sanitize 7.0.1 → 7.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 694fdddd1e40857325f7fac61ee5679e6a9fca926413c1b035062ab7449b92c7
-  data.tar.gz: 426f1b4ece2fe0514139b661ba77ca7b9a6196481a0759a3ac81a9f446996e3d
+  metadata.gz: 9dcbdd9a00a2f80ddded816eb9b52215365ae34ec23e99f0d31b2a2b11757b49
+  data.tar.gz: 38be6ac4c8215e558b4b1f4c8ae2eb570f6225a6473964b52ffbcb49c2806779
 SHA512:
-  metadata.gz: 3e58a303bb8a1285fbc75ab93acfd896444dc125d3b9b13884868366720bc451e5c69409b9a852014394604bc932e0ffbeeb7c1b7192eb3cd0a673ec10a79df2
-  data.tar.gz: 8a4b8ca81da4bc4bb070941fab4b08f8e6d36a10487d0d90820e762155fe5717acfbc919c2676650d490cd7d9cac82f7a2f4ec21bc0f373f837938a23a670d6d
+  metadata.gz: d802d1606fa2a8cb2056125d26092ef056146252c38ff55a086776c35eda10b70c63882f7b473656f4ea5cf18dfc9864e1e2bc6d257b204a1072568a5a65d440
+  data.tar.gz: 0f64bb78dd9c4b2dca863530c02a08559c36ed9ec761c0d3f3b1d81fef3b1eefe39e7632d0354eaf75b49b5e755c0e0191f92b6fb6a669255fd48bde2df332d7

data/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to Sanitize are documented in this file. The format (since version 7.0.0) is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 7.0.2 (2026-11-02)
+
+### Security
+
+- MathML and SVG elements whose `<math>` or `<svg>` ancestor has been removed are now also removed (keeping their contents, subject to `:remove_contents`), even if they're allowed by the config or have been allowlisted by a transformer. Previously, if Sanitize removed a `<math>` or `<svg>` element but kept its contents, its descendants were kept even though they'd been parsed as foreign elements, and browsers would reparse them as HTML elements. Since some elements are parsed very differently in foreign content than in HTML, this could allow arbitrary HTML to be injected. For example, the contents of a `<textarea>`, `<title>`, `<xmp>`, `<noembed>`, or `<noframes>` element inside a MathML or SVG element are parsed as markup rather than text, so an attribute value, comment, or raw text element inside it like `<svg><textarea><!--</textarea><img src=x onerror=alert(1)>-->` could close the element early once it was reparsed as HTML. Similarly, browsers that use legacy `<select>` parsing rules would parse the contents of a raw text element inside a `<select>` element like `<math><select><mi><xmp><input><img src=x onerror=alert(1)></xmp>` as markup. This only affected custom configs that don't remove the contents of `<math>` or `<svg>` elements and allow one of the affected elements. Sanitize's default and built-in configs aren't affected. Thanks to Mike Dalessio (@flavorjones) for reporting this issue. (GHSA-599p-54q3-ff89)
+
+- Elements and comments inside text content elements such as `<textarea>`, `<title>`, `<xmp>`, `<noembed>`, and `<noframes>` are now always removed, even if they're allowed by the config or have been allowlisted by a transformer. Only their text is kept, subject to `:remove_contents`. This provides defense in depth against the issue above. (GHSA-599p-54q3-ff89)
+
+- Sanitize now requires Nokogiri 1.19.7 or higher. Nokogiri versions since 1.19.5 escape `<` and `>` in serialized attribute values to match browser behavior, which provides defense in depth against the issue above. (GHSA-599p-54q3-ff89)
+
+- Elements inside `<select>`, `<option>`, and `<optgroup>` elements that browsers using legacy `<select>` parsing rules wouldn't allow there are now always removed (keeping their contents, subject to `:remove_contents`), even if they're allowed by the config or have been allowlisted by a transformer. Previously, if Sanitize removed a `<template>` element inside a `<select>` element but kept its contents, any raw text element inside the `<template>` element would end up inside the `<select>` element. Browsers that use legacy `<select>` parsing rules ignore the start tags of raw text elements inside a `<select>` element and parse their contents as markup, so input like `<select><template><xmp><input><img src=x onerror=alert(1)></xmp>` could be used to inject arbitrary HTML. This only affected custom configs that allow `<select>` and at least one raw text element such as `<style>`, `<xmp>`, `<noembed>`, `<noframes>`, or `<plaintext>`. Sanitize's default and built-in configs aren't affected. (GHSA-mg79-gw37-jxx7)
+
+### Changed
+
+- Ruby 3.2.0 is now the oldest supported Ruby version, since Nokogiri 1.19.x requires Ruby 3.2.0 or higher. Ruby 3.1 reached end of life in March 2025.
+
 ## 7.0.1 (2026-10-21)
 
 ### Security

data/lib/sanitize/config.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require "set"
-
 class Sanitize
   module Config
     # Deeply freezes and returns the given configuration Hash.

data/lib/sanitize/css.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 require "crass"
-require "set"
 
 class Sanitize
   class CSS

data/lib/sanitize/transformers/clean_comment.rb

@@ -2,12 +2,48 @@
 
 class Sanitize
   module Transformers
+    # Names of elements whose content is parsed as text rather than markup when
+    # they're in the HTML namespace.
+    #
+    # An element with one of these names can contain markup if it's in a foreign
+    # namespace like MathML or SVG. If Sanitize removes the foreign ancestor but
+    # keeps the element, its serialized contents will be reparsed as text inside
+    # an HTML element, so a closing tag inside a comment or an unescaped raw
+    # text element could break out of the element and inject arbitrary markup.
+    # To prevent this, Sanitize removes all elements and comments inside these
+    # elements, leaving only text.
+    TEXT_CONTENT_ELEMENTS = Set.new(%w[
+      iframe
+      noembed
+      noframes
+      noscript
+      plaintext
+      script
+      style
+      textarea
+      title
+      xmp
+    ]).freeze
+
     CleanComment = lambda do |env|
       node = env[:node]
 
-      if node.type == Nokogiri::XML::Node::COMMENT_NODE
-        node.unlink unless env[:is_allowlisted]
+      return unless node.type == Nokogiri::XML::Node::COMMENT_NODE
+
+      # Comments inside text content elements are always removed, even if
+      # they're allowlisted, since they can never be serialized safely.
+      parent = node.parent
+
+      while parent&.element?
+        if TEXT_CONTENT_ELEMENTS.include?(parent.name.downcase)
+          node.unlink
+          return
+        end
+
+        parent = parent.parent
       end
+
+      node.unlink unless env[:config][:allow_comments] || env[:is_allowlisted]
     end
   end
 end

data/lib/sanitize/transformers/clean_element.rb

@@ -1,10 +1,15 @@
 # frozen_string_literal: true
 
-require "set"
-
 class Sanitize
   module Transformers
     class CleanElement
+      # Maps the namespace URI of each foreign element type supported by HTML to
+      # the name of its root element.
+      FOREIGN_NAMESPACE_ROOTS = {
+        "http://www.w3.org/1998/Math/MathML" => "math",
+        "http://www.w3.org/2000/svg" => "svg"
+      }.freeze
+
       # Matches a valid HTML5 data attribute name. The unicode ranges included
       # here are a conservative subset of the full range of characters that are
       # technically allowed, with the intent of matching the most common
@@ -20,6 +25,14 @@ class Sanitize
       # https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes
       REGEX_DATA_ATTR = /\Adata-(?!xml)[a-z_][\w.\u00E0-\u00F6\u00F8-\u017F\u01DD-\u02AF-]*\z/u
 
+      # Maps `<select>` and related elements to the names of the elements that
+      # browsers using legacy `<select>` parsing rules allow as their children.
+      SELECT_CONTENT_MODEL = {
+        "optgroup" => Set["option"].freeze,
+        "option" => Set.new.freeze,
+        "select" => Set["hr", "optgroup", "option"].freeze
+      }.freeze
+
       # Elements whose content is treated as unescaped text by HTML parsers.
       UNESCAPED_TEXT_ELEMENTS = Set.new(%w[
         iframe
@@ -90,9 +103,18 @@ class Sanitize
 
       def call(env)
         node = env[:node]
-        return if node.type != Nokogiri::XML::Node::ELEMENT_NODE || env[:is_allowlisted]
+        return if node.type != Nokogiri::XML::Node::ELEMENT_NODE
 
         name = env[:node_name]
+        parent = node.parent
+
+        # Some elements are always removed, even if they're allowlisted, since
+        # browsers would parse them differently than Nokogiri did.
+        force_remove = orphaned_foreign_element?(node, name, parent) ||
+          invalid_select_descendant?(name, parent) ||
+          text_content_element?(parent)
+
+        return if env[:is_allowlisted] && !force_remove
 
         # Delete any element that isn't in the config allowlist, unless the node
         # has already been deleted from the document.
@@ -100,7 +122,7 @@ class Sanitize
         # It's important that we not try to reparent the children of a node that
         # has already been deleted, since that seems to trigger a memory leak in
         # Nokogiri.
-        unless @elements.include?(name) || node.parent.nil?
+        if (force_remove || !@elements.include?(name)) && !parent.nil?
           # Elements like br, div, p, etc. need to be replaced with whitespace
           # in order to preserve readability.
           if @whitespace_elements.include?(name)
@@ -245,6 +267,55 @@ class Sanitize
           node.unlink
         end
       end
+
+      private
+
+      # Returns `true` if _parent_ is an HTML `<select>`, `<option>`, or
+      # `<optgroup>` element and _name_ isn't an element that browsers allow
+      # inside it.
+      #
+      # Browsers that use legacy `<select>` parsing rules ignore the start tags
+      # of most elements inside a `<select>` element, including raw text
+      # elements like `<style>` and `<xmp>`, so these elements' contents would
+      # be parsed as markup. Nokogiri parses these elements the same way, but
+      # they can still end up inside a `<select>` element via a `<template>`
+      # element or foreign content that Sanitize removes. Since traversal is
+      # top-down, removing these elements ensures that only allowed elements
+      # and text remain inside `<select>` elements.
+      def invalid_select_descendant?(name, parent)
+        return false unless parent&.element? && SELECT_CONTENT_MODEL.key?(parent.name.downcase)
+        return false if FOREIGN_NAMESPACE_ROOTS.key?(parent.namespace&.href)
+
+        !SELECT_CONTENT_MODEL[parent.name.downcase].include?(name)
+      end
+
+      # Returns `true` if _node_ is a MathML or SVG element other than a
+      # `<math>` or `<svg>` element and its parent isn't a MathML or SVG element.
+      #
+      # This happens when Sanitize removes a `<math>` or `<svg>` element but
+      # keeps its contents. Nokogiri parsed these descendants as foreign
+      # elements, but browsers would reparse them as HTML elements, which may
+      # be parsed very differently. For example, the contents of a foreign
+      # `<textarea>` element are parsed as markup rather than as text. Since
+      # traversal is top-down, removing these elements ensures that no foreign
+      # element is kept without a foreign root.
+      def orphaned_foreign_element?(node, name, parent)
+        root_name = FOREIGN_NAMESPACE_ROOTS[node.namespace&.href]
+        return false if root_name.nil? || name == root_name
+
+        !(parent&.element? && FOREIGN_NAMESPACE_ROOTS.key?(parent.namespace&.href))
+      end
+
+      # Returns `true` if _parent_ is a text content element, such as
+      # `<textarea>` or `<xmp>`.
+      #
+      # Browsers parse the contents of these elements as text when they're in
+      # the HTML namespace, so any element inside one must have been parsed in
+      # a foreign namespace. Since traversal is top-down, removing these
+      # elements ensures that only text remains inside text content elements.
+      def text_content_element?(parent)
+        !!parent&.element? && TEXT_CONTENT_ELEMENTS.include?(parent.name.downcase)
+      end
     end
   end
 end

data/lib/sanitize/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 class Sanitize
-  VERSION = "7.0.1"
+  VERSION = "7.0.2"
 end

data/lib/sanitize.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 require "nokogiri"
-require "set"
 
 require_relative "sanitize/version"
 require_relative "sanitize/config"
@@ -97,7 +96,7 @@ class Sanitize
     # Default transformers always run at the end of the chain, after any custom
     # transformers.
     @transformers << Transformers::CleanElement.new(@config)
-    @transformers << Transformers::CleanComment unless @config[:allow_comments]
+    @transformers << Transformers::CleanComment
 
     if @config[:elements].include?("style")
       scss = Sanitize::CSS.new(config)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sanitize
 version: !ruby/object:Gem::Version
-  version: 7.0.1
+  version: 7.0.2
 platform: ruby
 authors:
 - Ryan Grove
@@ -29,14 +29,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.16.8
+        version: 1.19.7
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.16.8
+        version: 1.19.7
 description: |
   Sanitize is an allowlist-based HTML and CSS sanitizer. It removes all HTML
   and/or CSS from a string except the elements, attributes, and properties you
@@ -76,7 +76,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.1.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="