| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: ruby4.0-rubygem-rails-html-sanitizer | Distribution: openSUSE Tumbleweed |
| Version: 1.7.0 | Vendor: openSUSE |
| Release: 1.1 | Build date: Fri Mar 13 09:43:49 2026 |
| Group: Development/Languages/Ruby | Build host: reproducible |
| Size: 70715 | Source RPM: rubygem-rails-html-sanitizer-1.7.0-1.1.src.rpm |
| Packager: https://bugs.opensuse.org | |
| Url: https://github.com/rails/rails-html-sanitizer | |
| Summary: HTML sanitization to Rails applications (part of Rails) | |
HTML sanitization for Rails applications.
MIT
* Fri Mar 13 2026 Johannes Segitz <jsegitz@suse.com>
- Update to version 1.7.0
* Add Rails::HTML::Sanitizer.allowed_uri? which delegates to
Loofah::HTML5::Scrub.allowed_uri?, allowing the Rails framework to check
URI safety without a direct dependency on Loofah.
* The minimum Loofah dependency is now ~> 2.25.
* Mon Dec 16 2024 Paolo Perego <paolo.perego@suse.com>
- Update to version 1.6.2
* PermitScrubber fully supports frozen "allowed tags".
- v1.6.1 introduced safety checks that may remove unsafe tags from the
allowed list, which introduced a regression for applications passing
a frozen array of allowed tags. Tags and attributes are now properly
copied when they are passed to the scrubber.
- Version 1.6.1
* The dependency on Nokogiri is updated to v1.15.7 or >=1.16.8. This change
addresses CVE-2024-53985 (GHSA-w8gc-x259-rc7x).
* Disallowed tags will be pruned when they appear in foreign content (i.e.
SVG or MathML content), regardless of the prune: option value. Previously,
disallowed tags were "stripped" unless the gem was configured with the
prune: true option.
The CVEs addressed by this change are:
* CVE-2024-53986 (GHSA-638j-pmjw-jq48)
* CVE-2024-53987 (GHSA-2x5m-9ch4-qgrr)
* The tags "noscript", "mglyph", and "malignmark" will not be allowed, even
if explicitly added to the allowlist. If applications try to allow any of
these tags, a warning is emitted and the tags are removed from the
allow-list.
The CVEs addressed by this change are:
* CVE-2024-53988 (GHSA-cfjx-w229-hgx5)
* CVE-2024-53989 (GHSA-rxv5-gxqc-xx8g)
Please note that we may restore support for allowing "noscript" in a future
release. We do not expect to ever allow "mglyph" or "malignmark", though,
especially since browser support is minimal for these tags.
* Improve performance by eliminating needless operations on attributes that
are being removed.
* Mike Dalessio*
* Thu Aug 31 2023 Paolo Perego <paolo.perego@suse.com>
- Updated to version 1.6.0
* Dependencies have been updated:
- Loofah `~>2.21` and Nokogiri `~>1.14` for HTML5 parser support
- As a result, required Ruby version is now `>= 2.7.0`
Security updates will continue to be made on the `1.5.x` release branch as long as Rails 6.1
(which supports Ruby 2.5) is still in security support.
* Mike Dalessio*
* HTML5 standards-compliant sanitizers are now available on platforms supported by
Nokogiri::HTML5. These are available as:
- `Rails::HTML5::FullSanitizer`
- `Rails::HTML5::LinkSanitizer`
- `Rails::HTML5::SafeListSanitizer`
And a new "vendor" is provided at `Rails::HTML5::Sanitizer` that can be used in a future version
of Rails.
Note that for symmetry `Rails::HTML4::Sanitizer` is also added, though its behavior is identical
to the vendor class methods on `Rails::HTML::Sanitizer`.
Users may call `Rails::HTML::Sanitizer.best_supported_vendor` to get back the HTML5 vendor if it's
supported, else the legacy HTML4 vendor.
* Mike Dalessio*
* Module namespaces have changed, but backwards compatibility is provided by aliases.
The library defines three additional modules:
- `Rails::HTML` for general functionality (replacing `Rails::Html`)
- `Rails::HTML4` containing sanitizers that parse content as HTML4
- `Rails::HTML5` containing sanitizers that parse content as HTML5
The following aliases are maintained for backwards compatibility:
- `Rails::Html` points to `Rails::HTML`
- `Rails::HTML::FullSanitizer` points to `Rails::HTML4::FullSanitizer`
- `Rails::HTML::LinkSanitizer` points to `Rails::HTML4::LinkSanitizer`
- `Rails::HTML::SafeListSanitizer` points to `Rails::HTML4::SafeListSanitizer`
* Mike Dalessio*
* `LinkSanitizer` always returns UTF-8 encoded strings. `SafeListSanitizer` and `FullSanitizer`
already ensured this encoding.
* Mike Dalessio*
* `SafeListSanitizer` allows `time` tag and `lang` attribute by default.
* Mike Dalessio*
* The constant `Rails::Html::XPATHS_TO_REMOVE` has been removed. It's not necessary with the
existing sanitizers, and should have been a private constant all along anyway.
* Mike Dalessio*
- Removed comparison against a very old ruby code no longer maintained
- Updated description in spec file
* Wed Feb 22 2023 Paolo Perego <paolo.perego@suse.com>
- updated to version 1.5.0
* SafeListSanitizer, PermitScrubber, and TargetScrubber now all support pruning of unsafe tags.
By default, unsafe tags are still stripped, but this behavior can be
changed to prune the elementand its children from the document by passing
prune: true to any of these classes' constructors.
@seyerian
[#]# 1.4.4 / 2022-12-13
* Address inefficient regular expression complexity with certain configurations of Rails::Html::Sanitizer.
Fixes CVE-2022-23517 (bsc#1206433). See GHSA-5x79-w82f-gw8w for more information.
_Mike Dalessio_
* Address improper sanitization of data URIs.
Fixes CVE-2022-23518 (bsc#1206434) and #135. See GHSA-mcvf-2q2m-x72m for more information.
_Mike Dalessio_
* Address possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.
Fixes CVE-2022-23520 (bsc#1206436). See GHSA-rrfc-7g8p-99q8 for more information.
_Mike Dalessio_
* Address possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.
Fixes CVE-2022-23519 (bsc#1206435). See GHSA-9h9g-93gc-623h for more information.
_Mike Dalessio_
* Mon Jun 13 2022 Manuel Schnitzer <mschnitzer@suse.com>
- updated to version 1.4.3
* Address a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.
Prevent the combination of `select` and `style` as allowed tags in SafeListSanitizer.
Fixes CVE-2022-32209: bsc#1201183. File 0001_CVE-2022-32209.patch no longer required.
* Mike Dalessio*
* Wed Aug 25 2021 Manuel Schnitzer <mschnitzer@suse.com>
- updated to version 1.4.2
* Slightly improve performance.
Assuming elements are more common than comments, make one less method call per node.
* Mike Dalessio*
[#]# 1.4.1 / 2021-08-18
* Fix regression in v1.4.0 that did not pass comment nodes to the scrubber.
Some scrubbers will want to override the default behavior and allow comments, but v1.4.0 only
passed through elements to the scrubber's `keep_node?` method.
This change once again allows the scrubber to make the decision on comment nodes, but still skips
other non-elements like processing instructions (see #115).
* Mike Dalessio*
[#]# 1.4.0 / 2021-08-18
* Processing Instructions are no longer allowed by Rails::Html::PermitScrubber
Previously, a PI with a name (or "target") matching an allowed tag name was not scrubbed. There
are no known security issues associated with these PIs, but similar to comments it's preferred to
omit these nodes when possible from sanitized output.
Fixes #115.
* Mike Dalessio*
* Tue Nov 12 2019 Manuel Schnitzer <mschnitzer@suse.com>
- updated to version 1.3.0
* Address deprecations in Loofah 2.3.0.
* Josh Goodall*
* Thu Aug 15 2019 Manuel Schnitzer <mschnitzer@suse.com>
- updated to version 1.2.0
* Remove needless `white_list_sanitizer` deprecation.
By deprecating this, we were forcing Rails 5.2 to be updated or spew
deprecations that users could do nothing about.
That's pointless and I'm sorry for adding that!
Now there's no deprecation warning and Rails 5.2 works out of the box, while
Rails 6 can use the updated naming.
* Kasper Timm Hansen*
* Fri Mar 23 2018 dkang@suse.com
- updated to version 1.0.4
* CVE-2018-3741: XSS vulnerability
see installed CHANGELOG.md
fix bsc#1086598
* Tue Jan 26 2016 coolo@suse.com
- updated to version 1.0.3:
* boo#963326: CVE-2015-7578: XSS vulnerability via attributes
* boo#963327: CVE-2015-7579: XSS vulnerability
* boo#963328: CVE-2015-7580: XSS via whitelist sanitizer
/usr/lib64/ruby/gems/4.0.0/build_info /usr/lib64/ruby/gems/4.0.0/cache/rails-html-sanitizer-1.7.0.gem /usr/lib64/ruby/gems/4.0.0/gems/rails-html-sanitizer-1.7.0 /usr/lib64/ruby/gems/4.0.0/gems/rails-html-sanitizer-1.7.0/CHANGELOG.md /usr/lib64/ruby/gems/4.0.0/gems/rails-html-sanitizer-1.7.0/MIT-LICENSE /usr/lib64/ruby/gems/4.0.0/gems/rails-html-sanitizer-1.7.0/README.md /usr/lib64/ruby/gems/4.0.0/gems/rails-html-sanitizer-1.7.0/lib /usr/lib64/ruby/gems/4.0.0/gems/rails-html-sanitizer-1.7.0/lib/rails /usr/lib64/ruby/gems/4.0.0/gems/rails-html-sanitizer-1.7.0/lib/rails-html-sanitizer.rb /usr/lib64/ruby/gems/4.0.0/gems/rails-html-sanitizer-1.7.0/lib/rails/html /usr/lib64/ruby/gems/4.0.0/gems/rails-html-sanitizer-1.7.0/lib/rails/html/sanitizer /usr/lib64/ruby/gems/4.0.0/gems/rails-html-sanitizer-1.7.0/lib/rails/html/sanitizer.rb /usr/lib64/ruby/gems/4.0.0/gems/rails-html-sanitizer-1.7.0/lib/rails/html/sanitizer/version.rb /usr/lib64/ruby/gems/4.0.0/gems/rails-html-sanitizer-1.7.0/lib/rails/html/scrubbers.rb /usr/lib64/ruby/gems/4.0.0/specifications/rails-html-sanitizer-1.7.0.gemspec /usr/share/doc/packages/ruby4.0-rubygem-rails-html-sanitizer /usr/share/doc/packages/ruby4.0-rubygem-rails-html-sanitizer/CHANGELOG.md /usr/share/doc/packages/ruby4.0-rubygem-rails-html-sanitizer/MIT-LICENSE /usr/share/doc/packages/ruby4.0-rubygem-rails-html-sanitizer/README.md
Generated by rpm2html 1.8.1
Fabrice Bellet, Tue Apr 21 22:32:08 2026