sanitize 4.6.3 → 4.6.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 04fe170a57bfd67e2e2f40e19e6add8cd777a9d812f24b66a4350d0cefe9f803
-  data.tar.gz: fb848fbc8cf1878905378f2795c9ad012d4247a1a5491ec4735994902544840d
+  metadata.gz: ac9e4e6beb6025350578007019bf48458a64b82ef26cd11e4547aee35b72625c
+  data.tar.gz: 000a0cd02b3a2690589f042f3d27fb0dd8fe34d150cc1ba073793dcfb2eb0a92
 SHA512:
-  metadata.gz: dde1af17f562062ea7136d8033df17ed2aeaf39fdc1d037e75118c1ed9718d6ae50f29f9bb1165b0057810fed7a8bcac303e9e0687c3f98dbe514f6cb768cae5
-  data.tar.gz: 408533cd205ec1570041a6c029bb639978aa1785824a2e69df9d695331f274e7cda4e024934300ba35b8792fb39f4a94bd780dc6365cc2eaade06cdc32d3299e
+  metadata.gz: 127b1656fa575c9ba793db8d6026a37b240a884172b18b05bb2776c80b2cda6fc2982938e3a98272b46d5741b05c8c05f3238ebb61e439a9f7ded36615854c4d
+  data.tar.gz: adb7c8b6bf29118b82094dd2cb7109dfaa6286ca57b73e98ec457b8eb433e91c76efd987fe2c6d3b6dac1ed554331f7d067240c4a96e7522d7122da5c5b925b1

data/HISTORY.md

@@ -1,8 +1,17 @@
 # Sanitize History
 
+## 4.6.4 (2018-03-20)
+
+* Fixed: A change introduced in 4.6.2 broke certain transformers that relied on
+  being able to mutate the name of an HTML node. That change has been reverted
+  and a test has been added to cover this case. [@zetter - #177][177]
+
+[177]:https://github.com/rgrove/sanitize/issues/177
+
 ## 4.6.3 (2018-03-19)
 
-* Fixed an HTML injection vulnerability that could allow XSS.
+* [CVE-2018-3740][176]: Fixed an HTML injection vulnerability that could allow
+  XSS.
 
   When Sanitize <= 4.6.2 is used in combination with libxml2 >= 2.9.2, a
   specially crafted HTML fragment can cause libxml2 to generate improperly
@@ -15,6 +24,8 @@
   Many thanks to the Shopify Application Security Team for responsibly reporting
   this issue.
 
+[176]:https://github.com/rgrove/sanitize/issues/176
+
 ## 4.6.2 (2018-03-19)
 
 * Reduced string allocations to optimize memory usage. [@janklimo - #175][175]

data/lib/sanitize.rb

@@ -217,14 +217,12 @@ class Sanitize
   end
 
   def transform_node!(node, node_whitelist)
-    node_name = node.name.downcase
-
     @transformers.each do |transformer|
       result = transformer.call(
         :config         => @config,
         :is_whitelisted => node_whitelist.include?(node),
         :node           => node,
-        :node_name      => node_name,
+        :node_name      => node.name.downcase,
         :node_whitelist => node_whitelist
       )
 

data/lib/sanitize/version.rb

@@ -1,5 +1,5 @@
 # encoding: utf-8
 
 class Sanitize
-  VERSION = '4.6.3'
+  VERSION = '4.6.4'
 end

data/test/test_transformers.rb

@@ -203,4 +203,22 @@ describe 'Transformers' do
         .must_equal('')
     end
   end
+
+  describe 'DOM modification transformer' do
+    b_to_strong_tag_transformer = lambda do |env|
+      node      = env[:node]
+      node_name = env[:node_name]
+
+      if node_name == 'b'
+        node.name = 'strong'
+      end
+    end
+
+    it 'should allow the <b> tag to be changed to a <strong> tag' do
+      input = '<b>text</b>'
+
+      Sanitize.fragment(input, :elements => ['strong'], :transformers => b_to_strong_tag_transformer)
+        .must_equal '<strong>text</strong>'
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sanitize
 version: !ruby/object:Gem::Version
-  version: 4.6.3
+  version: 4.6.4
 platform: ruby
 authors:
 - Ryan Grove