sanitize 1.2.0.dev.20091104 → 1.2.0

data/HISTORY

@@ -1,13 +1,15 @@
 Sanitize History
 ================================================================================
 
-Version 1.2.0.dev (git)
+Version 1.2.0 (2010-01-17)
+  * Requires Nokogiri ~> 1.4.1.
   * Added support for transformers, which allow you to filter and alter nodes
     using your own custom logic, on top of (or instead of) Sanitize's core
-    filter. See the README for details.
-  * Requires Nokogiri >= 1.4.0.
-  * Added elements h1 through h6 to the Relaxed whitelist. [Suggested by David
-    Reese]
+    filter. See the README for details and examples.
+  * Added Sanitize.clean_node!, which sanitizes a Nokogiri::XML::Node and all
+    its children.
+  * Added elements <h1> through <h6> to the Relaxed whitelist. [Suggested by
+    David Reese]
 
 Version 1.1.0 (2009-10-11)
   * Migrated from Hpricot to Nokogiri. Requires libxml2 >= 2.7.2 [Adam Hooper]

data/LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2009 Ryan Grove <ryan@wonko.com>
+Copyright (c) 2010 Ryan Grove <ryan@wonko.com>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the 'Software'), to deal in

data/README.rdoc

@@ -15,14 +15,14 @@ or maliciously-formed HTML. When in doubt, Sanitize always errs on the side of
 caution.
 
 *Author*::    Ryan Grove (mailto:ryan@wonko.com)
-*Version*::   1.2.0.dev (git)
-*Copyright*:: Copyright (c) 2009 Ryan Grove. All rights reserved.
+*Version*::   1.2.0 (2010-01-17)
+*Copyright*:: Copyright (c) 2010 Ryan Grove. All rights reserved.
 *License*::   MIT License (http://opensource.org/licenses/mit-license.php)
 *Website*::   http://github.com/rgrove/sanitize
 
 == Requires
 
-* Nokogiri >= 1.4.0
+* Nokogiri ~> 1.4.1
 * libxml2 >= 2.7.2
 
 == Installation
@@ -33,7 +33,7 @@ Latest stable release:
 
 Latest development version:
 
-  gem install sanitize -s http://gemcutter.org --prerelease
+  gem install sanitize --prerelease
 
 == Usage
 
@@ -213,6 +213,56 @@ way. A returned Hash may contain the following items, all of which are optional:
   Array of specific Nokogiri::XML::Node objects to whitelist, anywhere in the
   document, regardless of the current Sanitize config.
 
+==== Example: Transformer to whitelist YouTube video embeds
+
+The following example demonstrates how to create a Sanitize transformer that
+will safely whitelist valid YouTube video embeds without having to blindly allow
+other kinds of embedded content, which would be the case if you tried to do this
+by just whitelisting all <code><object></code>, <code><embed></code>, and
+<code><param></code> elements:
+
+  lambda do |env|
+    node      = env[:node]
+    node_name = node.name.to_s.downcase
+    parent    = node.parent
+
+    # Since the transformer receives the deepest nodes first, we look for a
+    # <param> element or an <embed> element whose parent is an <object>.
+    return nil unless (node_name == 'param' || node_name == 'embed') &&
+        parent.name.to_s.downcase == 'object'
+
+    if node_name == 'param'
+      # Quick XPath search to find the <param> node that contains the video URL.
+      return nil unless movie_node = parent.search('param[@name="movie"]')[0]
+      url = movie_node['value']
+    else
+      # Since this is an <embed>, the video URL is in the "src" attribute. No
+      # extra work needed.
+      url = node['src']
+    end
+
+    # Verify that the video URL is actually a valid YouTube video URL.
+    return nil unless url =~ /^http:\/\/(?:www\.)?youtube\.com\/v\//
+
+    # We're now certain that this is a YouTube embed, but we still need to run
+    # it through a special Sanitize step to ensure that no unwanted elements or
+    # attributes that don't belong in a YouTube embed can sneak in.
+    Sanitize.clean_node!(parent, {
+      :elements   => ['embed', 'object', 'param'],
+      :attributes => {
+        'embed'  => ['allowfullscreen', 'allowscriptaccess', 'height', 'src', 'type', 'width'],
+        'object' => ['height', 'width'],
+        'param'  => ['name', 'value']
+      }
+    })
+
+    # Now that we're sure that this is a valid YouTube embed and that there are
+    # no unwanted elements or attributes hidden inside it, we can tell Sanitize
+    # to whitelist the current node (<param> or <embed>) and its parent
+    # (<object>).
+    {:whitelist_nodes => [node, parent]}
+  end
+
 == Contributors
 
 The following lovely people have contributed to Sanitize in the form of patches
@@ -229,7 +279,7 @@ or ideas that later became code:
 
 == License
 
-Copyright (c) 2009 Ryan Grove <ryan@wonko.com>
+Copyright (c) 2010 Ryan Grove <ryan@wonko.com>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the 'Software'), to deal in

data/lib/sanitize.rb

@@ -1,6 +1,6 @@
 # encoding: utf-8
 #--
-# Copyright (c) 2009 Ryan Grove <ryan@wonko.com>
+# Copyright (c) 2010 Ryan Grove <ryan@wonko.com>
 #
 # Permission is hereby granted, free of charge, to any person obtaining a copy
 # of this software and associated documentation files (the 'Software'), to deal
@@ -105,9 +105,8 @@ class Sanitize
 
     result = output_method.call(output_method_params)
 
-    # Nokogiri 1.3.3 (and possibly earlier versions) always returns a US-ASCII
-    # string no matter what we ask for. This will be fixed in 1.4.0, but for
-    # now we have to hack around it to prevent errors.
+    # Ensure that the result is always a UTF-8 string in Ruby 1.9, no matter
+    # what. Nokogiri seems to return empty strings as ASCII for some reason.
     result.force_encoding('utf-8') if RUBY_VERSION >= '1.9'
 
     return result == html ? nil : html[0, html.length] = result
@@ -209,7 +208,7 @@ class Sanitize
         transformer_node
       elsif transform.is_a?(Hash)
         if transform[:whitelist_nodes].is_a?(Array)
-          @whitelist_nodes += transform[:whitelist_nodes] 
+          @whitelist_nodes += transform[:whitelist_nodes]
           @whitelist_nodes.uniq!
         end
 

data/lib/sanitize/config.rb

@@ -1,5 +1,5 @@
 #--
-# Copyright (c) 2009 Ryan Grove <ryan@wonko.com>
+# Copyright (c) 2010 Ryan Grove <ryan@wonko.com>
 # 
 # Permission is hereby granted, free of charge, to any person obtaining a copy
 # of this software and associated documentation files (the 'Software'), to deal
@@ -49,6 +49,8 @@ class Sanitize
       # to allow relative URLs sans protocol.
       :protocols => {},
 
+      # Transformers allow you to filter or alter nodes using custom logic. See
+      # README.rdoc for details and examples.
       :transformers => []
     }
   end

data/lib/sanitize/config/basic.rb

@@ -1,5 +1,5 @@
 #--
-# Copyright (c) 2009 Ryan Grove <ryan@wonko.com>
+# Copyright (c) 2010 Ryan Grove <ryan@wonko.com>
 # 
 # Permission is hereby granted, free of charge, to any person obtaining a copy
 # of this software and associated documentation files (the 'Software'), to deal

data/lib/sanitize/config/relaxed.rb

@@ -1,5 +1,5 @@
 #--
-# Copyright (c) 2009 Ryan Grove <ryan@wonko.com>
+# Copyright (c) 2010 Ryan Grove <ryan@wonko.com>
 # 
 # Permission is hereby granted, free of charge, to any person obtaining a copy
 # of this software and associated documentation files (the 'Software'), to deal
@@ -20,8 +20,6 @@
 # SOFTWARE.
 #++
 
-
-
 class Sanitize
   module Config
     RELAXED = {

data/lib/sanitize/config/restricted.rb

@@ -1,5 +1,5 @@
 #--
-# Copyright (c) 2009 Ryan Grove <ryan@wonko.com>
+# Copyright (c) 2010 Ryan Grove <ryan@wonko.com>
 # 
 # Permission is hereby granted, free of charge, to any person obtaining a copy
 # of this software and associated documentation files (the 'Software'), to deal

data/lib/sanitize/version.rb

@@ -1,3 +1,3 @@
 class Sanitize
-  VERSION = '1.2.0.dev.20091104'
+  VERSION = '1.2.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: sanitize
 version: !ruby/object:Gem::Version 
-  version: 1.2.0.dev.20091104
+  version: 1.2.0
 platform: ruby
 authors: 
 - Ryan Grove
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2009-11-04 00:00:00 -08:00
+date: 2010-01-17 00:00:00 -08:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -20,7 +20,7 @@ dependencies:
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        version: 1.4.0
+        version: 1.4.1
     version: 
 - !ruby/object:Gem::Dependency 
   name: bacon
@@ -77,9 +77,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
   version: 
 required_rubygems_version: !ruby/object:Gem::Requirement 
   requirements: 
-  - - ">"
+  - - ">="
     - !ruby/object:Gem::Version 
-      version: 1.3.1
+      version: "0"
   version: 
 requirements: []