_clean_comment.rb

@@ -1,48 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "common"
-
-describe "Sanitize::Transformers::CleanComment" do
-  make_my_diffs_pretty!
-  parallelize_me!
-
-  describe "when :allow_comments is false" do
-    before do
-      @s = Sanitize.new(allow_comments: false, elements: ["div"])
-    end
-
-    it "should remove comments" do
-      _(@s.fragment("foo <!-- comment --> bar")).must_equal "foo  bar"
-      _(@s.fragment("foo <!-- ")).must_equal "foo "
-      _(@s.fragment("foo <!-- - -> bar")).must_equal "foo "
-      _(@s.fragment("foo <!--\n\n\n\n-->bar")).must_equal "foo bar"
-      _(@s.fragment("foo <!-- <!-- <!-- --> --> -->bar")).must_equal "foo  --&gt; --&gt;bar"
-      _(@s.fragment("foo <div <!-- comment -->>bar</div>")).must_equal "foo <div>&gt;bar</div>"
-
-      # Special case: the comment markup is inside a <script>, which makes it
-      # text content and not an actual HTML comment.
-      _(@s.fragment("<script><!-- comment --></script>")).must_equal ""
-
-      _(Sanitize.fragment("<script><!-- comment --></script>", allow_comments: false, elements: ["script"]))
-        .must_equal "<script><!-- comment --></script>"
-    end
-  end
-
-  describe "when :allow_comments is true" do
-    before do
-      @s = Sanitize.new(allow_comments: true, elements: ["div"])
-    end
-
-    it "should allow comments" do
-      _(@s.fragment("foo <!-- comment --> bar")).must_equal "foo <!-- comment --> bar"
-      _(@s.fragment("foo <!-- ")).must_equal "foo <!-- -->"
-      _(@s.fragment("foo <!-- - -> bar")).must_equal "foo <!-- - -> bar-->"
-      _(@s.fragment("foo <!--\n\n\n\n-->bar")).must_equal "foo <!--\n\n\n\n-->bar"
-      _(@s.fragment("foo <!-- <!-- <!-- --> --> -->bar")).must_equal "foo <!-- <!-- <!-- --> --&gt; --&gt;bar"
-      _(@s.fragment("foo <div <!-- comment -->>bar</div>")).must_equal "foo <div>&gt;bar</div>"
-
-      _(Sanitize.fragment("<script><!-- comment --></script>", allow_comments: true, elements: ["script"]))
-        .must_equal "<script><!-- comment --></script>"
-    end
-  end
-end

data/test/test_clean_css.rb

@@ -1,68 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "common"
-
-describe "Sanitize::Transformers::CSS::CleanAttribute" do
-  make_my_diffs_pretty!
-  parallelize_me!
-
-  before do
-    @s = Sanitize.new(Sanitize::Config::RELAXED)
-  end
-
-  it "should sanitize CSS properties in style attributes" do
-    _(@s.fragment(%[
-      <div style="color: #fff; width: expression(alert(1)); /* <-- evil! */"></div>
-    ].strip)).must_equal %(
-      <div style="color: #fff;  /* <-- evil! */"></div>
-    ).strip
-  end
-
-  it "should remove the style attribute if the sanitized CSS is empty" do
-    _(@s.fragment('<div style="width: expression(alert(1))"></div>'))
-      .must_equal "<div></div>"
-  end
-end
-
-describe "Sanitize::Transformers::CSS::CleanElement" do
-  make_my_diffs_pretty!
-  parallelize_me!
-
-  before do
-    @s = Sanitize.new(Sanitize::Config::RELAXED)
-  end
-
-  it "should sanitize CSS stylesheets in <style> elements" do
-    html = %[
-      <style>@import url(evil.css);
-      /* Yay CSS! */
-      .foo { color: #fff; }
-      #bar { background: url(yay.jpg); bogus: wtf; }
-      .evil { width: expression(xss()); }
-
-      @media screen (max-width:480px) {
-        .foo { width: 400px; }
-        #bar:not(.baz) { height: 100px; }
-      }
-      </style>
-    ].strip
-
-    _(@s.fragment(html)).must_equal %[
-      <style>
-      /* Yay CSS! */
-      .foo { color: #fff; }
-      #bar { background: url(yay.jpg);  }
-      .evil {  }
-
-      @media screen (max-width:480px) {
-        .foo { width: 400px; }
-        #bar:not(.baz) { height: 100px; }
-      }
-      </style>
-    ].strip
-  end
-
-  it "should remove the <style> element if the sanitized CSS is empty" do
-    _(@s.fragment("<style></style>")).must_equal ""
-  end
-end

data/test/test_clean_doctype.rb

@@ -1,72 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "common"
-
-describe "Sanitize::Transformers::CleanDoctype" do
-  make_my_diffs_pretty!
-  parallelize_me!
-
-  describe "when :allow_doctype is false" do
-    before do
-      @s = Sanitize.new(allow_doctype: false, elements: ["html"])
-    end
-
-    it "should remove doctype declarations" do
-      _(@s.document("<!DOCTYPE html><html>foo</html>")).must_equal "<html>foo</html>"
-      _(@s.fragment("<!DOCTYPE html>foo")).must_equal "foo"
-    end
-
-    it "should not allow doctype definitions in fragments" do
-      _(@s.fragment("<!DOCTYPE html><html>foo</html>"))
-        .must_equal "foo"
-
-      _(@s.fragment('<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"><html>foo</html>'))
-        .must_equal "foo"
-
-      _(@s.fragment("<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\"\n    \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\"><html>foo</html>"))
-        .must_equal "foo"
-    end
-  end
-
-  describe "when :allow_doctype is true" do
-    before do
-      @s = Sanitize.new(allow_doctype: true, elements: ["html"])
-    end
-
-    it "should allow doctype declarations in documents" do
-      _(@s.document("<!DOCTYPE html><html>foo</html>"))
-        .must_equal "<!DOCTYPE html><html>foo</html>"
-
-      _(@s.document('<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"><html>foo</html>'))
-        .must_equal "<!DOCTYPE html><html>foo</html>"
-
-      _(@s.document("<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\"\n    \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\"><html>foo</html>"))
-        .must_equal "<!DOCTYPE html><html>foo</html>"
-    end
-
-    it "should not allow obviously invalid doctype declarations in documents" do
-      _(@s.document("<!DOCTYPE blah blah blah><html>foo</html>"))
-        .must_equal "<!DOCTYPE html><html>foo</html>"
-
-      _(@s.document("<!DOCTYPE blah><html>foo</html>"))
-        .must_equal "<!DOCTYPE html><html>foo</html>"
-
-      _(@s.document('<!DOCTYPE html BLAH "-//W3C//DTD HTML 4.01//EN"><html>foo</html>'))
-        .must_equal "<!DOCTYPE html><html>foo</html>"
-
-      _(@s.document("<!whatever><html>foo</html>"))
-        .must_equal "<html>foo</html>"
-    end
-
-    it "should not allow doctype definitions in fragments" do
-      _(@s.fragment("<!DOCTYPE html><html>foo</html>"))
-        .must_equal "foo"
-
-      _(@s.fragment('<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"><html>foo</html>'))
-        .must_equal "foo"
-
-      _(@s.fragment("<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\"\n    \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\"><html>foo</html>"))
-        .must_equal "foo"
-    end
-  end
-end