Codebase list ruby-html-pipeline / 0adc6f7
Update upstream source from tag 'upstream/2.8.4' Update to upstream version '2.8.4' with Debian dir 79662d240f2e096927d4e593ab77130a633be98c Lucas Kanashiro 5 years ago
6 changed file(s) with 51 addition(s) and 40 deletion(s). Raw diff Collapse all Expand all
+1
-1
Gemfile less more
1515 gem 'minitest'
1616 gem 'RedCloth', '~> 4.2.9', require: false
1717 gem 'rinku', '~> 1.7', require: false
18 gem 'sanitize', '~> 2.0', require: false
18 gem 'sanitize', '~> 4.6', require: false
1919
2020 gem 'escape_utils', '~> 1.0', require: false
2121 gem 'rouge', '~> 3.1', require: false
+1
-0
README.md less more
185185 * `PlainTextInputFilter` - `escape_utils`
186186 * `SanitizationFilter` - `sanitize`
187187 * `SyntaxHighlightFilter` - `rouge`
188 * `TableOfContentsFilter` - `escape_utils`
188189 * `TextileFilter` - `RedCloth`
189190
190191 _Note:_ See [Gemfile](/Gemfile) `:test` block for version requirements.
+38
-36
lib/html/pipeline/sanitization_filter.rb less more
4040 elements: %w[
4141 h1 h2 h3 h4 h5 h6 h7 h8 br b i strong em a pre code img tt
4242 div ins del sup sub p ol ul table thead tbody tfoot blockquote
43 dl dt dd kbd q samp var hr ruby rt rp li tr td th s strike summary details
44 ],
45 remove_contents: ['script'],
43 dl dt dd kbd q samp var hr ruby rt rp li tr td th s strike summary
44 details caption figure figcaption
45 ].freeze,
46 remove_contents: ['script'].freeze,
4647 attributes: {
47 'a' => ['href'],
48 'img' => %w[src longdesc],
49 'div' => %w[itemscope itemtype],
50 'blockquote' => ['cite'],
51 'del' => ['cite'],
52 'ins' => ['cite'],
53 'q' => ['cite'],
54 :all => ['abbr', 'accept', 'accept-charset',
55 'accesskey', 'action', 'align', 'alt', 'axis',
56 'border', 'cellpadding', 'cellspacing', 'char',
57 'charoff', 'charset', 'checked',
58 'clear', 'cols', 'colspan', 'color',
59 'compact', 'coords', 'datetime', 'dir',
60 'disabled', 'enctype', 'for', 'frame',
61 'headers', 'height', 'hreflang',
62 'hspace', 'ismap', 'label', 'lang',
63 'maxlength', 'media', 'method',
64 'multiple', 'name', 'nohref', 'noshade',
65 'nowrap', 'open', 'prompt', 'readonly', 'rel', 'rev',
66 'rows', 'rowspan', 'rules', 'scope',
67 'selected', 'shape', 'size', 'span',
68 'start', 'summary', 'tabindex', 'target',
69 'title', 'type', 'usemap', 'valign', 'value',
70 'vspace', 'width', 'itemprop']
71 },
48 'a' => ['href'].freeze,
49 'img' => %w[src longdesc].freeze,
50 'div' => %w[itemscope itemtype].freeze,
51 'blockquote' => ['cite'].freeze,
52 'del' => ['cite'].freeze,
53 'ins' => ['cite'].freeze,
54 'q' => ['cite'].freeze,
55 all: %w[abbr accept accept-charset
56 accesskey action align alt
57 aria-describedby aria-hidden aria-label aria-labelledby
58 axis border cellpadding cellspacing char
59 charoff charset checked
60 clear cols colspan color
61 compact coords datetime dir
62 disabled enctype for frame
63 headers height hreflang
64 hspace ismap label lang
65 maxlength media method
66 multiple name nohref noshade
67 nowrap open prompt readonly rel rev
68 rows rowspan rules scope
69 selected shape size span
70 start summary tabindex target
71 title type usemap valign value
72 vspace width itemprop].freeze
73 }.freeze,
7274 protocols: {
7375 'a' => { 'href' => ANCHOR_SCHEMES },
74 'blockquote' => { 'cite' => ['http', 'https', :relative] },
75 'del' => { 'cite' => ['http', 'https', :relative] },
76 'ins' => { 'cite' => ['http', 'https', :relative] },
77 'q' => { 'cite' => ['http', 'https', :relative] },
76 'blockquote' => { 'cite' => ['http', 'https', :relative].freeze },
77 'del' => { 'cite' => ['http', 'https', :relative].freeze },
78 'ins' => { 'cite' => ['http', 'https', :relative].freeze },
79 'q' => { 'cite' => ['http', 'https', :relative].freeze },
7880 'img' => {
79 'src' => ['http', 'https', :relative],
80 'longdesc' => ['http', 'https', :relative]
81 }
81 'src' => ['http', 'https', :relative].freeze,
82 'longdesc' => ['http', 'https', :relative].freeze
83 }.freeze
8284 },
8385 transformers: [
8486 # Top-level <li> elements are removed because they can break out of
99101 node.replace(node.children)
100102 end
101103 }
102 ]
104 ].freeze
103105 }.freeze
104106
105107 # A more limited sanitization whitelist. This includes all attributes,
+3
-1
lib/html/pipeline/toc_filter.rb less more
0 HTML::Pipeline.require_dependency('escape_utils', 'TableOfContentsFilter')
1
02 module HTML
13 class Pipeline
24 # HTML filter that adds an 'id' attribute to all headers
4244 uniq = headers[id] > 0 ? "-#{headers[id]}" : ''
4345 headers[id] += 1
4446 if header_content = node.children.first
45 result[:toc] << %(<li><a href="##{id}#{uniq}">#{text}</a></li>\n)
47 result[:toc] << %(<li><a href="##{id}#{uniq}">#{EscapeUtils.escape_html(text)}</a></li>\n)
4648 header_content.add_previous_sibling(%(<a id="#{id}#{uniq}" class="anchor" href="##{id}#{uniq}" aria-hidden="true">#{anchor_icon}</a>))
4749 end
4850 end
+1
-1
lib/html/pipeline/version.rb less more
00 module HTML
11 class Pipeline
2 VERSION = '2.8.0'.freeze
2 VERSION = '2.8.4'.freeze
33 end
44 end
+7
-1
test/html/pipeline/toc_filter_test.rb less more
9191 assert_equal 6, doc.search('a').size
9292 end
9393
94 def test_toc_outputs_escaped_html
95 @orig = %(<h1>&lt;img src="x" onerror="alert(42)"&gt;</h1>)
96
97 refute_includes toc, %(<img src="x" onerror="alert(42)">)
98 end
99
94100 def test_toc_is_complete
95101 @orig = %(<h1>"Funky President" by James Brown</h1>
96102 <h2>"It's My Thing" by Marva Whitney</h2>
100106 <h6>"Ruthless Villain" by Eazy-E</h6>
101107 <h7>"Be Thankful for What You Got" by William DeVaughn</h7>)
102108
103 expected = %(<ul class="section-nav">\n<li><a href="#funky-president-by-james-brown">"Funky President" by James Brown</a></li>\n<li><a href="#its-my-thing-by-marva-whitney">"It's My Thing" by Marva Whitney</a></li>\n<li><a href="#boogie-back-by-roy-ayers">"Boogie Back" by Roy Ayers</a></li>\n<li><a href="#feel-good-by-fancy">"Feel Good" by Fancy</a></li>\n<li><a href="#funky-drummer-by-james-brown">"Funky Drummer" by James Brown</a></li>\n<li><a href="#ruthless-villain-by-eazy-e">"Ruthless Villain" by Eazy-E</a></li>\n</ul>)
109 expected = %(<ul class="section-nav">\n<li><a href="#funky-president-by-james-brown">&quot;Funky President&quot; by James Brown</a></li>\n<li><a href="#its-my-thing-by-marva-whitney">&quot;It&#39;s My Thing&quot; by Marva Whitney</a></li>\n<li><a href="#boogie-back-by-roy-ayers">&quot;Boogie Back&quot; by Roy Ayers</a></li>\n<li><a href="#feel-good-by-fancy">&quot;Feel Good&quot; by Fancy</a></li>\n<li><a href="#funky-drummer-by-james-brown">&quot;Funky Drummer&quot; by James Brown</a></li>\n<li><a href="#ruthless-villain-by-eazy-e">&quot;Ruthless Villain&quot; by Eazy-E</a></li>\n</ul>)
104110
105111 assert_equal expected, toc
106112 end