makeup - rubygems Package Compare versions

Comparing version 0.4.2 to 0.4.3

.gitignore

 coverage
 test/reports
+Gemfile.lock

lib/makeup/markup.rb

@@ -25,2 +25,3 @@ # encoding: utf-8
 #++
+require "loofah"
 require "github/markup"
@@ -60,5 +61,9 @@ require "makeup/code_block_parser"
       content = highlight_code_blocks(path, content)
-      GitHub::Markup.render(path, content)
+      sanitize(GitHub::Markup.render(path, content))
     end
 
+    def sanitize(html)
+      Loofah.fragment(html).scrub!(:prune).to_s
+    end
+
     def highlight_code_blocks(path, markup)
@@ -65,0 +70,0 @@ return markup unless path =~ /\.(md|mkdn?|mdwn|mdown|markdown)$/

lib/makeup/version.rb

@@ -27,3 +27,3 @@ # encoding: utf-8
 module Makeup
-  VERSION = "0.4.2"
+  VERSION = "0.4.3"
 end

makeup.gemspec

@@ -24,2 +24,3 @@ # -*- encoding: utf-8 -*-
   s.add_dependency "htmlentities", "~> 4.3"
+  s.add_dependency "loofah", "~> 1.2"
 
@@ -26,0 +27,0 @@ s.add_development_dependency "minitest", "~> 2.0"

test/makeup/markup_test.rb

@@ -65,2 +65,14 @@ # encoding: utf-8
     end
+
+    it "strips unsafe html attributes and elements" do
+      md = <<-MD
+<script>alert("foo")</script>
+<a href="foo" data-destroy="boom" onclick="alert('foo')">link</a>
+*bar*
+      MD
+
+      html = @renderer.render("file.md", md)
+
+      assert_equal %Q{<p><a href="foo">link</a>\n<em>bar</em></p>}, html
+    end
   end
@@ -67,0 +79,0 @@

Gemfile.lock

-PATH
-  remote: .
-  specs:
-    makeup (0.4.1)
-      github-linguist (~> 2.8)
-      github-markup (~> 0.7)
-      htmlentities (~> 4.3)
-      pygments.rb (~> 0.4)
-
-GEM
-  remote: http://rubygems.org/
-  specs:
-    builder (3.2.2)
-    charlock_holmes (0.6.9.4)
-    ci_reporter (1.9.0)
-      builder (>= 2.1.2)
-    escape_utils (0.3.2)
-    github-linguist (2.8.5)
-      charlock_holmes (~> 0.6.6)
-      escape_utils (~> 0.3.1)
-      mime-types (~> 1.19)
-      pygments.rb (~> 0.4.2)
-    github-markup (0.7.5)
-    htmlentities (4.3.1)
-    mime-types (1.24)
-    minitest (2.12.1)
-    multi_json (1.7.7)
-    posix-spawn (0.3.6)
-    pygments.rb (0.4.2)
-      posix-spawn (~> 0.3.6)
-      yajl-ruby (~> 1.1.0)
-    rake (0.9.2.2)
-    rcov (1.0.0)
-    redcarpet (2.2.0)
-    simplecov (0.7.1)
-      multi_json (~> 1.0)
-      simplecov-html (~> 0.7.1)
-    simplecov-html (0.7.1)
-    yajl-ruby (1.1.0)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  ci_reporter
-  makeup!
-  minitest (~> 2.0)
-  rake (~> 0.9)
-  rcov
-  redcarpet (= 2.2.0)
-  simplecov

No alert changes

No metric changes