gollum-lib 5.2.3 → 5.2.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 76bc9820326afb2ae3a0c8768311f7e757dbe763ce7c5064e05edaf45f48f013
4
- data.tar.gz: 1e6fa1ba6853fd44594c5ffad36148d0022c75bc1bfcd2f05fbc8e2c0e960bfd
3
+ metadata.gz: 89665fc53e8dac8e1787645fde43c827410639049a789503b7e2859ce5fadb5f
4
+ data.tar.gz: cc9aac74db4af15d4943663ec1b3ab02dd451c77a728db20dcd87b4580736d39
5
5
  SHA512:
6
- metadata.gz: 630ec62731370539725a760d149cd7940048087ed2a306d8cab9a23de77f137566383c644c177cec5904426fca0b81c210762d61ae64a0570b122fd98ba1fb92
7
- data.tar.gz: 86546d058561c867d2eacf5df54ab1d7f834444f13202619688b5cccc972016e9119b421574d5e6bc1b3cb97edd11c7037d6be427a1586605056784564b17f9e
6
+ metadata.gz: 4a19c6ecd939a79ec62de95e06508e97ef962abdcf945a73da5b5aeed97149cee79b6fce2532aa8ca21e701f9b4251746aa69b2456a5f5276e40b0541814bd22
7
+ data.tar.gz: '029d5f5f42f759e8827871cc80ccb4d3308f794dd3d7bffe5c0c7286d1acd3fc40f6c644c57ca975c49c63d7085bfb14a5bef0887599db5bafc78978434ea622'
data/HISTORY.md CHANGED
@@ -1,3 +1,9 @@
1
+ # 5.2.3 / 2023-03-13
2
+
3
+ * Bugfix release: update adapter dependencies for Ruby 3.2 support.
4
+
5
+
6
+
1
7
  # 5.2.2 / 2023-01-18
2
8
 
3
9
  * Bugfix release: set Nokogiri default XHTML conversion options more relaibly. See https://github.com/sparklemotion/nokogiri/issues/2761
data/LATEST_CHANGES.md CHANGED
@@ -1,4 +1,3 @@
1
- # 5.2.3 / 2023-03-13
2
-
3
- * Bugfix release: update adapter dependencies for Ruby 3.2 support.
1
+ # 5.2.4 / 2023-03-22
4
2
 
3
+ * Bugfix release: address XSS vulnerability ( @6661620a, @dometto)
@@ -157,7 +157,7 @@ class Gollum::Filter::TOC < Gollum::Filter
157
157
  end
158
158
 
159
159
  # % -> %25 so anchors work on Firefox. See issue #475
160
- @tail.add_child(%Q{<a href="##{name}">#{header.content}</a>})
160
+ @tail.add_child(%Q{<a href="##{name}">#{CGI.escapeHTML(header.content)}</a>})
161
161
  end
162
162
 
163
163
  # Increments the number of anchors with the given name
@@ -1,8 +1,10 @@
1
1
  module Gollum
2
2
  class Macro
3
3
  class Video < Gollum::Macro
4
- def render (fname)
5
- "<video width=\"100%\" height=\"100%\" src=\"#{CGI::escapeHTML(fname)}\" controls=\"true\"> HTML5 video is not supported on this Browser.</video>"
4
+ def render(fname, auto=false)
5
+ escaped_fname = CGI.escapeHTML(fname)
6
+ properties = auto ? "autoplay='true' playsinline='true' muted='true' loop='true'" : "controls='true'"
7
+ "<video width='100%' height='100%' src='#{escaped_fname}' #{properties}>HTML5 video is not supported on this browser.</video>"
6
8
  end
7
9
  end
8
10
  end
@@ -1,5 +1,5 @@
1
1
  ::Loofah::HTML5::SafeList::ACCEPTABLE_PROTOCOLS.add('apt')
2
- ::Loofah::HTML5::SafeList::ALLOWED_ATTRIBUTES.add('controls')
2
+ ::Loofah::HTML5::SafeList::ALLOWED_ATTRIBUTES.merge(%w[controls loop muted playsinline autoplay])
3
3
 
4
4
  module Gollum
5
5
  class Sanitization
@@ -1,5 +1,5 @@
1
1
  module Gollum
2
2
  module Lib
3
- VERSION = '5.2.3'
3
+ VERSION = '5.2.4'
4
4
  end
5
5
  end
@@ -152,7 +152,7 @@ module Gollum
152
152
  @per_page_uploads = options.fetch :per_page_uploads, false
153
153
  @metadata = options.fetch :metadata, {}
154
154
  @filter_chain = options.fetch :filter_chain,
155
- [:YAML, :BibTeX, :PlainText, :CriticMarkup, :TOC, :RemoteCode, :Code, :Macro, :Emoji, :Sanitize, :PlantUML, :Tags, :PandocBib, :Render]
155
+ [:YAML, :BibTeX, :PlainText, :CriticMarkup, :TOC, :Sanitize, :RemoteCode, :Code, :Macro, :Emoji, :PlantUML, :Tags, :PandocBib, :Render]
156
156
  @filter_chain.delete(:Emoji) unless options.fetch :emoji, false
157
157
  @filter_chain.delete(:PandocBib) unless ::Gollum::MarkupRegisterUtils.using_pandoc?
158
158
  @filter_chain.delete(:CriticMarkup) unless options.fetch :critic_markup, false
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: gollum-lib
3
3
  version: !ruby/object:Gem::Version
4
- version: 5.2.3
4
+ version: 5.2.4
5
5
  platform: ruby
6
6
  authors:
7
7
  - Tom Preston-Werner
@@ -9,7 +9,7 @@ authors:
9
9
  autorequire:
10
10
  bindir: bin
11
11
  cert_chain: []
12
- date: 2023-03-13 00:00:00.000000000 Z
12
+ date: 2023-03-22 00:00:00.000000000 Z
13
13
  dependencies:
14
14
  - !ruby/object:Gem::Dependency
15
15
  name: gollum-rugged_adapter
@@ -470,7 +470,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
470
470
  - !ruby/object:Gem::Version
471
471
  version: '0'
472
472
  requirements: []
473
- rubygems_version: 3.4.6
473
+ rubygems_version: 3.2.3
474
474
  signing_key:
475
475
  specification_version: 4
476
476
  summary: A simple, Git-powered wiki.
OSZAR »