CVS commit: pkgsrc/www/ruby-loofah

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Sun Nov  8 13:58:26 UTC 2026

Modified Files:
        pkgsrc/www/ruby-loofah: Makefile distinfo

Log Message:
www/ruby-loofah: update to 2.25.3

2.25.3 (2026-11-01)

Security

* Ensure Loofah::HTML5::Scrub.allowed_uri? rejects schemes split by a
  numeric character reference without a semicolon that ends at a character
  allowed_uri? strips (e.g. javascript&#x3a alert(1)) or at another
  character reference (e.g. javascript&#x3aalert(1)).  Character
  references are now decoded before anything is stripped, as browsers do.
  See GHSA-p9wj-w8xq-vjx6.  @flavorjones

* Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character
  reference /, which CGI.unescapeHTML does not decode and browsers read
  as /, and rejects data: URIs that disguise a disallowed mediatype with it
  (e.g. data:text&sol;html,<script>alert(1)</script>).  Previously that
  mediatype was treated as malformed and fell back to the allowed
  text/plain.  Only v2.25.2 is affected.  See GHSA-jcff-cj73-4w4f.
  @flavorjones

* Ensure Loofah::HTML5::Scrub.scrub_css does not decode CSS escapes in
  identifiers.  Previously, escaped parentheses (e.g. url\28
  http://example.com/\29) came out as a live url(), which could make the
  viewer's browser fetch an attacker-chosen URL.  See GHSA-m3x9-938q-5767.
  @flavorjones

* Ensure that href and xlink:href on SVG textPath and mpath elements are
  restricted to local (same-document) references.  Previously
  SVG_ALLOW_LOCAL_HREF spelled textPath in lowercase, which never matched
  the name the HTML5 parser assigns inside <svg>, and omitted mpath
  entirely.  See GHSA-345x-3rq2-jfrm.  @flavorjones

* Fix quadratic-time scrubbing of the href and xlink:href attributes of SVG
  elements.  Only Ruby 3.1 and earlier are affected, because Ruby 3.2
  introduced linear-time regexp matching.  See GHSA-mf2j-8f84-cc9q.
  @flavorjones

* Ensure HTML5 scrubber output does not turn into new markup when a browser
  parses it again.  The fix is in Nokogiri v1.19.5, which escapes < and > in
  attribute values as the HTML standard requires, so Loofah now requires
  Nokogiri >= 1.19.5.  See GHSA-h6v6-rg66-fqj4. @flavorjones @hackvertor

Dependencies

* Loofah now requires Ruby >= 3.2, the minimum that Nokogiri v1.19.x
  supports.  We don't like dropping Ruby versions in a patch release, and
  we're sorry for the inconvenience, but it's the only way to make sure
  everyone gets the security fix in GHSA-h6v6-rg66-fqj4.

Added

* Loofah::HTML5::Scrub.prefixed_attribute_name and
  Loofah::HTML5::Scrub.scrub_attribute_value expose the html5lib attribute
  name and value rules, so downstream consumers can apply them instead of
  carrying their own copy.  @flavorjones

Fixed

* Fix :double_breakpoint, which left document fragments unchanged despite
  its documented example.  The scrubber now changes only paragraphs inside
  the scrubbed node, and its run time on a document grows linearly, not
  quadratically, with the paragraph count.  #309 @OskarEichler

* Fix :whitewash, which passed CDATA sections through unchanged.  Markup
  inside a CDATA section in Loofah.xml_fragment or Loofah.xml_document
  survived scrubbing and became live elements if the output was later parsed
  as HTML.  The scrubber now escapes CDATA content, as :strip, :prune and
  :escape already do.  On JRuby, every sanitizer now emits escaped CDATA
  content as a CDATA section, as on CRuby, instead of a text node that
  double-escaped it.  #313 @flavorjones (reported by @MegaManSec)

* Fix :double_breakpoint, which raised NoMethodError on a paragraph that
  ends with a <br> after a double break.  #314 @flavorjones (reported by
  @MegaManSec)

* Fix Loofah::HTML5::Scrub.allowed_uri?, which raised
  Encoding::CompatibilityError on a string in an encoding other than UTF-8
  and ArgumentError on invalid UTF-8.  It now transcodes the input to UTF-8
  and returns false when the input has an invalid byte sequence or no UTF-8
  representation.  #315 @flavorjones

New Contributors

* @OskarEichler made their first contribution in #309


To generate a diff of this commit:
cvs rdiff -u -r1.28 -r1.29 pkgsrc/www/ruby-loofah/Makefile
cvs rdiff -u -r1.30 -r1.31 pkgsrc/www/ruby-loofah/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/ruby-loofah/Makefile
diff -u pkgsrc/www/ruby-loofah/Makefile:1.28 pkgsrc/www/ruby-loofah/Makefile:1.29
--- pkgsrc/www/ruby-loofah/Makefile:1.28        Tue Jul 21 14:12:19 2026
+++ pkgsrc/www/ruby-loofah/Makefile     Sun Nov  8 13:58:25 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.28 2026/07/21 14:12:19 taca Exp $
+# $NetBSD: Makefile,v 1.29 2026/11/08 13:58:25 taca Exp $
 
-DISTNAME=      loofah-2.25.2
+DISTNAME=      loofah-2.25.3
 CATEGORIES=    www
 
 MAINTAINER=    minskim%NetBSD.org@localhost

Index: pkgsrc/www/ruby-loofah/distinfo
diff -u pkgsrc/www/ruby-loofah/distinfo:1.30 pkgsrc/www/ruby-loofah/distinfo:1.31
--- pkgsrc/www/ruby-loofah/distinfo:1.30        Tue Jul 21 14:12:19 2026
+++ pkgsrc/www/ruby-loofah/distinfo     Sun Nov  8 13:58:25 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.30 2026/07/21 14:12:19 taca Exp $
+$NetBSD: distinfo,v 1.31 2026/11/08 13:58:25 taca Exp $
 
-BLAKE2s (loofah-2.25.2.gem) = bff2f5e2029869f6a0f2d2dc2bba3d1108194b953b2e08fe724c5166eccb8c92
-SHA512 (loofah-2.25.2.gem) = 7c5fe099c01266eadcb48f79837fa645c04c6c1a6d334c93f207f2a8a5e8878b256eee07e5476adfc3f849e202237a51f5d5d0a91a1bd2b65b8dadbc26616209
-Size (loofah-2.25.2.gem) = 36864 bytes
+BLAKE2s (loofah-2.25.3.gem) = f255e263b858475161f4461c628e78ba07899b0c9a0460d6c9fa885bff829f45
+SHA512 (loofah-2.25.3.gem) = 856731b5ddd1d32994209b0bf973b37fbb19ba29bc320b5434949b8d39c8006475f06166c0552d275103fa33a58d014b4926fedfa15f2e158c3369da2b89d008
+Size (loofah-2.25.3.gem) = 38912 bytes