sanitize 1.0.7 → 1.0.8

data/HISTORY

@@ -1,6 +1,12 @@
 Sanitize History
 ================================================================================
 
+Version 1.0.8 (2009-04-23)
+  * Added a workaround for an Hpricot bug that prevents attribute names from
+    being downcased in recent versions of Hpricot. This was exploitable to
+    prevent non-whitelisted protocols from being cleaned. [Reported by Ben
+    Wanicur]
+
 Version 1.0.7 (2009-04-11)
   * Requires Hpricot 0.8.1+, which is finally compatible with Ruby 1.9.1.
   * Fixed a bug that caused named character entities containing digits (like

data/README.rdoc

@@ -15,7 +15,7 @@ or maliciously-formed HTML. When in doubt, Sanitize always errs on the side of
 caution.
 
 *Author*::    Ryan Grove (mailto:ryan@wonko.com)
-*Version*::   1.0.7 (2009-04-11)
+*Version*::   1.0.8 (2009-04-23)
 *Copyright*:: Copyright (c) 2009 Ryan Grove. All rights reserved.
 *License*::   MIT License (http://opensource.org/licenses/mit-license.php)
 *Website*::   http://github.com/rgrove/sanitize
@@ -145,6 +145,7 @@ or ideas that later became code:
 * Adam Hooper <adam@adamhooper.com>
 * Mutwin Kraus <mutle@blogage.de>
 * Dev Purkayastha <dev.purkayastha@gmail.com>
+* Ben Wanicur <bwanicur@verticalresponse.com>
 
 == License
 

data/lib/sanitize.rb

@@ -112,6 +112,7 @@ class Sanitize
             protocol = @config[:protocols][name]
 
             node.raw_attributes.delete_if do |key, value|
+              key = key.to_s.downcase
               next false unless protocol.has_key?(key)
               next true if value.nil?
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: sanitize
 version: !ruby/object:Gem::Version 
-  version: 1.0.7
+  version: 1.0.8
 platform: ruby
 authors: 
 - Ryan Grove
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2009-04-11 00:00:00 -07:00
+date: 2009-04-23 00:00:00 -07:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -61,7 +61,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 
 rubyforge_project: 
-rubygems_version: 1.3.1
+rubygems_version: 1.2.0
 signing_key: 
 specification_version: 2
 summary: Whitelist-based HTML sanitizer.