sutty-liquid 0.11.12 → 0.12.0rc0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d557f17924a4468f376f2543a21499ea563d5f4056fa22b2bbab6b7c87deb9eb
-  data.tar.gz: 2295324bafca5933965489267331e2bededa581a1d8b247a13848c69e0f840f9
+  metadata.gz: 9a115b92ca64ac9e835375765973be8644207695da46a8eb542780365f963081
+  data.tar.gz: 5ed09726684f3a905e11afc6dd82b822dfe8cba9ba50eb1a5b5677e348c36c94
 SHA512:
-  metadata.gz: 352ec53763d94689cc54cce696557b6f84ad0ca6c56a9c045c13b7048a32940c64769c0323420edc859b10c0b99b4b6f462b056be6cbfef6a3c3c741eae28aae
-  data.tar.gz: d89b6086998d1195897d5b1dbb4dda9ae4fac81be7330e704fcf4e389bf496ab63f8ffde81cd1c4c2ba8271e50abd8891588c6551672b5766acd5623b190894a
+  metadata.gz: a135688c8a8bba5d0742e4c7536b44eb6db8a0c24ed0123394dfa257835d854f25fdccc5c668c7710c3fac4a5fa09bbbd4878476dd361f58c82abd89b8e56abd
+  data.tar.gz: a2d4bf13672469e9f4e39598c2f103163a89e8673a58e5a866108c241aac367a36a8dea657f2e1392d0f2711caed43cff9264e163b25890acaed265bcb1ff1a3

data/lib/jekyll/filters/strings.rb

@@ -75,6 +75,60 @@ module Jekyll
 
         Addressable::URI.encode_component input.to_s, Addressable::URI::CharacterClasses::UNRESERVED
       end
+
+
+      # Sanitizes HTML. By default follows Sutty CMS allowlist.
+      #
+      # @todo Benchmark Jekyll cache, because it'll need to hash all params
+      # @param input [String]
+      # @param tags [String,Array<String>] Allowed elements. Can be a comma-separated string
+      # @param attrs [String,Array<String>] Allowed attributes. Can be a comma-separated string
+      def sanitize_html(input, tags = nil, attrs = nil)
+        tags = list_to_array(tags, ALLOWED_TAGS)
+        attrs = list_to_array(attrs, ALLOWED_ATTRIBUTES)
+
+        sanitizer.sanitize(input.to_s.tr("\r", '').unicode_normalize, tags: tags, attributes: attrs).strip
+      end
+
+      ALLOWED_ATTRIBUTES = %w[style href src alt controls data-align data-multimedia data-multimedia-inner id name rel target referrerpolicy class colspan rowspan role data-turbo start type reversed].freeze
+      ALLOWED_TAGS = %w[strong em del u mark p h1 h2 h3 h4 h5 h6 ul ol li img iframe audio video div figure blockquote figcaption a sub sup small table thead tbody tfoot tr th td br code].freeze
+
+      private
+
+      # Turn values to arrays or return a default array if empty. Use a
+      # class-level cache because we'll probably parse tags and
+      # attributes many times.
+      #
+      # @param input [String,Array<String>]
+      # @param default [Array<String>]
+      # @return [Array<String>]
+      def list_to_array(input, default)
+        @@list_to_array ||= {}
+        @@list_to_array[input] ||=
+          begin
+            array =
+              case input
+              when Array then input
+              else input.to_s.split(',').map(&:strip)
+              end
+
+            if array.empty?
+              default
+            else
+              array
+            end
+          end
+      end
+
+      def sanitizer
+        @@sanitizer ||=
+          begin
+            require 'rails/html/sanitizer'
+            require 'rails/html/scrubbers'
+
+            Rails::HTML5::Sanitizer.safe_list_sanitizer.new
+          end
+      end
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sutty-liquid
 version: !ruby/object:Gem::Version
-  version: 0.11.12
+  version: 0.12.0rc0
 platform: ruby
 authors:
 - f
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-07-01 00:00:00.000000000 Z
+date: 2024-07-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: fast_blank
@@ -38,6 +38,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '4'
+- !ruby/object:Gem::Dependency
+  name: rails-html-sanitizer
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.6.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.6.0
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
@@ -176,9 +190,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: 2.7.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - ">"
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 1.3.1
 requirements: []
 rubygems_version: 3.3.26
 signing_key: