selma 0.5.3 → 0.5.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 968ea670eb08eb49bbb5c305e257f87e4c38bd8371c9f0ba823600cc2be6c660
-  data.tar.gz: 83a5af8a2314d041ac6ae153db21271d57665c7b6a3ad851bdcb92c7753610d0
+  metadata.gz: 9bad668396052252afb3ff8e14400bbe010624aa224ef4c186d52f31939c7ccc
+  data.tar.gz: 5df036f8760268c7377fd447d30196f551a8ce4c55d93a38a9318e5a40dfd86c
 SHA512:
-  metadata.gz: 2673b5d305855725ffa53b343cdb6fa8da91903a914da50211eeff4acc17eee54837c29e6e8d19d20ad52c29075dc8ea2b2c9700b6cf0dfd255665aa0adfaccf
-  data.tar.gz: edd5982cef291e0fc666117c0ba0f6e7b18de03a007dc55b6a464b3fe0cb67db51435d86050ea01743694c65a8bd373debb606eff58a79a1e4fe361efa57912f
+  metadata.gz: bbb137a5b8013274687d6122c791ec2c30efbe13f5a5b2688ea60888ecf010b0ff7f4a17eb1ab3f2691ff7527240e0428ad45d616f159cf86be7c1f41bb1cbc6
+  data.tar.gz: c80e09b3e9de266be755cdda31e3c03c91b2fd2c40b0175a741e8b70ea965e9a8f43be929a0de802254af6656b5a7c7420bbb3b17556fc4dd3a7fa34f0e28b6f

data/Cargo.lock

@@ -275,9 +275,9 @@ dependencies = [
 
 [[package]]
 name = "magnus"
-version = "0.8.2"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b36a5b126bbe97eb0d02d07acfeb327036c6319fd816139a49824a83b7f9012"
+checksum = "379d50b6eea4ca84074ccd3e551eb9b07f7865194d5b3198325317e9ef78e5e9"
 dependencies = [
  "magnus-macros",
  "rb-sys",
@@ -287,9 +287,9 @@ dependencies = [
 
 [[package]]
 name = "magnus-macros"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47607461fd8e1513cb4f2076c197d8092d921a1ea75bd08af97398f593751892"
+checksum = "9dafde2eeb66f090e0f326112323eb8324b12cb32b5d1210e541d3df6b0ce77e"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -298,9 +298,9 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.8.0"
+version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
 [[package]]
 name = "mime"

data/README.md

@@ -207,7 +207,7 @@ Whenever a sanitizer is in use, a literal `<` in text is emitted as `&lt;`. That
 
 ## Benchmarks
 
-When `bundle exec rake benchmark`, two different benchmarks are calculated. Here are those results on my machine.
+The benchmark gems live in an optional Bundler group, so install them first with `bundle config set --local with benchmark && bundle install`. When `bundle exec rake benchmark`, two different benchmarks are calculated. Here are those results on my machine.
 
 ### Benchmarks for just the sanitization process
 

data/ext/selma/Cargo.toml

@@ -8,7 +8,7 @@ publish = false
 [dependencies]
 enum-iterator = "2.3"
 escapist = "0.0.2"
-magnus = { version = "0.8", features = ["rb-sys"] }
+magnus = { version = "0.9", features = ["rb-sys"] }
 rb-sys = { version = "*", default-features = false, features = [
     "stable-api-compiled-fallback",
 ] }

data/ext/selma/src/tags.rs

@@ -171,12 +171,23 @@ impl Tag {
     pub const TAG_COUNT: usize = 151;
 
     /// Identifies whether this is an HTML tag whose contents
-    /// are considered "text nodes", and thus, must be removed
+    /// are considered "text nodes", and thus, must be removed.
+    ///
+    /// Raw-text elements (`<noscript>`, `<xmp>`, ...) belong here: their content is
+    /// tokenized as text, so markup inside it never reaches the sanitizer. Keeping that
+    /// content after removing the wrapper would re-emit it verbatim into a context where
+    /// the browser parses it as live markup.
     pub fn has_text_content(tag: Tag) -> bool {
         tag.index == HTMLTag::SCRIPT as usize
             || tag.index == HTMLTag::STYLE as usize
             || tag.index == HTMLTag::MATH as usize
             || tag.index == HTMLTag::SVG as usize
+            || tag.index == HTMLTag::IFRAME as usize
+            || tag.index == HTMLTag::NOEMBED as usize
+            || tag.index == HTMLTag::NOFRAMES as usize
+            || tag.index == HTMLTag::NOSCRIPT as usize
+            || tag.index == HTMLTag::PLAINTEXT as usize
+            || tag.index == HTMLTag::XMP as usize
     }
 
     /// Is this tag an `<iframe>`?

data/lib/selma/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Selma
-  VERSION = "0.5.3"
+  VERSION = "0.5.4"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: selma
 version: !ruby/object:Gem::Version
-  version: 0.5.3
+  version: 0.5.4
 platform: ruby
 authors:
 - Garen J. Torikian