selma 0.5.2-arm-linux-gnu → 0.5.4-arm-linux-gnu

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 187e9b74b78214a994d12f36ed5c921e21afe4ea83f3af6f2044de7c3bc3003d
-  data.tar.gz: 6dc4bffc12c44affd4f9b1790d36d8e65a255a7edae1f082d25c6109f7434c3f
+  metadata.gz: 456f223667a85894ea951073e41d5252672541d2b29f1c5d5f7f6b7a053f104b
+  data.tar.gz: 86920f471af1648f0b3306677aa850803786c2982bd1ca819f89c79d44dd69a1
 SHA512:
-  metadata.gz: 5f431f4bd6ed9e7a38f53f2c99678e15e06dfe58a82d7afb671bfeec4573b3b02cc199382a0422f7e566f23013a3c377a98eea002ad97392de64ca2ae0ef3fe3
-  data.tar.gz: 5e0f89474e62afb69a1d662f0698883393c712bf2c2813b5a4e383f1c64c3ee0d41448f07e96af0e61fbd9cd355ff0f5c6c0c4b30c8a804ef6a3501866665285
+  metadata.gz: f21ad7b3c5afa5a5d3e266002cc9a5714ab4c1aa9817383888905370227d31e12874d135ac9956de15f227042bca10a16d2a8691ab73e1db2a0b59a02fe5dfa1
+  data.tar.gz: b19cb504ca94341052b0c7c1e150577e0b792c2cfe7de74c07384112ffe81868b9312dae444260bc3e52b56da318c18935ac34a1a040b765d9d46ce5a513467a

data/README.md

@@ -201,9 +201,13 @@ The structure of the `memory` options looks like this:
 
 Note that `preallocated_parsing_buffer_size` must always be less than `max_allowed_memory_usage`. See [the`lol_html` project documentation](https://docs.rs/lol_html/1.2.1/lol_html/struct.MemorySettings.html) to learn more about the default values.
 
+### Literal `<` in text is always escaped
+
+Whenever a sanitizer is in use, a literal `<` in text is emitted as `&lt;`. That includes `<textarea>` and `<title>`, where entities are still decoded, but not raw-text elements such as `<style>`, where they are not. This is what stops a stray `<` from fusing with the text after it into a brand new tag once the sanitizer removes whatever sat in between, e.g. `<<script></script>img src=x onerror=alert(1)>`. Your own `handle_text_chunk` handlers still receive the original text, and anything they `replace` takes precedence. An unterminated trailing token (`foo <!-- `, `foo <img src=x`) is dropped rather than passed through, since emitted verbatim it would keep parsing into whatever page the fragment is embedded in.
+
 ## Benchmarks
 
-When `bundle exec rake benchmark`, two different benchmarks are calculated. Here are those results on my machine.
+The benchmark gems live in an optional Bundler group, so install them first with `bundle config set --local with benchmark && bundle install`. When `bundle exec rake benchmark`, two different benchmarks are calculated. Here are those results on my machine.
 
 ### Benchmarks for just the sanitization process
 

data/lib/selma/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Selma
-  VERSION = "0.5.2"
+  VERSION = "0.5.4"
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: selma
 version: !ruby/object:Gem::Version
-  version: 0.5.2
+  version: 0.5.4
 platform: arm-linux-gnu
 authors:
 - Garen J. Torikian
 bindir: exe
 cert_chain: []
-date: 2026-09-07 00:00:00.000000000 Z
+date: 2026-10-29 00:00:00.000000000 Z
 dependencies: []
 email:
 - gjtorikian@gmail.com