CVS commit: pkgsrc/textproc/ruby-sanitize

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Sat Feb  4 13:33:10 UTC 2023

Modified Files:
        pkgsrc/textproc/ruby-sanitize: Makefile distinfo

Log Message:
textproc/ruby-sanitize: update to 6.0.1

6.0.1 (2023-01-27)

Bug Fixes

* Sanitize now always removes <noscript> elements and their contents, even
  when noscript is in the allowlist.

  This fixes a sanitization bypass that could occur when noscript was
  allowed by a custom allowlist.  In this scenario, carefully crafted input
  could sneak arbitrary HTML through Sanitize, potentially enabling an XSS
  (cross-site scripting) attack.

  Sanitize's default configs don't allow <noscript> elements and are not
  vulnerable.  This issue only affects users who are using a custom config
  that adds noscript to the element allowlist.

  The root cause of this issue is that HTML parsing rules treat the contents
  of a <noscript> element differently depending on whether scripting is
  enabled in the user agent.  Nokogiri doesn't support scripting so it
  follows the "scripting disabled" rules, but a web browser with scripting
  enabled will follow the "scripting enabled" rules.  This means that
  Sanitize can't reliably make the contents of a <noscript> element safe for
  scripting enabled browsers, so the safest thing to do is to remove the
  element and its contents entirely.

  See the following security advisory for additional details:
  GHSA-fw3g-2h3j-qmm7

  Thanks to David Klein from TU Braunschweig (@leeN) for reporting this
  issue.

* Fixed an edge case in which the contents of an "unescaped text" element
  (such as <noembed> or <xmp>) were not properly escaped if that element was
  allowlisted and was also inside an allowlisted <math> or <svg> element.

  The only way to encounter this situation was to ignore multiple warnings
  in the readme and create a custom config that allowlisted all the elements
  involved, including <math> or <svg>.  If you're using a default config or
  if you heeded the warnings about MathML and SVG not being supported,
  you're not affected by this issue.

  Please let this be a reminder that Sanitize cannot safely sanitize MathML
  or SVG content and does not support this use case.  The default configs
  don't allow MathML or SVG elements, and allowlisting MathML or SVG
  elements in a custom config may create a security vulnerability in your
  application.

  Documentation has been updated to add more warnings and to make the
  existing warnings about this more prominent.

  Thanks to David Klein from TU Braunschweig (@leeN) for reporting this
  issue.


To generate a diff of this commit:
cvs rdiff -u -r1.1 -r1.2 pkgsrc/textproc/ruby-sanitize/Makefile \
    pkgsrc/textproc/ruby-sanitize/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/textproc/ruby-sanitize/Makefile
diff -u pkgsrc/textproc/ruby-sanitize/Makefile:1.1 pkgsrc/textproc/ruby-sanitize/Makefile:1.2
--- pkgsrc/textproc/ruby-sanitize/Makefile:1.1  Tue Aug 30 15:37:23 2022
+++ pkgsrc/textproc/ruby-sanitize/Makefile      Sat Feb  4 13:33:10 2023
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.1 2022/08/30 15:37:23 taca Exp $
+# $NetBSD: Makefile,v 1.2 2023/02/04 13:33:10 taca Exp $
 
-DISTNAME=      sanitize-6.0.0
+DISTNAME=      sanitize-6.0.1
 CATEGORIES=    textproc
 
 MAINTAINER=    pkgsrc-users%NetBSD.org@localhost
Index: pkgsrc/textproc/ruby-sanitize/distinfo
diff -u pkgsrc/textproc/ruby-sanitize/distinfo:1.1 pkgsrc/textproc/ruby-sanitize/distinfo:1.2
--- pkgsrc/textproc/ruby-sanitize/distinfo:1.1  Tue Aug 30 15:37:23 2022
+++ pkgsrc/textproc/ruby-sanitize/distinfo      Sat Feb  4 13:33:10 2023
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.1 2022/08/30 15:37:23 taca Exp $
+$NetBSD: distinfo,v 1.2 2023/02/04 13:33:10 taca Exp $
 
-BLAKE2s (sanitize-6.0.0.gem) = bbeeee0abb01b6a1a951d82f78995e49dd969b86ac6e38727bdd0e03a2c94bc8
-SHA512 (sanitize-6.0.0.gem) = 32c3bdab98e4caec6d0e6f4df86ceffa427dc799a40b65d1c71e9ecb9c2a97c43cd801e46df02337264c362f545f0b3efaf8679c1d92f84f0b90296d6e7e4150
-Size (sanitize-6.0.0.gem) = 45056 bytes
+BLAKE2s (sanitize-6.0.1.gem) = 7cd8b6d8845065bf5c90b60e2aec935376b87115c0849294692c34cb960a13eb
+SHA512 (sanitize-6.0.1.gem) = 361141150022788dbb804230621f4003d50d82ce6c8767581a3ec74d61388088546f3105a60b440bedb602de1b06d3a3625218f9e0a23c19409fad3385151267
+Size (sanitize-6.0.1.gem) = 47616 bytes