./textproc/ruby-sanitize, Allowlist-based HTML and CSS sanitizer

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]

Branch: CURRENT, Version: 6.1.3, Package name: ruby32-sanitize-6.1.3, Maintainer: pkgsrc-users

Sanitize is an allowlist-based HTML and CSS sanitizer. It removes all HTML
and/or CSS from a string except the elements, attributes, and properties you
choose to allow.


Required to run:
[textproc/ruby-nokogiri] [www/ruby-crass] [lang/ruby31-base]

Master sites:

Filesize: 47 KB

Version history: (Expand)

CVS history: (Expand)


   2024-09-22 08:49:07 by Takahiro Kambe | Files touched by this commit (2) | Package updated
Log message:
textproc/ruby-sanitize: update to 6.1.3

6.1.2 (2024-07-27)

Bug Fixes

* The CSS URL protocol allowlist is now properly enforced in CSS Images
  Module Level 4 image and image-set functions. @ltk - #240

6.1.3 (2024-08-14)

Bug Fixes

* The CSS URL protocol allowlist is now enforced on the nonstandard
  -webkit-image-set CSS function. @ltk - #242
   2024-07-28 15:41:03 by Takahiro Kambe | Files touched by this commit (2) | Package updated
Log message:
textproc/ruby-sanitize: update to 6.1.2

6.1.2 (2024-07-27)

Bug Fixes

* The CSS URL protocol allowlist is now properly enforced in CSS Images
  Module Level 4 image and image-set functions. @ltk - #240
   2024-06-15 18:32:25 by Takahiro Kambe | Files touched by this commit (2) | Package updated
Log message:
textproc/ruby-sanitize: update to 6.1.1

6.1.1 (2024-06-13)

* Proactively fixed a compatibility issue with libxml >= 2.13.0 (which will
  be used in an upcoming version of Nokogiri) that caused HTML doctype
  sanitization to fail.  @flavorjones - #238
   2023-09-18 19:37:33 by Takahiro Kambe | Files touched by this commit (2) | Package updated
Log message:
textproc/ruby-sanitize: update to 6.1.0

6.1.0 (2023-09-14)

Features

* Added the text-decoration-skip-ink and text-decoration-thickness CSS
  properties to the relaxed config.  @martineriksson - #228
   2023-07-09 04:56:28 by Takahiro Kambe | Files touched by this commit (2) | Package updated
Log message:
textproc/ruby-sanitize: update to 6.0.2

6.0.2 (2023-07-06)

Bug Fixes

* CVE-2023-36823: Fixed an HTML+CSS sanitization bypass that could allow XSS
  (cross-site scripting). This issue affects Sanitize versions 3.0.0 through
  6.0.1.

  When using Sanitize's relaxed config or a custom config that allows
  <style> elements and one or more CSS at-rules, carefully crafted input
  could be used to sneak arbitrary HTML through Sanitize.

  See the following security advisory for additional details:
  GHSA-f5ww-cq3m-q3g7

  Thanks to @cure53 for finding this issue.
   2022-08-30 17:37:23 by Takahiro Kambe | Files touched by this commit (4) 
Log message:
textproc/ruby-sanitize: add package version 6.0.0

It is required for forthcoming redmine50 package.

Sanitize is an allowlist-based HTML and CSS sanitizer.  It removes all HTML
and/or CSS from a string except the elements, attributes, and properties you
choose to allow.