CVS commit: pkgsrc/www/ruby-rails-html-sanitizer

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Sun Nov  8 14:20:36 UTC 2026

Modified Files:
        pkgsrc/www/ruby-rails-html-sanitizer: Makefile distinfo

Log Message:
www/ruby-rails-html-sanitizer: update to 1.7.2

1.7.2 (2026-11-02)

* Deciding whether an SVG href or xlink:href is a local reference no longer
  takes quadratic time.

  PermitScrubber matched the attribute value against a pattern that
  rescanned the value's whitespace run from every line start, so an
  all-whitespace value took seconds to scrub.  Only Ruby 3.1 and earlier are
  affected, because Ruby 3.2 introduced linear-time regexp matching.
  Through PermitScrubber, applications are only affected if the allowed tags
  are overridden to include an SVG reference element such as use; the
  default configuration is not affected.

  This change addresses GHSA-cpgf-5mjf-73p7. PermitScrubber now applies the
  html5lib attribute value rules by calling
  Loofah::HTML5::Scrub.scrub_attribute_value rather than carrying its own
  copy.  The minimum Loofah dependency is now ~> 2.25, >= 2.25.3.

  Mike Dalessio

* rails-html-sanitizer now requires Ruby >= 3.2, because Loofah 2.25.3
  requires it.

  The 1.6.x and 1.5.x release branches no longer receive security updates.
  Every Rails release in security support accepts rails-html-sanitizer 1.7
  and requires Ruby >= 3.2.

  Mike Dalessio

* SafeListSanitizer no longer shares a PermitScrubber across calls.

  Previously one sanitizer instance reused a single PermitScrubber,
  assigning its tags and attributes on every call.  Action View memoizes one
  sanitizer per helper module, so two concurrent sanitize calls with
  different tags: or attributes: options could interleave and one call could
  be scrubbed with the other call's allowlist.  Each call now builds its own
  PermitScrubber.

  This change addresses GHSA-h7wh-q2qr-458c.

  Mike Dalessio


To generate a diff of this commit:
cvs rdiff -u -r1.12 -r1.13 pkgsrc/www/ruby-rails-html-sanitizer/Makefile
cvs rdiff -u -r1.14 -r1.15 pkgsrc/www/ruby-rails-html-sanitizer/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/ruby-rails-html-sanitizer/Makefile
diff -u pkgsrc/www/ruby-rails-html-sanitizer/Makefile:1.12 pkgsrc/www/ruby-rails-html-sanitizer/Makefile:1.13
--- pkgsrc/www/ruby-rails-html-sanitizer/Makefile:1.12  Wed Aug 12 05:22:49 2026
+++ pkgsrc/www/ruby-rails-html-sanitizer/Makefile       Sun Nov  8 14:20:36 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.12 2026/08/12 05:22:49 taca Exp $
+# $NetBSD: Makefile,v 1.13 2026/11/08 14:20:36 taca Exp $
 
-DISTNAME=      rails-html-sanitizer-1.7.1
+DISTNAME=      rails-html-sanitizer-1.7.2
 CATEGORIES=    www
 
 MAINTAINER=    minskim%NetBSD.org@localhost

Index: pkgsrc/www/ruby-rails-html-sanitizer/distinfo
diff -u pkgsrc/www/ruby-rails-html-sanitizer/distinfo:1.14 pkgsrc/www/ruby-rails-html-sanitizer/distinfo:1.15
--- pkgsrc/www/ruby-rails-html-sanitizer/distinfo:1.14  Wed Aug 12 05:22:49 2026
+++ pkgsrc/www/ruby-rails-html-sanitizer/distinfo       Sun Nov  8 14:20:36 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.14 2026/08/12 05:22:49 taca Exp $
+$NetBSD: distinfo,v 1.15 2026/11/08 14:20:36 taca Exp $
 
-BLAKE2s (rails-html-sanitizer-1.7.1.gem) = 887216d67ff1ff05b9eadf7d1d57e6997ca682624c9d145c4c1d46b8ba0811f0
-SHA512 (rails-html-sanitizer-1.7.1.gem) = 75031b179c1287e7adc38b57ffc2448642e8cf5bd3988143a5baf879f2ce7171d7b11590929f84cc5a88b852466e33ddc7d1a421aca147dd22df5ef29d63a626
-Size (rails-html-sanitizer-1.7.1.gem) = 15360 bytes
+BLAKE2s (rails-html-sanitizer-1.7.2.gem) = f1f8d21dec1bb1c48a8145429e256df25a853bb4affa28aeeece3ffbe27f23f4
+SHA512 (rails-html-sanitizer-1.7.2.gem) = 7ba518daf07bde5c0ee82e5d876cfd2160355511cdd546ec33ef190789ee45ad7290fbd33a26df66585b11fa4457341171d68a6a6ce72314e29e49b63865a676
+Size (rails-html-sanitizer-1.7.2.gem) = 15872 bytes