CVS commit: pkgsrc/www/ruby-loofah

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Tue Jul 21 14:12:19 UTC 2026

Modified Files:
        pkgsrc/www/ruby-loofah: Makefile distinfo

Log Message:
www/ruby-loofah: update to 2.25.2

2.25.2 (2026-07-15)

Security

* Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes numeric character
  references without semicolons (e.g. javascript&#58alert(1)), which
  browsers decode and execute, and rejects schemes split by them.  See
  GHSA-5qhf-9phg-95m2.  @flavorjones

* Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character
  references 	 and 
, which CGI.unescapeHTML does not decode and
  browsers strip from URIs, and rejects schemes split by them
  (e.g. java	script:alert(1)).  See GHSA-8whx-365g-h9vv.  @flavorjones

* Ensure that both href and xlink:href attributes on SVG elements like use
  are restricted to local (same-document) references.  Previously only
  xlink:href was restricted, allowing the SVG 2 href attribute to reference
  external documents.  See GHSA-9wjq-cp2p-hrgf.  @flavorjones

Improved

* Harden data: URI mediatype parsing in Loofah::HTML5::Scrub.allowed_uri?.
  The mediatype is now parsed following the WHATWG data: URL spec and RFC
  2397 instead of simply being split on a colon.  A data: URI with an
  omitted or malformed mediatype is now treated as text/plain and allowed,
  and one without the required comma is now rejected.  #305 @flavorjones

* Remove feed from the default set of allowed protocols.  The feed URI
  scheme was never accepted as a standard protocol, and no major browser
  supports it.  Removing it reduces the attack surface particularly for
  non-browser contexts.  #304 @flavorjones

* Remove a vestigial &#x70 alternative from
  Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR.  This appears to be an
  ancient typo dating back to pre-extraction Rails circa 2007. #305
  @flavorjones


To generate a diff of this commit:
cvs rdiff -u -r1.27 -r1.28 pkgsrc/www/ruby-loofah/Makefile
cvs rdiff -u -r1.29 -r1.30 pkgsrc/www/ruby-loofah/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/ruby-loofah/Makefile
diff -u pkgsrc/www/ruby-loofah/Makefile:1.27 pkgsrc/www/ruby-loofah/Makefile:1.28
--- pkgsrc/www/ruby-loofah/Makefile:1.27        Sun Mar 29 13:47:19 2026
+++ pkgsrc/www/ruby-loofah/Makefile     Tue Jul 21 14:12:19 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.27 2026/03/29 13:47:19 taca Exp $
+# $NetBSD: Makefile,v 1.28 2026/07/21 14:12:19 taca Exp $
 
-DISTNAME=      loofah-2.25.1
+DISTNAME=      loofah-2.25.2
 CATEGORIES=    www
 
 MAINTAINER=    minskim%NetBSD.org@localhost

Index: pkgsrc/www/ruby-loofah/distinfo
diff -u pkgsrc/www/ruby-loofah/distinfo:1.29 pkgsrc/www/ruby-loofah/distinfo:1.30
--- pkgsrc/www/ruby-loofah/distinfo:1.29        Sun Mar 29 13:47:19 2026
+++ pkgsrc/www/ruby-loofah/distinfo     Tue Jul 21 14:12:19 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.29 2026/03/29 13:47:19 taca Exp $
+$NetBSD: distinfo,v 1.30 2026/07/21 14:12:19 taca Exp $
 
-BLAKE2s (loofah-2.25.1.gem) = 30cd892cfed52141241c9f4efc619b5bbc6372745a0188cb555241971733e7d3
-SHA512 (loofah-2.25.1.gem) = 8cccfc6ab2009e8f997a4595cc00d9621061ac4ec044391ae4893be95775a0218fd1fd9e3e34ae6167449c2506b87f713219c7273209b898972e21736bf9be50
-Size (loofah-2.25.1.gem) = 34816 bytes
+BLAKE2s (loofah-2.25.2.gem) = bff2f5e2029869f6a0f2d2dc2bba3d1108194b953b2e08fe724c5166eccb8c92
+SHA512 (loofah-2.25.2.gem) = 7c5fe099c01266eadcb48f79837fa645c04c6c1a6d334c93f207f2a8a5e8878b256eee07e5476adfc3f849e202237a51f5d5d0a91a1bd2b65b8dadbc26616209
+Size (loofah-2.25.2.gem) = 36864 bytes