selma 0.5.2-x86_64-linux → 0.5.4-x86_64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5eb5dd7edcef57be134854951e6747bc0a2c9dc424977467205b1a56354fc822
-  data.tar.gz: 31f4afb371c5a0da61e63d1af99714c630be96d2d61e9b6c978d11edcdf86d7e
+  metadata.gz: e72e293d3f0d36881a67732dda3fe9f9ba08463194d876f674bb6aa0656dc1ea
+  data.tar.gz: 3ecdad4331907ffcf9fcede6f9090a4ac7ec03baaa9c27f51938f78b33082312
 SHA512:
-  metadata.gz: 9f09e3c29e9101e8d1797643291f616d8be0300fee8681cec5d6e0ae0d2107695685e2353ba5a7bab6b9cb867f29a5c068cb4c897830a27abe9c798a4458023d
-  data.tar.gz: 66f86f9cce5b9ad61c48303033fa4b3e56e1a1831665590aca6297217fb7ef9e6cd7cbe02008963162fc0a3ef91f3a06ff00c58cf492c34e8cbfdbf05d0db0ab
+  metadata.gz: fa0ae3a6a77ae0605174a3fe183c88b443f6bf7e5341bfb7622618f33d11f729275aad24b339b070ff3b067115a82df61f6610804419aba1dadda609095ae5e1
+  data.tar.gz: a7cfe89c9f62f8d35cca7071de099f73553a53aa6ca303f35828e82ec84d5bf0c07820b56b23caf144bfc03bf89bdd1c15d1133af743ca03c5633469847d205d

data/README.md

@@ -201,9 +201,13 @@ The structure of the `memory` options looks like this:
 
 Note that `preallocated_parsing_buffer_size` must always be less than `max_allowed_memory_usage`. See [the`lol_html` project documentation](https://docs.rs/lol_html/1.2.1/lol_html/struct.MemorySettings.html) to learn more about the default values.
 
+### Literal `<` in text is always escaped
+
+Whenever a sanitizer is in use, a literal `<` in text is emitted as `&lt;`. That includes `<textarea>` and `<title>`, where entities are still decoded, but not raw-text elements such as `<style>`, where they are not. This is what stops a stray `<` from fusing with the text after it into a brand new tag once the sanitizer removes whatever sat in between, e.g. `<<script></script>img src=x onerror=alert(1)>`. Your own `handle_text_chunk` handlers still receive the original text, and anything they `replace` takes precedence. An unterminated trailing token (`foo <!-- `, `foo <img src=x`) is dropped rather than passed through, since emitted verbatim it would keep parsing into whatever page the fragment is embedded in.
+
 ## Benchmarks
 
-When `bundle exec rake benchmark`, two different benchmarks are calculated. Here are those results on my machine.
+The benchmark gems live in an optional Bundler group, so install them first with `bundle config set --local with benchmark && bundle install`. When `bundle exec rake benchmark`, two different benchmarks are calculated. Here are those results on my machine.
 
 ### Benchmarks for just the sanitization process
 

data/lib/selma/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Selma
-  VERSION = "0.5.2"
+  VERSION = "0.5.4"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: selma
 version: !ruby/object:Gem::Version
-  version: 0.5.2
+  version: 0.5.4
 platform: x86_64-linux
 authors:
 - Garen J. Torikian
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2026-09-07 00:00:00.000000000 Z
+date: 2026-10-29 00:00:00.000000000 Z
 dependencies: []
 description: 
 email: