sanitize 1.0.0 → 1.0.1

data/HISTORY

@@ -1,5 +1,13 @@
 Sanitize History
 ================================================================================
 
+Version 1.0.1 (2009-01-01)
+  * You can now specify :relative in a protocol config array to allow attributes
+    containing relative URLs with no protocol. The Basic and Relaxed configs
+    have been updated to allow relative URLs.
+  * Added a workaround for an Hpricot bug that causes HTML entities for
+    non-ASCII characters to be replaced by question marks, and all other
+    entities to be destructively decoded.
+
 Version 1.0.0 (2008-12-25)
   * First release.

data/LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2008 Ryan Grove <ryan@wonko.com>
+Copyright (c) 2009 Ryan Grove <ryan@wonko.com>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the 'Software'), to deal in

data/{README → README.rdoc}

@@ -15,8 +15,8 @@ or maliciously-formed HTML. When in doubt, Sanitize always errs on the side of
 caution.
 
 *Author*::    Ryan Grove (mailto:ryan@wonko.com)
-*Version*::   1.0.0 (2008-12-25)
-*Copyright*:: Copyright (c) 2008 Ryan Grove. All rights reserved.
+*Version*::   1.0.1 (2009-01-01)
+*Copyright*:: Copyright (c) 2009 Ryan Grove. All rights reserved.
 *License*::   MIT License (http://opensource.org/licenses/mit-license.php)
 *Website*::   http://github.com/rgrove/sanitize
 
@@ -120,9 +120,16 @@ protocol at all), it will be removed.
     'img' => {'src'  => ['http', 'https']}
   }
 
+If you'd like to allow the use of relative URLs which don't have a protocol,
+include the special value <code>:relative</code> in the protocol array:
+
+  :protocols => {
+    'a' => {'href' => ['http', 'https', :relative]}
+  }
+
 == License
 
-Copyright (c) 2008 Ryan Grove <ryan@wonko.com>
+Copyright (c) 2009 Ryan Grove <ryan@wonko.com>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the 'Software'), to deal in

data/lib/sanitize.rb

@@ -1,16 +1,16 @@
 #--
-# Copyright (c) 2008 Ryan Grove <ryan@wonko.com>
-# 
+# Copyright (c) 2009 Ryan Grove <ryan@wonko.com>
+#
 # Permission is hereby granted, free of charge, to any person obtaining a copy
 # of this software and associated documentation files (the 'Software'), to deal
 # in the Software without restriction, including without limitation the rights
 # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 # copies of the Software, and to permit persons to whom the Software is
 # furnished to do so, subject to the following conditions:
-# 
+#
 # The above copyright notice and this permission notice shall be included in all
 # copies or substantial portions of the Software.
-# 
+#
 # THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
@@ -25,13 +25,17 @@ $:.unshift(File.dirname(File.expand_path(__FILE__)))
 $:.uniq!
 
 require 'rubygems'
-gem 'hpricot', '~> 0.6'
+
+gem 'hpricot',      '~> 0.6'
+gem 'htmlentities', '~> 4.0.0'
 
 require 'hpricot'
+require 'htmlentities'
 require 'sanitize/config'
 require 'sanitize/config/restricted'
 require 'sanitize/config/basic'
 require 'sanitize/config/relaxed'
+require 'sanitize/monkeypatch/hpricot'
 
 class Sanitize
   #--
@@ -100,8 +104,13 @@ class Sanitize
             protocol = @config[:protocols][name]
 
             node.raw_attributes.delete_if do |key, value|
-              protocol.has_key?(key) && (!(value.downcase =~ /^([^:]+):/) ||
-                  !protocol[key].include?($1.downcase))
+              next false unless protocol.has_key?(key)
+
+              if value.downcase =~ /^([^:]+)(?:\:|&#0*58;|&#x0*3a;)/
+                !protocol[key].include?($1.downcase)
+              else
+                !protocol[key].include?(:relative)
+              end
             end
           end
         else
@@ -117,12 +126,15 @@ class Sanitize
       end
     end
 
-    # Make one last pass through the fragment and replace angle brackets with
-    # entities in all text nodes. This helps eliminate certain types of
-    # maliciously-malformed nested tags.
+    # Make one last pass through the fragment and encode all special HTML chars
+    # and non-ASCII chars as entities. This eliminates certain types of
+    # maliciously-malformed nested tags and also compensates for Hpricot's
+    # burning desire to decode all entities.
+    coder = HTMLEntities.new
+
     fragment.traverse_element do |node|
       if node.text?
-        node.swap(node.inner_text.gsub('<', '&lt;').gsub('>', '&gt;'))
+        node.swap(coder.encode(node.inner_text, :named))
       end
     end
 

data/lib/sanitize/config.rb

@@ -1,5 +1,5 @@
 #--
-# Copyright (c) 2008 Ryan Grove <ryan@wonko.com>
+# Copyright (c) 2009 Ryan Grove <ryan@wonko.com>
 # 
 # Permission is hereby granted, free of charge, to any person obtaining a copy
 # of this software and associated documentation files (the 'Software'), to deal
@@ -41,7 +41,8 @@ class Sanitize
       :add_attributes => {},
 
       # URL handling protocols to allow in specific attributes. By default, no
-      # protocols are allowed.
+      # protocols are allowed. Use :relative in place of a protocol if you want
+      # to allow relative URLs sans protocol.
       :protocols => {}
     }
   end

data/lib/sanitize/config/basic.rb

@@ -1,5 +1,5 @@
 #--
-# Copyright (c) 2008 Ryan Grove <ryan@wonko.com>
+# Copyright (c) 2009 Ryan Grove <ryan@wonko.com>
 # 
 # Permission is hereby granted, free of charge, to any person obtaining a copy
 # of this software and associated documentation files (the 'Software'), to deal
@@ -39,9 +39,10 @@ class Sanitize
       },
 
       :protocols => {
-        'a'          => {'href' => ['ftp', 'http', 'https', 'mailto']},
-        'blockquote' => {'cite' => ['http', 'https']},
-        'q'          => {'cite' => ['http', 'https']}
+        'a'          => {'href' => ['ftp', 'http', 'https', 'mailto',
+                                    :relative]},
+        'blockquote' => {'cite' => ['http', 'https', :relative]},
+        'q'          => {'cite' => ['http', 'https', :relative]}
       }
     }
   end

data/lib/sanitize/config/relaxed.rb

@@ -1,5 +1,5 @@
 #--
-# Copyright (c) 2008 Ryan Grove <ryan@wonko.com>
+# Copyright (c) 2009 Ryan Grove <ryan@wonko.com>
 # 
 # Permission is hereby granted, free of charge, to any person obtaining a copy
 # of this software and associated documentation files (the 'Software'), to deal
@@ -45,10 +45,11 @@ class Sanitize
       },
 
       :protocols => {
-        'a'          => {'href' => ['ftp', 'http', 'https', 'mailto']},
-        'blockquote' => {'cite' => ['http', 'https']},
-        'img'        => {'src'  => ['http', 'https']},
-        'q'          => {'cite' => ['http', 'https']}
+        'a'          => {'href' => ['ftp', 'http', 'https', 'mailto',
+                                    :relative]},
+        'blockquote' => {'cite' => ['http', 'https', :relative]},
+        'img'        => {'src'  => ['http', 'https', :relative]},
+        'q'          => {'cite' => ['http', 'https', :relative]}
       }
     }
   end

data/lib/sanitize/config/restricted.rb

@@ -1,5 +1,5 @@
 #--
-# Copyright (c) 2008 Ryan Grove <ryan@wonko.com>
+# Copyright (c) 2009 Ryan Grove <ryan@wonko.com>
 # 
 # Permission is hereby granted, free of charge, to any person obtaining a copy
 # of this software and associated documentation files (the 'Software'), to deal

data/lib/sanitize/monkeypatch/hpricot.rb

@@ -0,0 +1,33 @@
+#--
+# Copyright (c) 2009 Ryan Grove <ryan@wonko.com>
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the 'Software'), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+#++
+
+module Hpricot
+
+  # Monkeypatch to fix an Hpricot bug that causes HTML entities to be decoded
+  # incorrectly.
+  def self.uxs(str)
+    str.to_s.
+      gsub(/&(\w+);/) { [Hpricot::NamedCharacters[$1] || ??].pack("U*") }.
+      gsub(/\&\#(\d+);/) { [$1.to_i].pack("U*") }
+  end
+
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: sanitize
 version: !ruby/object:Gem::Version 
-  version: 1.0.0
+  version: 1.0.1
 platform: ruby
 authors: 
 - Ryan Grove
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2008-12-24 00:00:00 -08:00
+date: 2009-01-01 00:00:00 -08:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -22,6 +22,16 @@ dependencies:
       - !ruby/object:Gem::Version 
         version: "0.6"
     version: 
+- !ruby/object:Gem::Dependency 
+  name: htmlentities
+  type: :runtime
+  version_requirement: 
+  version_requirements: !ruby/object:Gem::Requirement 
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        version: 4.0.0
+    version: 
 description: 
 email: ryan@wonko.com
 executables: []
@@ -33,12 +43,13 @@ extra_rdoc_files: []
 files: 
 - HISTORY
 - LICENSE
-- README
+- README.rdoc
 - lib/sanitize.rb
 - lib/sanitize/config.rb
 - lib/sanitize/config/basic.rb
 - lib/sanitize/config/relaxed.rb
 - lib/sanitize/config/restricted.rb
+- lib/sanitize/monkeypatch/hpricot.rb
 has_rdoc: false
 homepage: http://github.com/rgrove/sanitize/
 post_install_message: