selma 0.5.1 → 0.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ed5dccbff7a289d57157e0ce627e31ed233ba316d6989ab14bfc6a9f28d241ec
-  data.tar.gz: de7de41bb7cd201f866515e3ef730491d435c90610e771dac5f928e1ca2e8688
+  metadata.gz: 9f9a2f98b54d8a383ef57ac7c8ef109b3849d07cb35bfa93a431e93c1a216e6d
+  data.tar.gz: 774d712999e64ff76f145689a08bbcd6b127fed100671bef264c9522bde9f2e5
 SHA512:
-  metadata.gz: 488c6240447f302b3479a20b76e17552648399dc82a465ddd0bf3d59cb058ec095a5ceae57a4f5cfef1a3865f6e765d2fdc4a94d79796f5d654d115982c53755
-  data.tar.gz: 371014f6ed8074097f1d7fd0c0c9600bbe7a5284248c7e7fdca6db9e4a5e26c4e565e3f20fa2c61612ad3a2ef199a8e8d87dc2103dbb987aa393e53f1f95e00d
+  metadata.gz: 87907675ef6bd1b0bc54196f451edc99c4527f25cb14a0d3cc223dbe5f4671e68f5787487348b1c7a80e152bd515bc0cc8e43df57f997a36541115753c66c267
+  data.tar.gz: f4bc7741b7a05506b8259e4c9e961d4230c340a32c98be96ba09ad67303e86d4925e0132001940aabcde55dc536348d41a85d1c0d0e290b2cfb68a0e9f82c4de

data/Cargo.lock

@@ -256,9 +256,9 @@ checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
 
 [[package]]
 name = "lol_html"
-version = "3.0.0"
+version = "3.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ae574a677ef0443a0bd3c291f0cab9d1e61a3ad85a1515e3cfc0bc720d5a48e"
+checksum = "5adbb62638edf7e6bc88835cd3ea388bdd53382af42045da0e414ea78aa0c91a"
 dependencies = [
  "bitflags",
  "cfg-if",
@@ -409,18 +409,18 @@ dependencies = [
 
 [[package]]
 name = "rb-sys"
-version = "0.9.128"
+version = "0.9.130"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45ca28513560e56cfb79a62b1fce363c73af170a182024ce880c77ee9429920a"
+checksum = "02faf625bb10ba893e3ae620f19c9fb1b5f8fcae0fe4eb86bb3f2230fad75edb"
 dependencies = [
  "rb-sys-build",
 ]
 
 [[package]]
 name = "rb-sys-build"
-version = "0.9.128"
+version = "0.9.130"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce04b2c55eff3a21aaa623fcc655d94373238e72cac6b3e1a3641ff31649f99a"
+checksum = "05be6f9c86fe5482808162826f6c047d093b3670582296c770de1d94f8066694"
 dependencies = [
  "bindgen",
  "lazy_static",

data/ext/selma/src/sanitizer.rs

@@ -551,33 +551,18 @@ impl SelmaSanitizer {
             return true;
         }
 
-        // FIXME: is there a more idiomatic way to do this?
-        let mut pos: usize = 0;
-        let mut chars = attr_val.chars();
-        let len = attr_val.len();
-
-        for (i, c) in attr_val.chars().enumerate() {
-            if c != ':' && c != '/' && c != '#' && pos + 1 < len {
-                pos = i + 1;
-            } else {
-                break;
-            }
-        }
-
-        let char = chars.nth(pos).unwrap();
-
-        if char == '/' {
-            return protocols_allowed.contains(&"/".to_string());
-        }
+        // The protocol is everything before the first `:`; a `/` or `#` before
+        // that means there is no protocol and the URL is relative.
+        let Some(idx) = attr_val.find([':', '/', '#']) else {
+            return false;
+        };
 
-        if char == '#' {
-            return protocols_allowed.contains(&"#".to_string());
+        match attr_val.as_bytes()[idx] {
+            b'/' => protocols_allowed.contains(&"/".to_string()),
+            b'#' => protocols_allowed.contains(&"#".to_string()),
+            // Allow protocol name to be case-insensitive
+            _ => protocols_allowed.contains(&attr_val[..idx].to_lowercase()),
         }
-
-        // Allow protocol name to be case-insensitive
-        let protocol = attr_val[0..pos].to_lowercase();
-
-        protocols_allowed.contains(&protocol.to_lowercase())
     }
 
     fn sanitize_class_attribute(

data/lib/selma/config.rb

@@ -7,6 +7,6 @@ module Selma
         max_allowed_memory_usage: nil,
         preallocated_parsing_buffer_size: nil,
       },
-    }
+    }.freeze
   end
 end

data/lib/selma/sanitizer/config/default.rb

@@ -5,7 +5,7 @@ module Selma
     module Config
       # although there are many more protocol types, eg., ftp, xmpp, etc.,
       # these are the only ones that are allowed by default
-      VALID_PROTOCOLS = ["http", "https", "mailto", :relative]
+      VALID_PROTOCOLS = ["http", "https", "mailto", :relative].freeze
 
       DEFAULT = freeze_config(
         # Whether or not to allow HTML comments. Allowing comments is strongly

data/lib/selma/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Selma
-  VERSION = "0.5.1"
+  VERSION = "0.5.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: selma
 version: !ruby/object:Gem::Version
-  version: 0.5.1
+  version: 0.5.2
 platform: ruby
 authors:
 - Garen J. Torikian
@@ -23,34 +23,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.9'
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '13.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '13.0'
-- !ruby/object:Gem::Dependency
-  name: rake-compiler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.2'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.2'
 email:
 - gjtorikian@gmail.com
 executables: []