In the Loofah gem, through v2.3.0, unsanitized JavaScript may occur in
sanitized output when a crafted SVG element is republished.

2.3.1

2.3.1 / 2019-10-22

Security

Address CVE-2019-15587: Unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

This CVE's public notice is at #171

2.3.0 (from changelog)

Features

• Expand set of allowed protocols to include tel: and line:. [#104, #147]
• Expand set of allowed CSS functions. [related to #122]
• Allow greater precision in shorthand CSS values. [#149] (Thanks, @danfstucky!)
• Allow CSS property list-style [#162] (Thanks, @jaredbeck!)
• Allow CSS keywords thick and thin [#168] (Thanks, @georgeclaghorn!)
• Allow HTML property contenteditable [#167] (Thanks, @andreynering!)

Bug fixes

• CSS hex values are no longer limited to lowercase hex. Previously uppercase hex were scrubbed. [#165] (Thanks, @asok!)

Deprecations / Name Changes

The following method and constants are hereby deprecated, and will be completely removed in a future release:

• Deprecate Loofah::Helpers::ActionView.white_list_sanitizer, please use Loofah::Helpers::ActionView.safe_list_sanitizer instead.
• Deprecate Loofah::Helpers::ActionView::WhiteListSanitizer, please use Loofah::Helpers::ActionView::SafeListSanitizer instead.
• Deprecate Loofah::HTML5::WhiteList, please use Loofah::HTML5::SafeList instead.

Thanks to @JuanitoFatas for submitting these changes in #164 and for making the language used in Loofah more inclusive.

2.2.3

Notably, this release addresses CVE-2018-16468.

Does any of this look wrong? Please let us know.

See the full diff on Github. The new version differs by 48 commits:

• version bump to v2.3.1
• Merge pull request #172 from flavorjones/171-xss-vulnerability
• update CHANGELOG
• mitigate XSS vulnerability in SVG animate attributes
• rufo formatting
• formatting in README
• update CHANGELOG with release date
• update dev gemspec
• version bump to v2.3.0
• update dev deps
• update README to work with modern Hoe
• update Manifest
• Merge branch 'jf.safelist'
• formatting CHANGELOG
• Only call deprecate_constant if available
• Use safelist consistently
• Use safelist(s), allowlist(s) where applicable
• update CHANGELOG
• ci: remove unused code from rake-test/run.sh
• Merge pull request #167 from jobscore/allow-html-property-contenteditable
• Merge pull request #168 from georgeclaghorn/border-width-keyword-values
• Allow the thin and thick CSS keywords
• Allow HTML property: contenteditable
• update to latest concourse-gem
• update dev dependencies
• changelog: update for #162
• Merge pull request #162 from jaredbeck/allow_list-style
• changelog: update for #165
• Merge pull request #165 from asok/correct-css-keywordish-regexp
• Fix test for style attribute scrubbing
• Add a test for testing style attribute scrubbing
• Correct the regexp for kewordish css property which hold a hex value
• Allow CSS property `list-style`
• cherry-pick v2.2.3 changelog entry
• remove the svg animate attribute `from` from the allowlist
• remove versioneye from readme
• Merge branch 'flavorjones-allowlist-changes'
• update CHANGELOG
• Allow greater precision in values of shorthand css elements
• failing test for high-precision CSS values
• update CHANGELOG
• expand allowed protocols to allow `tel:` and `line:`
• expand set of allowed CSS functions
• reformat `whitelist.rb`
• scripts to inspect and compare DOMPurify metadata
• add formatting to CHANGELOG
• updated mailing list to a new Google Group
• extract msword html data into an asset file

1.0.5

• Removed test files from the gem. (#8 - @t-richards)

Does any of this look wrong? Please let us know.

See the full diff on Github. The new version differs by 4 commits:

• Release 1.0.5
• Remove test files and omit them
• Remove 1.9.3 from the test matrix
• Update Travis test matrix

See the full diff on Github. The new version differs by 10 commits:

• version bump to v2.4.0
• update CHANGELOG in preparation for v2.4.0
• update dev dependencies
• Merge pull request #86 from eagletmt/skip-progress-when-chunked
• Merge pull request #87 from halfbyte/patch-1
• Make version in changelog fit release version.
• Skip progress report when Content-Length is unavailable
• update test:examples to libiconv 1.15
• concourse: test most-recent two rubies
• convert to using windows-ruby-dev-tools-release

1.10.4

1.10.4 / 2019-08-11

Security

Address CVE-2019-5477 (#1915)

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess by Ruby's Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizer#load_file is being passed untrusted user input.

This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.

This CVE's public notice is #1915

1.10.3

1.10.3 / 2019-04-22

Security Notes

[MRI] Pulled in upstream patch from libxslt that addresses CVE-2019-11068. Full details are available in #1892. Note that this patch is not yet (as of 2019-04-22) in an upstream release of libxslt.

1.10.2

1.10.2 / 2019-03-24

Security

• [MRI] Remove support from vendored libxml2 for future script macros. [#1871]
• [MRI] Remove support from vendored libxml2 for server-side includes within attributes. [#1877]

Bug fixes

• [JRuby] Fix node ownership in duplicated documents. [#1060]
• [JRuby] Rethrow exceptions caught by Java SAX handler. [#1847, #1872] (Thanks, @adjam!)

1.10.1

1.10.1 / 2019-01-13

Features

• [MRI] During installation, handle Xcode 10's new library pathOS. [#1801, #1851] (Thanks, @mlj and @deepj!)
• Avoid unnecessary creation of Procs in many methods. [#1776] (Thanks, @chopraanmol1!)

Bug fixes

• CSS selector :has() now correctly matches against any descendant. Previously this selector matched against only direct children). [#350] (Thanks, @Phrogz!)
• NodeSet#attr now returns nil if it's empty. Previously this raised a NoMethodError.
• [MRI] XPath errors are no longer suppressed during XSLT::Stylesheet#transform. Previously these errors were suppressed which led to silent failures and a subsequent segfault. [#1802]

1.10.0

1.10.0 / 2019-01-04

Features

• [MRI] Cross-built Windows gems now support Ruby 2.6 [#1842, #1850]

Backwards incompatibilities

This release ends support for:

• Ruby 2.2, for which official support ended on 2018-03-31 [#1841]
• JRuby 1.7, for which official support ended on 2017-11-21 [#1741]

Dependencies

• [MRI] libxml2 is updated from 2.9.8 to 2.9.9
• [MRI] libxslt is updated from 1.1.32 to 1.1.33

1.9.1

1.9.1 / 2018-12-17

Bug fixes

• Fix a bug introduced in v1.9.0 where XML::DocumentFragment#dup no longer returned an instance of the callee's class, instead always returning an XML::DocumentFragment. This notably broke any subclass of XML::DocumentFragment including HTML::DocumentFragment as well as the Loofah gem's Loofah::HTML::DocumentFragment. [#1846]

1.9.0

1.9.0 / 2018-12-17

Security Notes

• [JRuby] Upgrade Xerces dependency from 2.11.0 to 2.12.0 to address upstream vulnerability CVE-2012-0881 [#1831] (Thanks @grajagandev for reporting.)

Notable non-functional changes

• Decrease installation size by removing many unneeded files (e.g., /test) from the packaged gems. [#1719] (Thanks, @stevecrozz!)

Features

• XML::Attr#value= allows HTML node attribute values to be set to either a blank string or an empty boolean attribute. [#1800]
• Introduce XML::Node#wrap which does what XML::NodeSet#wrap has always done, but for a single node. [#1531] (Thanks, @ethirajsrinivasan!)
• [MRI] Improve installation experience on macOS High Sierra (Darwin). [#1812, #1813] (Thanks, @gpakosz and @nurse!)
• [MRI] Node#dup supports copying a node directly to a new document. See the method documentation for details.
• [MRI] DocumentFragment#dup is now more memory-efficient, avoiding making unnecessary copies. [#1063]
• [JRuby] NodeSet has been rewritten to improve performance! [#1795]

Bug fixes

• NodeSet#each now returns self instead of zero. [#1822] (Thanks, @olehif!)
• [MRI] Address a memory leak when using XML::Builder to create nodes with namespaces. [#1810]
• [MRI] Address a memory leak when unparenting a DTD. [#1784] (Thanks, @stevecheckoway!)
• [MRI] Use RbConfig::CONFIG instead of ::MAKEFILE_CONFIG to fix installations that use Makefile macros. [#1820] (Thanks, @nobu!)
• [JRuby] Decrease large memory usage when making nested XPath queries. [#1749]
• [JRuby] Fix failing tests on JRuby 9.2.x
• [JRuby] Fix default namespaces in nodes reparented into a different document [#1774]
• [JRuby] Fix support for Java 9. [#1759] (Thanks, @Taywee!)

Dependencies

• [MRI] Upgrade mini_portile2 dependency from ~> 2.3.0 to ~> 2.4.0

Does any of this look wrong? Please let us know.

See the full diff on Github. The new version differs by more commits than we can show here.

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)