sanitize 6.1.2 → 6.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 22d5dc60d871deef3c8d6e70a9991369350f730165771eb5a026c5db3c54c706
-  data.tar.gz: 1c2e3c02ce6cd4df374675102470203c657188bf70ce8fa344930588d59359b8
+  metadata.gz: 8811451060f77afcf698da8e589994af3c5683d08a0032a279f76b3b556b5f33
+  data.tar.gz: d2617a785428b5b99717ef1743cc75dc1f8c53bda53fea59050725a1218b5fe8
 SHA512:
-  metadata.gz: 4f6213a1274e9f4940aaedee5df9966d4d5ac26db5222fb8f14408b365be3bc6299fab02a275495516c0d9be0a1b2ebaddf622085321625c2773554728459760
-  data.tar.gz: b14dc3eeb2215eef2ffed29f4900d279ec6d3a5c32dc2c0d1d0f62e9adbf0b7241bd388064d3eda421819cb30c46b7d52924b182436535050402097945c8e4ca
+  metadata.gz: 33b4b13b4369ba159031a1298bd5965b9dbe15921121b58d55155d3e717dd7cadf3495e10683613cd1439055f6d5a57249e540824fd9f98a11ae62db08167573
+  data.tar.gz: 40f149e0e3c51283b72332efb4598a81263fba029ea121ede31bb578634de339ed5c162fd49355601568c5cbc08f617879f058bcdfe5ce35afa6322e155cff8b

data/HISTORY.md

@@ -1,5 +1,13 @@
 # Sanitize History
 
+## 6.1.3 (2024-08-14)
+
+### Bug Fixes
+
+* The CSS URL protocol allowlist is now enforced on the nonstandard `-webkit-image-set` CSS function. [@ltk - #242][242]
+
+[242]:https://github.com/rgrove/sanitize/pull/242
+
 ## 6.1.2 (2024-07-27)
 
 ### Bug Fixes

data/lib/sanitize/css.rb

@@ -229,6 +229,12 @@ class Sanitize; class CSS
     rule
   end
 
+  # Returns `true` if the given CSS function name is an image-related function
+  # that may contain image URLs that need to be validated.
+  def image_function?(name)
+    ['image', 'image-set', '-webkit-image-set'].include?(name)
+  end
+
   # Passes the URL value of an @import rule to a block to ensure
   # it's an allowed URL
   def import_url_allowed?(rule)
@@ -272,7 +278,7 @@ class Sanitize; class CSS
             return nil unless valid_url?(child)
           end
 
-          if name == 'image-set' || name == 'image'
+          if image_function?(name)
             return nil unless valid_image?(child)
           end
 
@@ -349,11 +355,11 @@ class Sanitize; class CSS
     false
   end
 
-  # Returns `true` if the given node (which is an `image` or `image-set` function) contains only strings
-  # using an allowlisted protocol.
+  # Returns `true` if the given node is an image-related function and contains
+  # only strings that use an allowlisted protocol.
   def valid_image?(node)
     return false unless node[:node] == :function
-    return false unless node.key?(:name) && ['image', 'image-set'].include?(node[:name].downcase)
+    return false unless node.key?(:name) && image_function?(node[:name].downcase)
     return false unless Array === node[:value]
 
     node[:value].each do |token|

data/lib/sanitize/version.rb

@@ -1,3 +1,3 @@
 class Sanitize
-  VERSION = '6.1.2'
+  VERSION = '6.1.3'
 end

data/test/test_sanitize_css.rb

@@ -32,6 +32,9 @@ describe 'Sanitize::CSS' do
           "background: image-set('relative.jpg' 1x, 'relative-2x.jpg' 2x)",
           "background: image-set('https://example.com/https.jpg' 1x, 'https://example.com/https-2x.jpg' 2x)",
           "background: image-set('https://example.com/https.jpg' type('image/jpeg'), 'https://example.com/https.avif' type('image/avif'))",
+          "background: -webkit-image-set('relative.jpg' 1x, 'relative-2x.jpg' 2x)",
+          "background: -webkit-image-set('https://example.com/https.jpg' 1x, 'https://example.com/https-2x.jpg' 2x)",
+          "background: -webkit-image-set('https://example.com/https.jpg' type('image/jpeg'), 'https://example.com/https.avif' type('image/avif'))",
           "background: image('relative.jpg');",
           "background: image('https://example.com/https.jpg');",
           "background: image(rtl 'https://example.com/https.jpg');"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sanitize
 version: !ruby/object:Gem::Version
-  version: 6.1.2
+  version: 6.1.3
 platform: ruby
 authors:
 - Ryan Grove
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-07-27 00:00:00.000000000 Z
+date: 2024-08-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: crass
@@ -123,7 +123,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.2.0
 requirements: []
-rubygems_version: 3.5.3
+rubygems_version: 3.5.11
 signing_key:
 specification_version: 4
 summary: Allowlist-based HTML and CSS sanitizer.