sanitize 1.0.2 → 1.0.3

data/HISTORY

@@ -1,6 +1,13 @@
 Sanitize History
 ================================================================================
 
+Version 1.0.3 (2009-01-15)
+  * Fixed a bug whereby incomplete Unicode or hex entities could be used to
+    prevent non-whitelisted protocols from being cleaned. Since IE6 and Opera
+    still decode the incomplete entities, users of those browsers may be
+    vulnerable to malicious script injection on websites using versions of
+    Sanitize prior to 1.0.3.
+
 Version 1.0.2 (2009-01-04)
   * Fixed a bug that caused an exception to be thrown when parsing a valueless
     attribute that's expected to contain a URL.

data/README.rdoc

@@ -15,7 +15,7 @@ or maliciously-formed HTML. When in doubt, Sanitize always errs on the side of
 caution.
 
 *Author*::    Ryan Grove (mailto:ryan@wonko.com)
-*Version*::   1.0.2 (2009-01-04)
+*Version*::   1.0.3 (2009-01-15)
 *Copyright*:: Copyright (c) 2009 Ryan Grove. All rights reserved.
 *License*::   MIT License (http://opensource.org/licenses/mit-license.php)
 *Website*::   http://github.com/rgrove/sanitize

data/lib/sanitize.rb

@@ -38,6 +38,14 @@ require 'sanitize/config/relaxed'
 require 'sanitize/monkeypatch/hpricot'
 
 class Sanitize
+
+  # Matches an attribute value that could be treated by a browser as a URL
+  # with a protocol prefix, such as "http:" or "javascript:". Any string of one
+  # or more characters followed by a colon is considered a match, even if the
+  # colon is encoded as an entity and even if it's an incomplete entity (which
+  # IE6 and Opera will still parse).
+  REGEX_PROTOCOL = /^([^:]+)(?:\:|&#0*58|&#x0*3a)(?:[^0-9a-f]|$)/i
+
   #--
   # Class Methods
   #++
@@ -50,7 +58,7 @@ class Sanitize
   end
 
   # Performs Sanitize#clean in place, returning _html_, or +nil+ if no changes
-  # were necessary.
+  # were made.
   def self.clean!(html, config = {})
     sanitize = Sanitize.new(config)
     sanitize.clean!(html)
@@ -72,7 +80,7 @@ class Sanitize
   end
 
   # Performs clean in place, returning _html_, or +nil+ if no changes were
-  # necessary.
+  # made.
   def clean!(html)
     fragment = Hpricot(html)
 
@@ -107,7 +115,7 @@ class Sanitize
               next false unless protocol.has_key?(key)
               next true if value.nil?
 
-              if value.to_s.downcase =~ /^([^:]+)(?:\:|&#0*58;|&#x0*3a;)/
+              if value.to_s.downcase =~ REGEX_PROTOCOL
                 !protocol[key].include?($1.downcase)
               else
                 !protocol[key].include?(:relative)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: sanitize
 version: !ruby/object:Gem::Version 
-  version: 1.0.2
+  version: 1.0.3
 platform: ruby
 authors: 
 - Ryan Grove
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2009-01-04 00:00:00 -08:00
+date: 2009-01-15 00:00:00 -08:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency