sanitize 4.0.1 → 4.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 91001a237cb7416e59ff83e47bac6087fde5fcb5
-  data.tar.gz: 8e93cb61a245815af2ff13a1e42815e794df3a0b
+  metadata.gz: db5b47018757eca02968cca236fae793558f28a3
+  data.tar.gz: 2556f1ebfb26b038190f334a39aff61315cd57b0
 SHA512:
-  metadata.gz: 466d73fcaf8c6e0481297451267db12a6e9729560faadc6a2be2f95dcb032a647fbe70068e4907c8b34a3314631fa0b8b90ecd61f0aea82b78e19111739b8bf4
-  data.tar.gz: faea3da32aaa91b4792d205eb59f74fcfd999d66db7a35e51c48e14017f3bdfc873461fc9208752243df23f945e50602cb6a5478c424ac914a6f6972a72ee7e3
+  metadata.gz: 2ddad668c07d8440a7e3bd4ccf4a066f6c1f0a7d9aeb8a0f43bd04569c8b5dd7959130d50c0725f902fa6f1bf8ed930b4d00ee4fa977f3364702d53387463b39
+  data.tar.gz: 677279ef0d92a8e1d96e1ac28cfa12a5e4934887952a75dc891a5f37014352b8369f5effc1e480a10ae10363724840dbb1a9b5ec7b60b317a501ec370811d5b4

data/HISTORY.md

@@ -1,16 +1,22 @@
-Sanitize History
-================================================================================
+# Sanitize History
 
-Version 4.0.1 (2015-12-09)
---------------------------
+## 4.1.0 (2016-06-17)
+
+* Added a new CSS config setting, `:import_url_validator`. This is a Proc or
+  other callable object that will be called with each `@import` URL, and should
+  return `true` to allow the URL or `false` to remove it. [@nikz - #153][153]
+
+[153]:https://github.com/rgrove/sanitize/pull/153/
+
+
+## 4.0.1 (2015-12-09)
 
 * Unpinned the Nokogumbo dependency. [@rubys - #141][141]
 
 [141]:https://github.com/rgrove/sanitize/pull/141
 
 
-Version 4.0.0 (2015-04-20)
---------------------------
+## 4.0.0 (2015-04-20)
 
 ### Potentially breaking changes
 
@@ -50,8 +56,7 @@ Version 4.0.0 (2015-04-20)
 [111]:https://github.com/rgrove/sanitize/issues/111
 
 
-Version 3.1.2 (2015-02-22)
---------------------------
+## 3.1.2 (2015-02-22)
 
 * Fixed: Deleting a node in a custom transformer could trigger a memory leak
   in Nokogiri if that node's children were later reparented, which the built-in
@@ -61,8 +66,7 @@ Version 3.1.2 (2015-02-22)
 [129]:https://github.com/rgrove/sanitize/issues/129
 
 
-Version 3.1.1 (2015-02-04)
---------------------------
+## 3.1.1 (2015-02-04)
 
 * Fixed: `#document` and `#fragment` failed on frozen strings, and could
   unintentionally modify unfrozen strings if they used an encoding other than
@@ -72,8 +76,7 @@ Version 3.1.1 (2015-02-04)
 [128]:https://github.com/rgrove/sanitize/pull/128
 
 
-Version 3.1.0 (2014-12-22)
---------------------------
+## 3.1.0 (2014-12-22)
 
 * Added the following CSS properties to the relaxed config. [@ehudc - #120][120]
 
@@ -90,8 +93,7 @@ Version 3.1.0 (2014-12-22)
 [120]:https://github.com/rgrove/sanitize/pull/120
 
 
-Version 3.0.4 (2014-12-12)
---------------------------
+## 3.0.4 (2014-12-12)
 
 * Fixed: Harmless whitespace preceding a URL protocol (such as " http://")
   caused the URL to be removed even when the protocol was whitelisted.
@@ -100,8 +102,7 @@ Version 3.0.4 (2014-12-12)
 [126]:https://github.com/rgrove/sanitize/pull/126
 
 
-Version 3.0.3 (2014-10-29)
---------------------------
+## 3.0.3 (2014-10-29)
 
 * Fixed: Some CSS selectors weren't parsed correctly inside the body of a
   `@media` block, causing them to be removed even when whitelist rules should
@@ -110,16 +111,14 @@ Version 3.0.3 (2014-10-29)
 [121]:https://github.com/rgrove/sanitize/issues/121
 
 
-Version 3.0.2 (2014-09-02)
---------------------------
+## 3.0.2 (2014-09-02)
 
 * Updated Nokogumbo to 1.1.12, because 1.1.11 silently reverted the change we
   were trying to pick up in the last release. Now issue [#114][114] is
   _actually_ fixed.
 
 
-Version 3.0.1 (2014-09-02)
---------------------------
+## 3.0.1 (2014-09-02)
 
 * Updated Nokogumbo to 1.1.11 to pick up a fix for a Gumbo bug in which certain
   HTML character entities, such as `Ö`, were parsed incorrectly, leaving
@@ -128,8 +127,7 @@ Version 3.0.1 (2014-09-02)
 [114]:https://github.com/rgrove/sanitize/issues/114
 
 
-Version 3.0.0 (2014-06-21)
---------------------------
+## 3.0.0 (2014-06-21)
 
 As of this version, Sanitize adheres strictly to the [SemVer 2.0.0][semver]
 versioning standard. This release contains API and output changes that are
@@ -228,8 +226,7 @@ Sanitize.fragment(html, Sanitize::Config.merge(Sanitize::Config::BASIC,
 [n1008]:https://github.com/sparklemotion/nokogiri/issues/1008
 
 
-Version 2.1.0 (2014-01-13)
---------------------------
+## 2.1.0 (2014-01-13)
 
 * Added support for whitelisting arbitrary HTML5 `data-*` attributes. Use the
   symbol `:data` instead of an attribute name in the `:attributes` config to
@@ -244,16 +241,14 @@ Version 2.1.0 (2014-01-13)
 [87]:https://github.com/rgrove/sanitize/pull/87
 
 
-Version 2.0.6 (2013-07-10)
---------------------------
+## 2.0.6 (2013-07-10)
 
 * Fixed: Version 2.0.5 inadvertently included some work-in-progress changes that
   shouldn't have made their way into the master branch. This is what happens
   when I release before coffee instead of after.
 
 
-Version 2.0.5 (2013-07-10)
---------------------------
+## 2.0.5 (2013-07-10)
 
 * Loosened the Nokogiri dependency back to >= 1.4.4 to allow Sanitize to coexist
   in newer Rubies with other libraries that restrict Nokogiri to 1.5.x for 1.8.7
@@ -261,8 +256,7 @@ Version 2.0.5 (2013-07-10)
   life easier for people who need those other libs.
 
 
-Version 2.0.4 (2013-06-12)
---------------------------
+## 2.0.4 (2013-06-12)
 
 * Added `Sanitize.clean_document`, which sanitizes a full HTML document rather
   than just a fragment. [Ben Anderson]
@@ -272,14 +266,12 @@ Version 2.0.4 (2013-06-12)
 * Dropped support for Ruby versions older than 1.9.2.
 
 
-Version 2.0.3 (2011-07-01)
---------------------------
+## 2.0.3 (2011-07-01)
 
 * Loosened the Nokogiri dependency to allow Nokogiri 1.5.x.
 
 
-Version 2.0.2 (2011-05-21)
---------------------------
+## 2.0.2 (2011-05-21)
 
 * Fixed a bug in which a protocol like "java\script:" would be translated to
   "java%5Cscript:" and allowed through the filter when relative URLs were
@@ -287,44 +279,50 @@ Version 2.0.2 (2011-05-21)
   undesired behavior.
 
 
-Version 2.0.1 (2011-03-16)
---------------------------
+## 2.0.1 (2011-03-16)
 
 * Updated the protocol regex to anchor at the beginning of the string rather
   than the beginning of a line. [Eaden McKee]
 
 
-Version 2.0.0 (2011-01-15)
---------------------------
+## 2.0.0 (2011-01-15)
 
 * The environment data passed into transformers and the return values expected
   from transformers have changed. Old transformers will need to be updated.
   See the README for details.
+
 * Transformers now receive nodes of all types, not just element nodes.
+
 * Sanitize's own core filtering logic is now implemented as a set of always-on
   transformers.
+
 * The default value for the `:output` config is now `:html`. Previously it was
   `:xhtml`.
+
 * Added a `:whitespace_elements` config, which specifies elements (such as
   `<br>` and `<p>`) that should be replaced with whitespace when removed in
   order to preserve readability. See the README for the default list of
   elements that will be replaced with whitespace when removed.
+
 * Added a `:transformers_breadth` config, which may be used to specify
   transformers that should traverse nodes in a breadth-first mode rather than
   the default depth-first mode.
+
 * Added the `abbr`, `dfn`, `kbd`, `mark`, `s`, `samp`, `time`, and `var`
   elements to the whitelists for the basic and relaxed configs.
+
 * Added the `bdo`, `del`, `figcaption`, `figure`, `hgroup`, `ins`, `rp`, `rt`,
   `ruby`, and `wbr` elements to the whitelist for the relaxed config.
+
 * The `dir`, `lang`, and `title` attributes are now whitelisted for all
   elements in the relaxed config.
+
 * Bumped minimum Nokogiri version to 1.4.4 to avoid a bug in 1.4.2+
   (issue #315) that caused `</body></html>` to be appended to the CDATA inside
   unterminated script and style elements.
 
 
-Version 1.2.1 (2010-04-20)
---------------------------
+## 1.2.1 (2010-04-20)
 
 * Added a `:remove_contents` config setting. If set to `true`, Sanitize will
   remove the contents of all non-whitelisted elements in addition to the
@@ -332,41 +330,46 @@ Version 1.2.1 (2010-04-20)
   remove the contents of only those elements (when filtered), and leave the
   contents of other filtered elements. [Thanks to Rafael Souza for the array
   option]
+
 * Added an `:output_encoding` config setting to allow the character encoding
   for HTML output to be specified. The default is utf-8.
+
 * The environment hash passed into transformers now includes a `:node_name`
   item containing the lowercase name of the current HTML node (e.g. "div").
+
 * Returning anything other than a Hash or nil from a transformer will now
   raise a meaningful `Sanitize::Error` exception rather than an unintended
   `NameError`.
 
 
-Version 1.2.0 (2010-01-17)
---------------------------
+## 1.2.0 (2010-01-17)
 
 * Requires Nokogiri ~> 1.4.1.
+
 * Added support for transformers, which allow you to filter and alter nodes
   using your own custom logic, on top of (or instead of) Sanitize's core
   filter. See the README for details and examples.
+
 * Added `Sanitize.clean_node!`, which sanitizes a `Nokogiri::XML::Node` and
   all its children.
+
 * Added elements `<h1>` through `<h6>` to the Relaxed whitelist. [Suggested by
   David Reese]
 
 
-Version 1.1.0 (2009-10-11)
---------------------------
+## 1.1.0 (2009-10-11)
 
 * Migrated from Hpricot to Nokogiri. Requires libxml2 >= 2.7.2 [Adam Hooper]
+
 * Added an `:output` config setting to allow the output format to be
   specified. Supported formats are `:xhtml` (the default) and `:html` (which
   outputs HTML4).
+
 * Changed protocol regex to ensure Sanitize doesn't kill URLs with colons in
   path segments. [Peter Cooper]
 
 
-Version 1.0.8 (2009-04-23)
---------------------------
+## 1.0.8 (2009-04-23)
 
 * Added a workaround for an Hpricot bug that prevents attribute names from
   being downcased in recent versions of Hpricot. This was exploitable to
@@ -374,48 +377,48 @@ Version 1.0.8 (2009-04-23)
   Wanicur]
 
 
-Version 1.0.7 (2009-04-11)
---------------------------
+## 1.0.7 (2009-04-11)
 
 * Requires Hpricot 0.8.1+, which is finally compatible with Ruby 1.9.1.
+
 * Fixed a bug that caused named character entities containing digits (like
   `&sup2;`) to be escaped when they shouldn't have been. [Reported by
   Sebastian Steinmetz]
 
 
-Version 1.0.6 (2009-02-23)
---------------------------
+## 1.0.6 (2009-02-23)
 
 * Removed htmlentities gem dependency.
+
 * Existing well-formed character entity references in the input string are now
   preserved rather than being decoded and re-encoded.
+
 * The `'` character is now encoded as `&#39;` instead of `&apos;` to prevent
   problems in IE6.
+
 * You can now specify the symbol `:all` in place of an element name in the
   attributes config hash to allow certain attributes on all elements. [Thanks
   to Mutwin Kraus]
 
 
-Version 1.0.5 (2009-02-05)
---------------------------
+## 1.0.5 (2009-02-05)
 
 * Fixed a bug introduced in version 1.0.3 that prevented non-whitelisted
   protocols from being cleaned when relative URLs were allowed. [Reported by
   Dev Purkayastha]
+
 * Fixed "undefined method `parent='" exceptions caused by parser changes in
   edge Hpricot.
 
 
-Version 1.0.4 (2009-01-16)
---------------------------
+## 1.0.4 (2009-01-16)
 
 * Fixed a bug that made it possible to sneak a non-whitelisted element through
   by repeating it several times in a row. All versions of Sanitize prior to
   1.0.4 are vulnerable. [Reported by Cristobal]
 
 
-Version 1.0.3 (2009-01-15)
---------------------------
+## 1.0.3 (2009-01-15)
 
 * Fixed a bug whereby incomplete Unicode or hex entities could be used to
   prevent non-whitelisted protocols from being cleaned. Since IE6 and Opera
@@ -424,25 +427,23 @@ Version 1.0.3 (2009-01-15)
   Sanitize prior to 1.0.3.
 
 
-Version 1.0.2 (2009-01-04)
---------------------------
+## 1.0.2 (2009-01-04)
 
 * Fixed a bug that caused an exception to be thrown when parsing a valueless
   attribute that's expected to contain a URL.
 
 
-Version 1.0.1 (2009-01-01)
---------------------------
+## 1.0.1 (2009-01-01)
 
 * You can now specify `:relative` in a protocol config array to allow
   attributes containing relative URLs with no protocol. The Basic and Relaxed
   configs have been updated to allow relative URLs.
+
 * Added a workaround for an Hpricot bug that causes HTML entities for
   non-ASCII characters to be replaced by question marks, and all other
   entities to be destructively decoded.
 
 
-Version 1.0.0 (2008-12-25)
---------------------------
+## 1.0.0 (2008-12-25)
 
 * First release.

data/README.md

@@ -381,6 +381,18 @@ Names of CSS [at-rules][at-rules] to allow that may have associated blocks
 containing style rules. At-rules like `media` and `keyframes` fall into this
 category. Names should be specified in lowercase.
 
+##### :css => :import_url_validator
+
+This is a `Proc` (or other callable object) that will be called and passed
+the URL specified for any `@import` [at-rules][at-rules].
+
+You can use this to limit what can be imported, for example something
+like the following to limit `@import` to Google Fonts URLs:
+
+```ruby
+Proc.new { |url| url.start_with?("https://fonts.googleapis.com") }
+```
+
 ##### :css => :properties (Array or Set)
 
 Whitelist of CSS property names to allow. Names should be specified in

data/lib/sanitize/css.rb

@@ -80,6 +80,7 @@ class Sanitize; class CSS
     @at_rules                 = Set.new(@config[:at_rules])
     @at_rules_with_properties = Set.new(@config[:at_rules_with_properties])
     @at_rules_with_styles     = Set.new(@config[:at_rules_with_styles])
+    @import_url_validator     = @config[:import_url_validator]
   end
 
   # Sanitizes inline CSS style properties.
@@ -219,6 +220,7 @@ class Sanitize; class CSS
       rule[:block] = tree!(props)
 
     elsif @at_rules.include?(name)
+      return nil if name == "import" && !import_url_allowed?(rule)
       return nil if rule.has_key?(:block)
     else
       return nil
@@ -227,6 +229,19 @@ class Sanitize; class CSS
     rule
   end
 
+  # Passes the URL value of an @import rule to a block to ensure
+  # it's an allowed URL
+  def import_url_allowed?(rule)
+    return true unless @import_url_validator
+
+    url_token = rule[:tokens].detect { |t| t[:node] == :url || t[:node] == :string }
+
+    # don't allow @imports with no URL value
+    return false unless url_token && (import_url = url_token[:value])
+
+    @import_url_validator.call(import_url)
+  end
+
   # Sanitizes a CSS property node. Returns the sanitized node, or `nil` if the
   # current config doesn't allow this property.
   def property!(prop)

data/lib/sanitize/version.rb

@@ -1,5 +1,5 @@
 # encoding: utf-8
 
 class Sanitize
-  VERSION = '4.0.1'
+  VERSION = '4.1.0'
 end

data/test/test_sanitize_css.rb

@@ -325,6 +325,73 @@ describe 'Sanitize::CSS' do
           ].strip
         end
       end
+
+      describe "when validating @import rules" do
+
+        describe "with no validation proc specified" do
+          before do
+            @scss = Sanitize::CSS.new(Sanitize::Config.merge(Sanitize::Config::RELAXED[:css], {
+              :at_rules => ['import']
+            }))
+          end
+
+          it "should allow any URL value" do
+            css = %[
+              @import url('https://somesite.com/something.css');
+            ].strip
+
+            @scss.stylesheet(css).strip.must_equal %[
+              @import url('https://somesite.com/something.css');
+            ].strip
+          end
+        end
+
+        describe "with a validation proc specified" do
+          before do
+            google_font_validator = Proc.new { |url| url.start_with?("https://fonts.googleapis.com") }
+
+            @scss = Sanitize::CSS.new(Sanitize::Config.merge(Sanitize::Config::RELAXED[:css], {
+              :at_rules => ['import'], :import_url_validator => google_font_validator
+            }))
+          end
+
+          it "should allow a google fonts url" do
+            css = %[
+              @import 'https://fonts.googleapis.com/css?family=Indie+Flower';
+              @import url('https://fonts.googleapis.com/css?family=Indie+Flower');
+            ].strip
+
+            @scss.stylesheet(css).strip.must_equal %[
+              @import 'https://fonts.googleapis.com/css?family=Indie+Flower';
+              @import url('https://fonts.googleapis.com/css?family=Indie+Flower');
+            ].strip
+          end
+
+          it "should not allow a nasty url" do
+            css = %[
+              @import 'https://fonts.googleapis.com/css?family=Indie+Flower';
+              @import 'https://nastysite.com/nasty_hax0r.css';
+              @import url('https://nastysite.com/nasty_hax0r.css');
+            ].strip
+
+            @scss.stylesheet(css).strip.must_equal %[
+              @import 'https://fonts.googleapis.com/css?family=Indie+Flower';
+            ].strip
+          end
+
+          it "should not allow a blank url" do
+            css = %[
+              @import 'https://fonts.googleapis.com/css?family=Indie+Flower';
+              @import '';
+              @import url('');
+            ].strip
+
+            @scss.stylesheet(css).strip.must_equal %[
+              @import 'https://fonts.googleapis.com/css?family=Indie+Flower';
+            ].strip
+          end
+        end
+      end
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sanitize
 version: !ruby/object:Gem::Version
-  version: 4.0.1
+  version: 4.1.0
 platform: ruby
 authors:
 - Ryan Grove
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-12-09 00:00:00.000000000 Z
+date: 2016-07-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: crass
@@ -165,7 +165,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: 1.2.0
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.8
+rubygems_version: 2.5.1
 signing_key: 
 specification_version: 4
 summary: Whitelist-based HTML and CSS sanitizer.