Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package rubygem-rails-html-sanitizer for
openSUSE:Factory checked in at 2026-11-06 19:47:31
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/rubygem-rails-html-sanitizer (Old)
and /work/SRC/openSUSE:Factory/.rubygem-rails-html-sanitizer.new.3759290
(New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rubygem-rails-html-sanitizer"
Fri Nov 6 19:47:31 2026 rev:15 rq:1395480 version:1.7.2
Changes:
--------
---
/work/SRC/openSUSE:Factory/rubygem-rails-html-sanitizer/rubygem-rails-html-sanitizer.changes
2026-09-10 11:51:13.184158885 +0200
+++
/work/SRC/openSUSE:Factory/.rubygem-rails-html-sanitizer.new.3759290/rubygem-rails-html-sanitizer.changes
2026-11-06 19:53:40.073357459 +0100
@@ -1,0 +2,48 @@
+Wed Nov 4 10:24:46 UTC 2026 - Marcus Rueckert <[email protected]>
+
+- update to 1.7.2
+ - Deciding whether an SVG `href` or `xlink:href` is a local
+ reference no longer takes quadratic time.
+
+ `PermitScrubber` matched the attribute value against a pattern
+ that rescanned the value's whitespace run from every line
+ start, so an all-whitespace value took seconds to scrub. Only
+ Ruby 3.1 and earlier are affected, because Ruby 3.2 introduced
+ linear-time regexp matching. Through `PermitScrubber`,
+ applications are only affected if the allowed tags are
+ overridden to include an SVG reference element such as `use`;
+ the default configuration is not affected.
+
+ This change addresses GHSA-cpgf-5mjf-73p7. `PermitScrubber` now
+ applies the html5lib attribute value rules by calling
+ `Loofah::HTML5::Scrub.scrub_attribute_value` rather than
+ carrying its own copy. The minimum Loofah dependency is now `~>
+ 2.25, >= 2.25.3`.
+
+ *Mike Dalessio*
+
+ - rails-html-sanitizer now requires Ruby >= 3.2, because Loofah
+ 2.25.3 requires it.
+
+ The `1.6.x` and `1.5.x` release branches no longer receive
+ security updates. Every Rails release in security support
+ accepts rails-html-sanitizer 1.7 and requires Ruby >= 3.2.
+
+ *Mike Dalessio*
+
+ - `SafeListSanitizer` no longer shares a `PermitScrubber` across
+ calls.
+
+ Previously one sanitizer instance reused a single
+ `PermitScrubber`, assigning its `tags` and `attributes` on
+ every call. Action View memoizes one sanitizer per helper
+ module, so two concurrent `sanitize` calls with different
+ `tags:` or `attributes:` options could interleave and one call
+ could be scrubbed with the other call's allowlist. Each call
+ now builds its own `PermitScrubber`.
+
+ This change addresses GHSA-h7wh-q2qr-458c.
+
+ *Mike Dalessio*
+
+-------------------------------------------------------------------
@@ -129,0 +178,5 @@
+
+-------------------------------------------------------------------
+Sun May 14 01:31:23 UTC 2023 - Marcus Rueckert <[email protected]>
+
+- cleanup ruby version restrictions
Old:
----
rails-html-sanitizer-1.7.1.gem
New:
----
rails-html-sanitizer-1.7.2.gem
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ rubygem-rails-html-sanitizer.spec ++++++
--- /var/tmp/diff_new_pack.Ig18qm/_old 2026-11-06 19:53:41.116401132 +0100
+++ /var/tmp/diff_new_pack.Ig18qm/_new 2026-11-06 19:53:41.119401258 +0100
@@ -16,19 +16,25 @@
#
+#
+# This file was generated with a gem2rpm.yml and not just plain gem2rpm.
+# All sections marked as MANUAL, license headers, summaries and descriptions
+# can be maintained in that file. Please consult this file before editing any
+# of those fields
+#
+
Name: rubygem-rails-html-sanitizer
-Version: 1.7.1
+Version: 1.7.2
Release: 0
%define mod_name rails-html-sanitizer
%define mod_full_name %{mod_name}-%{version}
-BuildRequires: %{ruby >= 2.7.0}
+BuildRequires: %{ruby >= 3.2.0}
BuildRequires: %{rubygem gem2rpm}
BuildRequires: ruby-macros >= 5
URL: https://github.com/rails/rails-html-sanitizer
Source: https://rubygems.org/gems/%{mod_full_name}.gem
-# This file was generated with a gem2rpm.yml and not just plain gem2rpm.
Source1: gem2rpm.yml
-Summary: This gem is responsible to sanitize HTML fragments in Rails
+Summary: HTML sanitization to Rails applications (part of Rails)
License: MIT
%description
++++++ rails-html-sanitizer-1.7.1.gem -> rails-html-sanitizer-1.7.2.gem ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/CHANGELOG.md new/CHANGELOG.md
--- old/CHANGELOG.md 1980-01-02 01:00:00.000000000 +0100
+++ new/CHANGELOG.md 1980-01-02 01:00:00.000000000 +0100
@@ -1,3 +1,42 @@
+## next / unreleased
+
+
+## v1.7.2 / 2026-11-02
+
+* Deciding whether an SVG `href` or `xlink:href` is a local reference no
longer takes quadratic time.
+
+ `PermitScrubber` matched the attribute value against a pattern that
rescanned the value's
+ whitespace run from every line start, so an all-whitespace value took
seconds to scrub. Only
+ Ruby 3.1 and earlier are affected, because Ruby 3.2 introduced linear-time
regexp matching.
+ Through `PermitScrubber`, applications are only affected if the allowed tags
are overridden to
+ include an SVG reference element such as `use`; the default configuration is
not affected.
+
+ This change addresses GHSA-cpgf-5mjf-73p7. `PermitScrubber` now applies the
html5lib attribute
+ value rules by calling `Loofah::HTML5::Scrub.scrub_attribute_value` rather
than carrying its own
+ copy. The minimum Loofah dependency is now `~> 2.25, >= 2.25.3`.
+
+ *Mike Dalessio*
+
+* rails-html-sanitizer now requires Ruby >= 3.2, because Loofah 2.25.3
requires it.
+
+ The `1.6.x` and `1.5.x` release branches no longer receive security updates.
Every Rails release
+ in security support accepts rails-html-sanitizer 1.7 and requires Ruby >=
3.2.
+
+ *Mike Dalessio*
+
+* `SafeListSanitizer` no longer shares a `PermitScrubber` across calls.
+
+ Previously one sanitizer instance reused a single `PermitScrubber`,
assigning its `tags` and
+ `attributes` on every call. Action View memoizes one sanitizer per helper
module, so two
+ concurrent `sanitize` calls with different `tags:` or `attributes:` options
could interleave and
+ one call could be scrubbed with the other call's allowlist. Each call now
builds its own
+ `PermitScrubber`.
+
+ This change addresses GHSA-h7wh-q2qr-458c.
+
+ *Mike Dalessio*
+
+
## v1.7.1 / 2026-07-15
* SVG reference elements now restrict both `href` and `xlink:href` to local
references.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/README.md new/README.md
--- old/README.md 1980-01-02 01:00:00.000000000 +0100
+++ new/README.md 1980-01-02 01:00:00.000000000 +0100
@@ -234,8 +234,9 @@
| branch | ruby support | actively maintained | security support
|
|--------|--------------|---------------------|----------------------------------------|
-| 1.6.x | >= 2.7 | yes | yes
|
-| 1.5.x | >= 2.5 | no | while Rails 6.1 is in security
support |
+| 1.7.x | >= 3.2 | yes | yes
|
+| 1.6.x | >= 2.7 | no | no
|
+| 1.5.x | >= 2.5 | no | no
|
| 1.4.x | >= 1.8.7 | no | no
|
Binary files old/checksums.yaml.gz and new/checksums.yaml.gz differ
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/rails/html/sanitizer/version.rb
new/lib/rails/html/sanitizer/version.rb
--- old/lib/rails/html/sanitizer/version.rb 1980-01-02 01:00:00.000000000
+0100
+++ new/lib/rails/html/sanitizer/version.rb 1980-01-02 01:00:00.000000000
+0100
@@ -3,7 +3,7 @@
module Rails
module HTML
class Sanitizer
- VERSION = "1.7.1"
+ VERSION = "1.7.2"
end
end
end
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/rails/html/sanitizer.rb
new/lib/rails/html/sanitizer.rb
--- old/lib/rails/html/sanitizer.rb 1980-01-02 01:00:00.000000000 +0100
+++ new/lib/rails/html/sanitizer.rb 1980-01-02 01:00:00.000000000 +0100
@@ -154,7 +154,7 @@
end
def initialize(prune: false)
- @permit_scrubber = PermitScrubber.new(prune: prune)
+ @prune = prune
end
def scrub(fragment, options = {})
@@ -162,9 +162,10 @@
# No duck typing, Loofah ensures subclass of Loofah::Scrubber
fragment.scrub!(scrubber)
elsif allowed_tags(options) || allowed_attributes(options)
- @permit_scrubber.tags = allowed_tags(options)
- @permit_scrubber.attributes = allowed_attributes(options)
- fragment.scrub!(@permit_scrubber)
+ permit_scrubber = PermitScrubber.new(prune: @prune)
+ permit_scrubber.tags = allowed_tags(options)
+ permit_scrubber.attributes = allowed_attributes(options)
+ fragment.scrub!(permit_scrubber)
else
fragment.scrub!(:strip)
end
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/rails/html/scrubbers.rb
new/lib/rails/html/scrubbers.rb
--- old/lib/rails/html/scrubbers.rb 1980-01-02 01:00:00.000000000 +0100
+++ new/lib/rails/html/scrubbers.rb 1980-01-02 01:00:00.000000000 +0100
@@ -160,21 +160,9 @@
end
def scrub_attribute(node, attr_node)
- attr_name = if attr_node.namespace
- "#{attr_node.namespace.prefix}:#{attr_node.node_name}"
- else
- attr_node.node_name
- end
+ attr_name = Loofah::HTML5::Scrub.prefixed_attribute_name(attr_node)
- return if
Loofah::HTML5::SafeList::ATTR_VAL_IS_URI.include?(attr_name) &&
Loofah::HTML5::Scrub.scrub_uri_attribute(attr_node)
-
- if
Loofah::HTML5::SafeList::SVG_ATTR_VAL_ALLOWS_REF.include?(attr_name)
-
Loofah::HTML5::Scrub.scrub_attribute_that_allows_local_ref(attr_node)
- end
-
- if Loofah::HTML5::SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name)
&& Loofah::HTML5::SafeList::SVG_HREF_ATTRIBUTES.include?(attr_name) &&
attr_node.value =~ /^\s*[^#\s].*/m
- attr_node.remove
- end
+ return if Loofah::HTML5::Scrub.scrub_attribute_value(node,
attr_node, attr_name)
node.remove_attribute(attr_node.name) if attr_name == "src" &&
attr_node.value !~ /[^[:space:]]/
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/metadata new/metadata
--- old/metadata 1980-01-02 01:00:00.000000000 +0100
+++ new/metadata 1980-01-02 01:00:00.000000000 +0100
@@ -1,7 +1,7 @@
--- !ruby/object:Gem::Specification
name: rails-html-sanitizer
version: !ruby/object:Gem::Version
- version: 1.7.1
+ version: 1.7.2
platform: ruby
authors:
- Rafael Mendonça França
@@ -20,7 +20,7 @@
version: '2.25'
- - ">="
- !ruby/object:Gem::Version
- version: 2.25.2
+ version: 2.25.3
type: :runtime
prerelease: false
version_requirements: !ruby/object:Gem::Requirement
@@ -30,7 +30,7 @@
version: '2.25'
- - ">="
- !ruby/object:Gem::Version
- version: 2.25.2
+ version: 2.25.3
- !ruby/object:Gem::Dependency
name: nokogiri
requirement: !ruby/object:Gem::Requirement
@@ -120,9 +120,9 @@
- MIT
metadata:
bug_tracker_uri: https://github.com/rails/rails-html-sanitizer/issues
- changelog_uri:
https://github.com/rails/rails-html-sanitizer/blob/v1.7.1/CHANGELOG.md
- documentation_uri: https://www.rubydoc.info/gems/rails-html-sanitizer/1.7.1
- source_code_uri: https://github.com/rails/rails-html-sanitizer/tree/v1.7.1
+ changelog_uri:
https://github.com/rails/rails-html-sanitizer/blob/v1.7.2/CHANGELOG.md
+ documentation_uri: https://www.rubydoc.info/gems/rails-html-sanitizer/1.7.2
+ source_code_uri: https://github.com/rails/rails-html-sanitizer/tree/v1.7.2
rdoc_options: []
require_paths:
- lib
@@ -130,14 +130,14 @@
requirements:
- - ">="
- !ruby/object:Gem::Version
- version: 2.7.0
+ version: 3.2.0
required_rubygems_version: !ruby/object:Gem::Requirement
requirements:
- - ">="
- !ruby/object:Gem::Version
version: '0'
requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.20
specification_version: 4
summary: This gem is responsible to sanitize HTML fragments in Rails
applications.
test_files: []
