sanitize 6.1.1 → 6.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ed64268ea99d49841046ad5977df0d4e622abe58a6374244bc9223631ee0ed95
-  data.tar.gz: eb614786ac3167798532bdfef07c2abd65d5a72928af487432c775d9c878024d
+  metadata.gz: 22d5dc60d871deef3c8d6e70a9991369350f730165771eb5a026c5db3c54c706
+  data.tar.gz: 1c2e3c02ce6cd4df374675102470203c657188bf70ce8fa344930588d59359b8
 SHA512:
-  metadata.gz: 176c443206f2880a84bca7d84a32a631e4237f5f3de4d69f45a9dcd80ba31999c7c7424c1ace1a09aa4566834a699e7ff149e956383ec91c2c98e7c63c01f3c6
-  data.tar.gz: f492268ae71a8109b4857f9dced29d3ed4e3897b39fe2cb4d12cd1459395b58197179b2e9cdd32175e281a5aea04a13fa741809040289dbe47391b7367e1397d
+  metadata.gz: 4f6213a1274e9f4940aaedee5df9966d4d5ac26db5222fb8f14408b365be3bc6299fab02a275495516c0d9be0a1b2ebaddf622085321625c2773554728459760
+  data.tar.gz: b14dc3eeb2215eef2ffed29f4900d279ec6d3a5c32dc2c0d1d0f62e9adbf0b7241bd388064d3eda421819cb30c46b7d52924b182436535050402097945c8e4ca

data/HISTORY.md

@@ -1,5 +1,13 @@
 # Sanitize History
 
+## 6.1.2 (2024-07-27)
+
+### Bug Fixes
+
+* The CSS URL protocol allowlist is now properly enforced in [CSS Images Module Level 4](https://drafts.csswg.org/css-images-4/) `image` and `image-set` functions. [@ltk - #240][240]
+
+[240]:https://github.com/rgrove/sanitize/pull/240
+
 ## 6.1.1 (2024-06-12)
 
 ### Bug Fixes

data/lib/sanitize/css.rb

@@ -272,6 +272,10 @@ class Sanitize; class CSS
             return nil unless valid_url?(child)
           end
 
+          if name == 'image-set' || name == 'image'
+            return nil unless valid_image?(child)
+          end
+
           combined_value << name
           return nil if name == 'expression' || combined_value == 'expression'
         end
@@ -345,4 +349,27 @@ class Sanitize; class CSS
     false
   end
 
+  # Returns `true` if the given node (which is an `image` or `image-set` function) contains only strings
+  # using an allowlisted protocol.
+  def valid_image?(node)
+    return false unless node[:node] == :function
+    return false unless node.key?(:name) && ['image', 'image-set'].include?(node[:name].downcase)
+    return false unless Array === node[:value]
+
+    node[:value].each do |token|
+        return false unless Hash === token
+
+        case token[:node]
+          when :string
+            if token[:value] =~ Sanitize::REGEX_PROTOCOL
+              return false unless @config[:protocols].include?($1.downcase)
+            else
+              return false unless @config[:protocols].include?(:relative)
+            end
+          else
+            next
+        end
+      end
+  end
+
 end; end

data/lib/sanitize/version.rb

@@ -1,3 +1,3 @@
 class Sanitize
-  VERSION = '6.1.1'
+  VERSION = '6.1.2'
 end

data/test/test_sanitize_css.rb

@@ -29,6 +29,12 @@ describe 'Sanitize::CSS' do
           "background: url('ht\\tp://example.com/http.jpg')",
           "background: url(https://example.com/https.jpg)",
           "background: url('https://example.com/https.jpg')",
+          "background: image-set('relative.jpg' 1x, 'relative-2x.jpg' 2x)",
+          "background: image-set('https://example.com/https.jpg' 1x, 'https://example.com/https-2x.jpg' 2x)",
+          "background: image-set('https://example.com/https.jpg' type('image/jpeg'), 'https://example.com/https.avif' type('image/avif'))",
+          "background: image('relative.jpg');",
+          "background: image('https://example.com/https.jpg');",
+          "background: image(rtl 'https://example.com/https.jpg');"
         ].each do |css|
           _(@default.properties(css)).must_equal ''
           _(@relaxed.properties(css)).must_equal css

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sanitize
 version: !ruby/object:Gem::Version
-  version: 6.1.1
+  version: 6.1.2
 platform: ruby
 authors:
 - Ryan Grove
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-06-13 00:00:00.000000000 Z
+date: 2024-07-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: crass
@@ -123,7 +123,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.2.0
 requirements: []
-rubygems_version: 3.5.11
+rubygems_version: 3.5.3
 signing_key:
 specification_version: 4
 summary: Allowlist-based HTML and CSS sanitizer.