selma 0.5.2 → 0.5.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9f9a2f98b54d8a383ef57ac7c8ef109b3849d07cb35bfa93a431e93c1a216e6d
-  data.tar.gz: 774d712999e64ff76f145689a08bbcd6b127fed100671bef264c9522bde9f2e5
+  metadata.gz: 968ea670eb08eb49bbb5c305e257f87e4c38bd8371c9f0ba823600cc2be6c660
+  data.tar.gz: 83a5af8a2314d041ac6ae153db21271d57665c7b6a3ad851bdcb92c7753610d0
 SHA512:
-  metadata.gz: 87907675ef6bd1b0bc54196f451edc99c4527f25cb14a0d3cc223dbe5f4671e68f5787487348b1c7a80e152bd515bc0cc8e43df57f997a36541115753c66c267
-  data.tar.gz: f4bc7741b7a05506b8259e4c9e961d4230c340a32c98be96ba09ad67303e86d4925e0132001940aabcde55dc536348d41a85d1c0d0e290b2cfb68a0e9f82c4de
+  metadata.gz: 2673b5d305855725ffa53b343cdb6fa8da91903a914da50211eeff4acc17eee54837c29e6e8d19d20ad52c29075dc8ea2b2c9700b6cf0dfd255665aa0adfaccf
+  data.tar.gz: edd5982cef291e0fc666117c0ba0f6e7b18de03a007dc55b6a464b3fe0cb67db51435d86050ea01743694c65a8bd373debb606eff58a79a1e4fe361efa57912f

data/Cargo.lock

@@ -508,6 +508,7 @@ dependencies = [
  "escapist",
  "lol_html",
  "magnus",
+ "memchr",
  "rb-sys",
 ]
 

data/README.md

@@ -201,6 +201,10 @@ The structure of the `memory` options looks like this:
 
 Note that `preallocated_parsing_buffer_size` must always be less than `max_allowed_memory_usage`. See [the`lol_html` project documentation](https://docs.rs/lol_html/1.2.1/lol_html/struct.MemorySettings.html) to learn more about the default values.
 
+### Literal `<` in text is always escaped
+
+Whenever a sanitizer is in use, a literal `<` in text is emitted as `&lt;`. That includes `<textarea>` and `<title>`, where entities are still decoded, but not raw-text elements such as `<style>`, where they are not. This is what stops a stray `<` from fusing with the text after it into a brand new tag once the sanitizer removes whatever sat in between, e.g. `<<script></script>img src=x onerror=alert(1)>`. Your own `handle_text_chunk` handlers still receive the original text, and anything they `replace` takes precedence. An unterminated trailing token (`foo <!-- `, `foo <img src=x`) is dropped rather than passed through, since emitted verbatim it would keep parsing into whatever page the fragment is embedded in.
+
 ## Benchmarks
 
 When `bundle exec rake benchmark`, two different benchmarks are calculated. Here are those results on my machine.

data/ext/selma/Cargo.toml

@@ -13,6 +13,7 @@ rb-sys = { version = "*", default-features = false, features = [
     "stable-api-compiled-fallback",
 ] }
 lol_html = "3.0"
+memchr = "2"
 
 [lib]
 name = "selma"

data/ext/selma/src/lib.rs

@@ -7,6 +7,7 @@ pub mod html;
 pub mod native_ref_wrap;
 pub mod rewriter;
 pub mod sanitizer;
+pub mod scan;
 pub mod selector;
 pub mod tags;
 

data/ext/selma/src/rewriter.rs

@@ -1,8 +1,8 @@
 use lol_html::{
-    doc_comments, doctype, element,
+    doc_comments, doc_text, doctype,
     html_content::{Element, TextChunk},
-    text, DocumentContentHandlers, ElementContentHandlers, HtmlRewriter, MemorySettings, Selector,
-    Settings,
+    DocumentContentHandlers, ElementContentHandlers, HandlerResult, HtmlRewriter, MemorySettings,
+    Selector, Settings,
 };
 use magnus::{
     function, gc, method,
@@ -21,16 +21,34 @@ use std::{
     ops::Deref,
     primitive::str,
     rc::Rc,
+    sync::OnceLock,
 };
 
 use crate::{
     html::{element::SelmaHTMLElement, end_tag::SelmaHTMLEndTag, text_chunk::SelmaHTMLTextChunk},
     native_ref_wrap::NativeRefWrap,
     sanitizer::SelmaSanitizer,
+    scan,
     selector::SelmaSelector,
     tags::Tag,
 };
 
+/// `*`, parsed once per process. lol_html's `element!` macro re-parses its CSS on every
+/// call, which is measurable for rewriters that run on many small inputs.
+fn all_elements_selector() -> &'static Selector {
+    static SELECTOR: OnceLock<Selector> = OnceLock::new();
+    SELECTOR.get_or_init(|| "*".parse().expect("`*` is a valid selector"))
+}
+
+fn escapeworthy_selector() -> &'static Selector {
+    static SELECTOR: OnceLock<Selector> = OnceLock::new();
+    SELECTOR.get_or_init(|| {
+        Tag::ESCAPEWORTHY_TAGS_CSS
+            .parse()
+            .expect("the escapeworthy tag list is valid CSS")
+    })
+}
+
 #[derive(Clone)]
 pub struct Handler {
     rb_handler: Opaque<Value>,
@@ -275,23 +293,37 @@ impl SelmaRewriter {
                         Ok(())
                     }));
                 }
-                if !sanitizer.get_allow_comments() {
+                if sanitizer.get_allow_comments() {
+                    // a no-op handler still makes lol_html tokenize comments, so an
+                    // unterminated `<!--`, `<!x` or `<?x` at EOF is dropped just like it is
+                    // when comments are stripped, instead of being flushed raw by the
+                    // tag-scanner fast path (which would comment out the host page)
+                    sanitizer_document_content_handlers.push(doc_comments!(|_c| Ok(())));
+                } else {
                     sanitizer_document_content_handlers.push(doc_comments!(|c| {
                         sanitizer.remove_comment(c);
                         Ok(())
                     }));
                 }
-                sanitizer_element_content_handlers.push(element!("*", |el| {
-                    sanitizer.try_remove_element(el);
-                    if el.removed() {
-                        return Ok(());
-                    }
-                    // if it was removed, there are no attributes to sanitize
-                    match sanitizer.sanitize_attributes(el) {
-                        Ok(_) => Ok(()),
-                        Err(err) => Err(err.to_string().into()),
-                    }
-                }));
+                // this must run in the same pass as element removal: by the time the
+                // output is re-parsed, a literal `<` next to a removed node has already
+                // fused with the text after it (see `SelmaSanitizer::escape_text_chunk`).
+                // Registering a text handler makes lol_html materialize every text chunk,
+                // so only pay for it when the input has a `<` that can end up in text.
+                if scan::has_escapable_lt(html.as_bytes()) {
+                    sanitizer_document_content_handlers.push(doc_text!(|t| {
+                        SelmaSanitizer::escape_text_chunk(t);
+                        Ok(())
+                    }));
+                }
+                sanitizer_element_content_handlers.push(Self::element_handler(
+                    all_elements_selector(),
+                    |el| {
+                        sanitizer
+                            .sanitize_element(el)
+                            .map_err(|err| err.to_string().into())
+                    },
+                ));
             }
         };
 
@@ -305,13 +337,7 @@ impl SelmaRewriter {
             html,
         ) {
             Ok(rewritten_html) => match &binding.sanitizer {
-                None => match String::from_utf8(rewritten_html) {
-                    Ok(output) => Ok(output),
-                    Err(err) => Err(magnus::Error::new(
-                        Ruby::get().unwrap().exception_runtime_error(),
-                        format!("{err:?}"),
-                    )),
-                },
+                None => Self::utf8(rewritten_html),
                 Some(sanitizer) => {
                     Self::perform_final_sanitization(self, sanitizer, rewritten_html)
                 }
@@ -327,30 +353,52 @@ impl SelmaRewriter {
         sanitizer: &SelmaSanitizer,
         html: Vec<u8>,
     ) -> Result<String, magnus::Error> {
-        // TODO: this should ideally be done ahead of time on `initialize`, not on every `#rewrite` call
-        let mut element_content_handlers: Vec<(Cow<Selector>, ElementContentHandlers)> = vec![];
+        // the only handler in this pass matches a fixed list of tag names, so a full
+        // re-parse is pointless unless the output can actually contain one of them
+        if !sanitizer.get_escape_tagfilter()
+            || !scan::has_start_tag(&html, Tag::ESCAPEWORTHY_TAG_NAMES)
+        {
+            return Self::utf8(html);
+        }
 
-        if sanitizer.get_escape_tagfilter() {
-            element_content_handlers.push(element!(Tag::ESCAPEWORTHY_TAGS_CSS, |el| {
-                let should_remove = sanitizer.allow_element(el);
-                if should_remove {
-                    sanitizer.force_remove_element(el);
-                }
+        let element_content_handlers = vec![Self::element_handler(escapeworthy_selector(), |el| {
+            sanitizer.remove_if_disallowed(el);
 
-                Ok(())
-            }));
-        }
+            Ok(())
+        })];
 
-        match Self::run_rewrite(self, vec![], element_content_handlers, html.as_slice()) {
-            Ok(rewritten_html) => match String::from_utf8(rewritten_html) {
-                Ok(output) => Ok(output),
-                Err(err) => Err(magnus::Error::new(
-                    Ruby::get().unwrap().exception_runtime_error(),
-                    format!("{err:?}"),
-                )),
-            },
-            Err(err) => Err(err),
-        }
+        Self::run_rewrite(self, vec![], element_content_handlers, html.as_slice())
+            .and_then(Self::utf8)
+    }
+
+    /// Pairs a pre-parsed selector with an element handler; see `all_elements_selector`.
+    fn element_handler<'h>(
+        selector: &'h Selector,
+        handler: impl FnMut(&mut Element<'_, '_>) -> HandlerResult + 'h,
+    ) -> (Cow<'h, Selector>, ElementContentHandlers<'h>) {
+        (
+            Cow::Borrowed(selector),
+            ElementContentHandlers::default().element(handler),
+        )
+    }
+
+    fn text_handler<'h>(
+        selector: &'h Selector,
+        handler: impl FnMut(&mut TextChunk<'_>) -> HandlerResult + 'h,
+    ) -> (Cow<'h, Selector>, ElementContentHandlers<'h>) {
+        (
+            Cow::Borrowed(selector),
+            ElementContentHandlers::default().text(handler),
+        )
+    }
+
+    fn utf8(html: Vec<u8>) -> Result<String, magnus::Error> {
+        String::from_utf8(html).map_err(|err| {
+            magnus::Error::new(
+                Ruby::get().unwrap().exception_runtime_error(),
+                format!("{err:?}"),
+            )
+        })
     }
 
     pub fn perform_handler_rewrite<'a>(
@@ -372,10 +420,10 @@ impl SelmaRewriter {
             let selector = &handler.selector;
 
             // TODO: test final raise by simulating errors
-            if let Some(match_element) = selector.match_element() {
+            if let Some(match_element) = selector.element_selector() {
                 let closure_element_stack = element_stack.clone();
 
-                element_content_handlers.push(element!(match_element, move |el| {
+                element_content_handlers.push(Self::element_handler(match_element, move |el| {
                     match Self::process_element_handlers(
                         handler,
                         el,
@@ -387,10 +435,10 @@ impl SelmaRewriter {
                 }));
             }
 
-            if let Some(match_text_within) = selector.match_text_within() {
+            if let Some(match_text_within) = selector.text_selector() {
                 let closure_element_stack = element_stack.clone();
 
-                element_content_handlers.push(text!(match_text_within, move |text| {
+                element_content_handlers.push(Self::text_handler(match_text_within, move |text| {
                     let element_stack = closure_element_stack.as_ref().borrow();
                     // check if current tag is a tag we should be ignoring text within;
                     // also checks if tag is within an ancestery of ignored tags
@@ -408,27 +456,31 @@ impl SelmaRewriter {
             }
 
             // we need to check *every* element we iterate over, to create a stack of elements
-            element_content_handlers.push(element!("*", move |el| {
-                let tag_name = el.tag_name().to_lowercase();
+            element_content_handlers.push(Self::element_handler(
+                all_elements_selector(),
+                move |el| {
+                    // lol_html already lowercases the name
+                    let tag_name = el.tag_name();
+
+                    // no need to track self-closing tags
+                    if Tag::tag_from_tag_name(&tag_name).self_closing {
+                        return Ok(());
+                    };
 
-                // no need to track self-closing tags
-                if Tag::tag_from_tag_name(&tag_name).self_closing {
-                    return Ok(());
-                };
+                    element_stack.as_ref().borrow_mut().push(tag_name);
 
-                element_stack.as_ref().borrow_mut().push(tag_name);
+                    let closure_element_stack = element_stack.clone();
 
-                let closure_element_stack = element_stack.clone();
+                    let handler: lol_html::EndTagHandler<'static> = Box::new(move |_end_tag| {
+                        closure_element_stack.as_ref().borrow_mut().pop();
+                        Ok(())
+                    });
+                    // ignore void elements (lol_html's void list may differ from selma's `self_closing`)
+                    let _ = el.on_end_tag(handler);
 
-                let handler: lol_html::EndTagHandler<'static> = Box::new(move |_end_tag| {
-                    closure_element_stack.as_ref().borrow_mut().pop();
                     Ok(())
-                });
-                // ignore void elements (lol_html's void list may differ from selma's `self_closing`)
-                let _ = el.on_end_tag(handler);
-
-                Ok(())
-            }));
+                },
+            ));
         });
 
         Self::run_rewrite(
@@ -467,6 +519,10 @@ impl SelmaRewriter {
                     ));
                 }
             }
+            // deliberately no `rewriter.end()`: lol_html would flush whatever token it is
+            // still holding at EOF *verbatim*, which turns a half-open `<img src=x onerror=..`
+            // into live markup once the fragment is embedded in a page; dropping an
+            // unterminated trailing token is the safe choice for a sanitizer
         }
         Ok(output)
     }

data/ext/selma/src/sanitizer.rs

@@ -1,8 +1,8 @@
-use std::{borrow::BorrowMut, collections::HashMap};
+use std::{borrow::Cow, collections::HashMap, sync::OnceLock};
 
 use lol_html::{
     errors::AttributeNameError,
-    html_content::{Comment, ContentType, Doctype, Element, EndTag},
+    html_content::{Comment, ContentType, Doctype, Element, EndTag, TextChunk},
 };
 use magnus::{
     eval, function, method,
@@ -15,11 +15,19 @@ use magnus::{
 #[derive(Clone, Debug, Default)]
 struct ElementSanitizer {
     allowed_attrs: Vec<String>,
-    required_attrs: Vec<String>,
     allowed_classes: Vec<String>,
     protocol_sanitizers: HashMap<String, Vec<String>>,
 }
 
+impl ElementSanitizer {
+    /// Shared stand-in for elements the config never mentions, so lookups at rewrite
+    /// time never insert anything and the config stays immutable once built.
+    fn empty() -> &'static ElementSanitizer {
+        static EMPTY: OnceLock<ElementSanitizer> = OnceLock::new();
+        EMPTY.get_or_init(ElementSanitizer::default)
+    }
+}
+
 #[derive(Clone)]
 pub struct Sanitizer {
     flags: [u8; crate::tags::Tag::TAG_COUNT],
@@ -33,9 +41,11 @@ pub struct Sanitizer {
     config: Opaque<RHash>,
 }
 
+/// The config is fully built in `new` and never changes afterwards, so there is no
+/// interior mutability here: every rewrite-time method only reads.
 #[derive(Clone)]
 #[magnus::wrap(class = "Selma::Sanitizer")]
-pub struct SelmaSanitizer(std::cell::RefCell<Sanitizer>);
+pub struct SelmaSanitizer(Sanitizer);
 
 impl SelmaSanitizer {
     const SELMA_SANITIZER_ALLOW: u8 = (1 << 0);
@@ -65,16 +75,10 @@ impl SelmaSanitizer {
             }
         };
 
+        // only elements the config actually mentions get an entry; everything else
+        // resolves to `ElementSanitizer::empty()` at rewrite time
         let mut element_sanitizers = HashMap::new();
 
-        // TODO: set up default tags; do we need this?
-        crate::tags::Tag::html_tags().iter().for_each(|html_tag| {
-            let element_name = crate::tags::Tag::element_name_from_enum(html_tag).to_string();
-
-            let element_sanitizer = ElementSanitizer::default();
-            element_sanitizers.insert(element_name, element_sanitizer);
-        });
-
         // def allow_attribute(element, attrs)
         //   attrs.flatten.each { |attr| set_allowed_attribute(element, attr, true) }
         // end
@@ -172,7 +176,7 @@ impl SelmaSanitizer {
             None => true,
         };
 
-        Ok(Self(std::cell::RefCell::new(Sanitizer {
+        Ok(Self(Sanitizer {
             flags,
             allowed_attrs: sanitizer_allowed_attrs,
             allowed_classes: sanitizer_allowed_classes,
@@ -182,7 +186,7 @@ impl SelmaSanitizer {
             allow_comments,
             allow_doctype,
             config: config.into(),
-        })))
+        }))
     }
 
     fn setup_config(
@@ -276,10 +280,9 @@ impl SelmaSanitizer {
     }
 
     fn get_config(&self) -> Result<RHash, magnus::Error> {
-        let binding = self.0.borrow();
         let ruby = Ruby::get().unwrap();
 
-        Ok(ruby.get_inner(binding.config))
+        Ok(ruby.get_inner(self.0.config))
     }
 
     /// Toggle a sanitizer option on or off.
@@ -317,7 +320,7 @@ impl SelmaSanitizer {
     }
 
     pub fn escape_tagfilter(&self, e: &mut Element) -> bool {
-        if self.0.borrow().escape_tagfilter {
+        if self.0.escape_tagfilter {
             let tag = crate::tags::Tag::tag_from_element(e);
             if crate::tags::Tag::is_tag_escapeworthy(tag) {
                 e.remove();
@@ -329,11 +332,30 @@ impl SelmaSanitizer {
     }
 
     pub fn get_escape_tagfilter(&self) -> bool {
-        self.0.borrow().escape_tagfilter
+        self.0.escape_tagfilter
     }
 
     pub fn get_allow_comments(&self) -> bool {
-        self.0.borrow().allow_comments
+        self.0.allow_comments
+    }
+
+    /// A `<` that the tokenizer classified as text (because the character after it
+    /// cannot start a tag, e.g. `<<b>` or `< b`) is otherwise passed through verbatim.
+    /// If the sanitizer then removes the node that follows it, the text on either side
+    /// joins up and re-tokenizes as markup.
+    /// Escaping `<` in every context that decodes entities keeps
+    /// text as text regardless of what gets removed around it. Raw-text contexts
+    /// (`<script>`, `<style>`, ...) are skipped: entities are not decoded there, so
+    /// escaping would corrupt the content rather than protect it.
+    pub fn escape_text_chunk(text_chunk: &mut TextChunk) {
+        if !text_chunk.text_type().allows_html_entities() {
+            return;
+        }
+
+        if text_chunk.as_str().contains('<') {
+            let escaped = text_chunk.as_str().replace('<', "&lt;");
+            text_chunk.set_str(escaped);
+        }
     }
 
     pub fn remove_comment(&self, c: &mut Comment) {
@@ -342,7 +364,7 @@ impl SelmaSanitizer {
 
     /// Whether or not to keep HTML doctype.
     pub fn get_allow_doctype(&self) -> bool {
-        self.0.borrow().allow_doctype
+        self.0.allow_doctype
     }
 
     pub fn remove_doctype(&self, d: &mut Doctype) {
@@ -355,7 +377,7 @@ impl SelmaSanitizer {
         allow_list: RArray,
     ) {
         let ruby = Ruby::get().unwrap();
-        let protocol_sanitizers = &mut element_sanitizer.protocol_sanitizers.borrow_mut();
+        let protocol_sanitizers = &mut element_sanitizer.protocol_sanitizers;
 
         for allowed_protocol in allow_list.into_iter() {
             let protocol_list = protocol_sanitizers.get_mut(&attr_name);
@@ -397,92 +419,95 @@ impl SelmaSanitizer {
         }
     }
 
-    pub fn sanitize_attributes(&self, element: &mut Element) -> Result<(), AttributeNameError> {
-        let tag = crate::tags::Tag::tag_from_element(element);
-        let tag_name = &element.tag_name();
-        let element_sanitizer = {
-            let mut binding = self.0.borrow_mut();
-            let element_sanitizers = &mut binding.element_sanitizers;
-            Self::get_element_sanitizer(element_sanitizers, tag_name).clone()
-        };
+    /// Everything the sanitizer does to one element, with a single tag lookup: remove it
+    /// (and, depending on the config, its contents) when it is not allowed, otherwise
+    /// filter and re-escape its attributes.
+    pub fn sanitize_element(&self, element: &mut Element) -> Result<(), AttributeNameError> {
+        // `tag_name()` allocates, so take it once and derive everything else from it
+        let name = element.tag_name();
+        let tag = crate::tags::Tag::tag_from_tag_name(&name);
+
+        self.try_remove_element(element, tag);
+        if element.removed() {
+            // nothing left to sanitize
+            return Ok(());
+        }
 
-        let binding = self.0.borrow();
+        self.sanitize_attributes(element, tag, &name)
+    }
 
-        // FIXME: This is a hack to get around the fact that we can't borrow
-        let attribute_map: HashMap<String, String> = element
+    fn sanitize_attributes(
+        &self,
+        element: &mut Element,
+        tag: crate::tags::Tag,
+        tag_name: &str,
+    ) -> Result<(), AttributeNameError> {
+        let sanitizer = &self.0;
+        let element_sanitizer = sanitizer
+            .element_sanitizers
+            .get(tag_name)
+            .unwrap_or_else(|| ElementSanitizer::empty());
+
+        // the attribute list cannot be iterated while the element is being mutated, so
+        // take a snapshot. Every occurrence of a duplicated name is evaluated in order;
+        // a rejected occurrence removes the attribute outright.
+        let attributes: Vec<(String, String)> = element
             .attributes()
             .iter()
             .map(|a| (a.name(), a.value()))
             .collect();
 
-        for (attr_name, attr_val) in attribute_map.iter() {
+        for (attr_name, attr_val) in &attributes {
             // you can actually embed <!-- ... --> inside
             // an HTML tag to pass malicious data. If this is
             // encountered, remove the entire element to be safe.
             if attr_name.starts_with("<!--") {
-                Self::force_remove_element(self, element);
+                Self::force_remove_element(element, tag);
                 return Ok(());
             }
 
-            // first, trim leading spaces and unescape any encodings
+            // first, trim leading spaces and unescape any encodings (an entity always
+            // starts with `&`, so a value without one is already unescaped)
             let trimmed = attr_val.trim_start();
-            let x = escapist::unescape_html(trimmed.as_bytes());
-            let unescaped_attr_val = String::from_utf8_lossy(&x).to_string();
+            let unescaped_attr_val: Cow<str> = if trimmed.contains('&') {
+                let bytes = escapist::unescape_html(trimmed.as_bytes());
+                Cow::Owned(
+                    String::from_utf8(bytes)
+                        .unwrap_or_else(|err| String::from_utf8_lossy(err.as_bytes()).into_owned()),
+                )
+            } else {
+                Cow::Borrowed(trimmed)
+            };
 
-            let should_keep_attrubute = match Self::should_keep_attribute(
-                &binding,
+            let keep = Self::should_keep_attribute(
+                sanitizer,
                 element,
-                &element_sanitizer,
+                element_sanitizer,
                 attr_name,
                 &unescaped_attr_val,
-            ) {
-                Ok(should_keep) => should_keep,
-                Err(e) => {
-                    return Err(e);
-                }
-            };
+            )?;
 
-            if !should_keep_attrubute {
+            if !keep {
                 element.remove_attribute(attr_name);
-            } else {
-                // Prevent the use of `<meta>` elements that set a charset other than UTF-8,
-                // since output is always UTF-8.
-                if crate::tags::Tag::is_meta(tag) {
-                    if attr_name == "charset" && unescaped_attr_val != "utf-8" {
-                        match element.set_attribute(attr_name, "utf-8") {
-                            Ok(_) => {}
-                            Err(err) => {
-                                return Err(err);
-                            }
-                        }
-                    }
-                } else if !unescaped_attr_val.is_empty() {
-                    let mut buf = String::new();
-                    // ...then, escape any special characters, for security
-                    if attr_name == "href" {
-                        escapist::escape_href(&mut buf, unescaped_attr_val.as_str()).unwrap();
-                    } else {
-                        escapist::escape_html(&mut buf, unescaped_attr_val.as_str()).unwrap();
-                    };
-
-                    match element.set_attribute(attr_name, &buf) {
-                        Ok(_) => {}
-                        Err(err) => {
-                            return Err(err);
-                        }
-                    }
-                }
+                continue;
             }
-        }
 
-        let required = &element_sanitizer.required_attrs;
-        if required.contains(&"*".to_string()) {
-            return Ok(());
-        }
-        for attr in element.attributes().iter() {
-            let attr_name = &attr.name();
-            if required.contains(attr_name) {
-                return Ok(());
+            // Prevent the use of `<meta>` elements that set a charset other than UTF-8,
+            // since output is always UTF-8.
+            if crate::tags::Tag::is_meta(tag) {
+                if attr_name == "charset" && unescaped_attr_val != "utf-8" {
+                    element.set_attribute(attr_name, "utf-8")?;
+                }
+            } else if !unescaped_attr_val.is_empty() {
+                // ...then, escape any special characters, for security
+                let mut buf = String::with_capacity(unescaped_attr_val.len());
+                if attr_name == "href" {
+                    escapist::escape_href(&mut buf, &unescaped_attr_val).unwrap();
+                } else {
+                    escapist::escape_html(&mut buf, &unescaped_attr_val).unwrap();
+                };
+
+                element.set_attribute(attr_name, &buf)?;
             }
         }
 
@@ -493,12 +518,15 @@ impl SelmaSanitizer {
         binding: &Sanitizer,
         element: &mut Element,
         element_sanitizer: &ElementSanitizer,
-        attr_name: &String,
+        attr_name: &str,
         attr_val: &str,
     ) -> Result<bool, AttributeNameError> {
         let mut allowed: bool = false;
-        let element_allowed_attrs = element_sanitizer.allowed_attrs.contains(attr_name);
-        let sanitizer_allowed_attrs = binding.allowed_attrs.contains(attr_name);
+        let element_allowed_attrs = element_sanitizer
+            .allowed_attrs
+            .iter()
+            .any(|a| a == attr_name);
+        let sanitizer_allowed_attrs = binding.allowed_attrs.iter().any(|a| a == attr_name);
 
         if element_allowed_attrs {
             allowed = true;
@@ -547,7 +575,7 @@ impl SelmaSanitizer {
     }
 
     fn has_allowed_protocol(protocols_allowed: &[String], attr_val: &str) -> bool {
-        if protocols_allowed.contains(&"all".to_string()) {
+        if protocols_allowed.iter().any(|p| p == "all") {
             return true;
         }
 
@@ -558,10 +586,18 @@ impl SelmaSanitizer {
         };
 
         match attr_val.as_bytes()[idx] {
-            b'/' => protocols_allowed.contains(&"/".to_string()),
-            b'#' => protocols_allowed.contains(&"#".to_string()),
-            // Allow protocol name to be case-insensitive
-            _ => protocols_allowed.contains(&attr_val[..idx].to_lowercase()),
+            b'/' => protocols_allowed.iter().any(|p| p == "/"),
+            b'#' => protocols_allowed.iter().any(|p| p == "#"),
+            // Allow protocol name to be case-insensitive (the config side is taken as-is)
+            _ => {
+                let protocol = &attr_val.as_bytes()[..idx];
+                protocols_allowed.iter().any(|p| {
+                    p.len() == protocol.len()
+                        && p.bytes()
+                            .zip(protocol)
+                            .all(|(allowed, given)| allowed == given.to_ascii_lowercase())
+                })
+            }
         }
     }
 
@@ -574,8 +610,6 @@ impl SelmaSanitizer {
     ) -> Result<bool, lol_html::errors::AttributeNameError> {
         let allowed_global = &binding.allowed_classes;
 
-        let mut valid_classes: Vec<String> = vec![];
-
         let allowed_local = &element_sanitizer.allowed_classes;
 
         // No class filters, so everything goes through
@@ -583,15 +617,13 @@ impl SelmaSanitizer {
             return Ok(true);
         }
 
-        let attr_value = attr_val.trim_start();
-        attr_value
+        let valid_classes: Vec<&str> = attr_val
             .split_whitespace()
-            .map(|s| s.to_string())
-            .for_each(|class| {
-                if allowed_global.contains(&class) || allowed_local.contains(&class) {
-                    valid_classes.push(class);
-                }
-            });
+            .filter(|class| {
+                allowed_global.iter().any(|a| a == class)
+                    || allowed_local.iter().any(|a| a == class)
+            })
+            .collect();
 
         if valid_classes.is_empty() {
             return Ok(false);
@@ -603,18 +635,23 @@ impl SelmaSanitizer {
         }
     }
 
-    pub fn allow_element(&self, element: &mut Element) -> bool {
-        let tag = crate::tags::Tag::tag_from_element(element);
-        let flags: u8 = self.0.borrow().flags[tag.index];
-
-        (flags & Self::SELMA_SANITIZER_ALLOW) == 0
+    fn is_disallowed(&self, tag: crate::tags::Tag) -> bool {
+        (self.0.flags[tag.index] & Self::SELMA_SANITIZER_ALLOW) == 0
     }
 
-    pub fn try_remove_element(&self, element: &mut Element) -> bool {
+    /// The final pass only needs to know whether a (possibly handler-inserted or fused)
+    /// element from the tagfilter list is allowed, and remove it outright if not.
+    pub fn remove_if_disallowed(&self, element: &mut Element) {
         let tag = crate::tags::Tag::tag_from_element(element);
-        let flags: u8 = self.0.borrow().flags[tag.index];
+        if self.is_disallowed(tag) {
+            Self::force_remove_element(element, tag);
+        }
+    }
 
-        let should_remove = !element.removed() && self.allow_element(element);
+    fn try_remove_element(&self, element: &mut Element, tag: crate::tags::Tag) -> bool {
+        let flags: u8 = self.0.flags[tag.index];
+
+        let should_remove = !element.removed() && self.is_disallowed(tag);
 
         if should_remove {
             if crate::tags::Tag::has_text_content(tag) {
@@ -627,11 +664,11 @@ impl SelmaSanitizer {
                 Self::remove_element(element, tag.self_closing, flags);
             }
 
-            Self::check_if_end_tag_needs_removal(element);
+            Self::check_if_end_tag_needs_removal(element, tag);
         } else {
             // anything in <iframe> must be removed, if it's kept
             if crate::tags::Tag::is_iframe(tag) {
-                if self.0.borrow().flags[tag.index] != 0 {
+                if flags != 0 {
                     element.set_inner_content(" ", ContentType::Text);
                 } else {
                     element.set_inner_content("", ContentType::Text);
@@ -662,15 +699,17 @@ impl SelmaSanitizer {
         }
     }
 
-    pub fn force_remove_element(&self, element: &mut Element) {
-        let tag = crate::tags::Tag::tag_from_element(element);
-        let self_closing = tag.self_closing;
-        Self::remove_element(element, self_closing, Self::SELMA_SANITIZER_REMOVE_CONTENTS);
-        Self::check_if_end_tag_needs_removal(element);
+    fn force_remove_element(element: &mut Element, tag: crate::tags::Tag) {
+        Self::remove_element(
+            element,
+            tag.self_closing,
+            Self::SELMA_SANITIZER_REMOVE_CONTENTS,
+        );
+        Self::check_if_end_tag_needs_removal(element, tag);
     }
 
-    fn check_if_end_tag_needs_removal(element: &mut Element) {
-        if element.removed() && !crate::tags::Tag::tag_from_element(element).self_closing {
+    fn check_if_end_tag_needs_removal(element: &mut Element, tag: crate::tags::Tag) {
+        if element.removed() && !tag.self_closing {
             // ignore void elements (lol_html's void list may differ from selma's `self_closing`)
             let _ = element.on_end_tag(Box::new(move |end| {
                 Self::remove_end_tag(end);

data/ext/selma/src/scan.rs

@@ -0,0 +1,57 @@
+//! Cheap byte scans that decide whether a rewriting pass has any work to do, so the
+//! expensive part (a full lol_html parse, or materializing every text chunk) is only
+//! paid for when it can matter.
+
+use memchr::memchr;
+
+fn starts_with_ignore_ascii_case(haystack: &[u8], needle: &[u8]) -> bool {
+    haystack.len() >= needle.len() && haystack[..needle.len()].eq_ignore_ascii_case(needle)
+}
+
+/// Whether any `<` in `html` can end up in an entity-decoding text chunk, which is the
+/// only place `SelmaSanitizer::escape_text_chunk` has work to do.
+///
+/// In the data state the tokenizer emits a `<` as text exactly when the byte after it
+/// can start neither a tag (ASCII letter), a comment or doctype (`!`), an end tag (`/`),
+/// nor a bogus comment (`?`). Inside `<textarea>` and `<title>` (RCDATA) every `<` is
+/// text, so the presence of either start tag counts as well. Raw-text contexts such as
+/// `<script>` and `<style>` are never escaped and need no consideration here.
+///
+/// A false positive only costs registering the handler; there are no false negatives.
+pub fn has_escapable_lt(html: &[u8]) -> bool {
+    let mut pos = 0;
+    while let Some(i) = memchr(b'<', &html[pos..]) {
+        let at = pos + i;
+        match html.get(at + 1) {
+            Some(b'!' | b'/' | b'?') => {}
+            Some(c) if c.is_ascii_alphabetic() => {
+                let name = &html[at + 1..];
+                if starts_with_ignore_ascii_case(name, b"textarea")
+                    || starts_with_ignore_ascii_case(name, b"title")
+                {
+                    return true;
+                }
+            }
+            // anything else (or nothing at all) after a `<` makes it text
+            _ => return true,
+        }
+        pos = at + 1;
+    }
+    false
+}
+
+/// Whether `html` contains a start tag for any of `names`, compared ASCII
+/// case-insensitively. Matching by prefix over-approximates (`<titlex>` counts for
+/// `title`), which is the safe direction for a gate.
+pub fn has_start_tag(html: &[u8], names: &[&[u8]]) -> bool {
+    let mut pos = 0;
+    while let Some(i) = memchr(b'<', &html[pos..]) {
+        let at = pos + i;
+        let name = &html[at + 1..];
+        if names.iter().any(|n| starts_with_ignore_ascii_case(name, n)) {
+            return true;
+        }
+        pos = at + 1;
+    }
+    false
+}

data/ext/selma/src/selector.rs

@@ -3,8 +3,9 @@ use magnus::{function, scan_args, Error, Module, Object, RModule, Ruby, Value};
 #[derive(Clone, Debug)]
 #[magnus::wrap(class = "Selma::Selector")]
 pub struct SelmaSelector {
-    match_element: Option<String>,
-    match_text_within: Option<String>,
+    // parsed once here, so `Rewriter#rewrite` does not re-parse the CSS on every call
+    element_selector: Option<lol_html::Selector>,
+    text_selector: Option<lol_html::Selector>,
     ignore_text_within: Option<Vec<String>>,
 }
 
@@ -23,25 +24,31 @@ impl SelmaSelector {
             ));
         }
 
-        // FIXME: not excited about this double parse work (`element!` does it too),
-        // but at least we can bail ASAP if the CSS is invalid
-        if let Some(css) = &match_element {
-            if css.parse::<lol_html::Selector>().is_err() {
-                return Err(Error::new(
-                    ruby.exception_arg_error(),
-                    format!("Could not parse `match_element` (`{css:?}`) as valid CSS"),
-                ));
-            }
-        }
+        let element_selector = match &match_element {
+            None => None,
+            Some(css) => match css.parse::<lol_html::Selector>() {
+                Ok(selector) => Some(selector),
+                Err(_) => {
+                    return Err(Error::new(
+                        ruby.exception_arg_error(),
+                        format!("Could not parse `match_element` (`{css:?}`) as valid CSS"),
+                    ));
+                }
+            },
+        };
 
-        if let Some(css) = &match_text_within {
-            if css.parse::<lol_html::Selector>().is_err() {
-                return Err(Error::new(
-                    ruby.exception_arg_error(),
-                    format!("Could not parse `match_text_within` (`{css:?}`) as valid CSS",),
-                ));
-            }
-        }
+        let text_selector = match &match_text_within {
+            None => None,
+            Some(css) => match css.parse::<lol_html::Selector>() {
+                Ok(selector) => Some(selector),
+                Err(_) => {
+                    return Err(Error::new(
+                        ruby.exception_arg_error(),
+                        format!("Could not parse `match_text_within` (`{css:?}`) as valid CSS"),
+                    ));
+                }
+            },
+        };
 
         let ignore_text_within = match rb_ignore_text_within {
             None => None,
@@ -57,8 +64,8 @@ impl SelmaSelector {
         };
 
         Ok(Self {
-            match_element,
-            match_text_within,
+            element_selector,
+            text_selector,
             ignore_text_within,
         })
     }
@@ -87,12 +94,12 @@ impl SelmaSelector {
         Ok((match_element, match_text_within, rb_ignore_text_within))
     }
 
-    pub fn match_element(&self) -> Option<&str> {
-        self.match_element.as_deref()
+    pub fn element_selector(&self) -> Option<&lol_html::Selector> {
+        self.element_selector.as_ref()
     }
 
-    pub fn match_text_within(&self) -> Option<&str> {
-        self.match_text_within.as_deref()
+    pub fn text_selector(&self) -> Option<&lol_html::Selector> {
+        self.text_selector.as_ref()
     }
 
     pub fn ignore_text_within(&self) -> Option<&[String]> {

data/ext/selma/src/tags.rs

@@ -208,12 +208,26 @@ impl Tag {
     pub const ESCAPEWORTHY_TAGS_CSS: &'static str =
         "title, textarea, style, xmp, iframe, noembed, noframes, script, plaintext";
 
+    /// Byte-level twin of [`Self::ESCAPEWORTHY_TAGS_CSS`], used to decide whether the
+    /// final sanitization pass has anything to do before paying for a full re-parse.
+    pub const ESCAPEWORTHY_TAG_NAMES: &'static [&'static [u8]] = &[
+        b"title",
+        b"textarea",
+        b"style",
+        b"xmp",
+        b"iframe",
+        b"noembed",
+        b"noframes",
+        b"script",
+        b"plaintext",
+    ];
+
     pub fn html_tags() -> Vec<HTMLTag> {
         all::<HTMLTag>().collect::<Vec<_>>()
     }
 
     pub fn tag_from_element(element: &mut Element) -> Tag {
-        Self::tag_from_tag_name(element.tag_name().to_lowercase().as_str())
+        Self::tag_from_tag_name(&element.tag_name())
     }
 
     pub fn tag_from_tag_name(tag_name: &str) -> Tag {

data/lib/selma/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Selma
-  VERSION = "0.5.2"
+  VERSION = "0.5.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: selma
 version: !ruby/object:Gem::Version
-  version: 0.5.2
+  version: 0.5.3
 platform: ruby
 authors:
 - Garen J. Torikian
@@ -44,6 +44,7 @@ files:
 - ext/selma/src/native_ref_wrap.rs
 - ext/selma/src/rewriter.rs
 - ext/selma/src/sanitizer.rs
+- ext/selma/src/scan.rs
 - ext/selma/src/selector.rs
 - ext/selma/src/tags.rs
 - lib/selma.rb
@@ -84,7 +85,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '3.4'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Selma selects and matches HTML nodes using CSS rules. Backed by Rust's lol_html
   parser.