CVS commit: [pkgsrc-2026Q3] pkgsrc/www/ruby-loofah

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Wed Nov 11 10:49:26 UTC 2026

Modified Files:
        pkgsrc/www/ruby-loofah [pkgsrc-2026Q3]: Makefile distinfo

Log Message:
Pullup ticket #7372 - requested by taca
www/ruby-loofah: Security fix

Revisions pulled up:
- www/ruby-loofah/Makefile                                      1.29
- www/ruby-loofah/distinfo                                      1.31

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Sun Nov  8 13:58:26 UTC 2026

   Modified Files:
        pkgsrc/www/ruby-loofah: Makefile distinfo

   Log Message:
   www/ruby-loofah: update to 2.25.3

   2.25.3 (2026-11-01)

   Security

   * Ensure Loofah::HTML5::Scrub.allowed_uri? rejects schemes split by a
     numeric character reference without a semicolon that ends at a character
     allowed_uri? strips (e.g. javascript&#x3a alert(1)) or at another
     character reference (e.g. javascript&#x3aalert(1)).  Character
     references are now decoded before anything is stripped, as browsers do.
     See GHSA-p9wj-w8xq-vjx6.  @flavorjones

   * Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character
     reference /, which CGI.unescapeHTML does not decode and browsers read
     as /, and rejects data: URIs that disguise a disallowed mediatype with it
     (e.g. data:text&sol;html,<script>alert(1)</script>).  Previously that
     mediatype was treated as malformed and fell back to the allowed
     text/plain.  Only v2.25.2 is affected.  See GHSA-jcff-cj73-4w4f.
     @flavorjones

   * Ensure Loofah::HTML5::Scrub.scrub_css does not decode CSS escapes in
     identifiers.  Previously, escaped parentheses (e.g. url\28
     http://example.com/\29) came out as a live url(), which could make the
     viewer's browser fetch an attacker-chosen URL.  See GHSA-m3x9-938q-5767.
     @flavorjones

   * Ensure that href and xlink:href on SVG textPath and mpath elements are
     restricted to local (same-document) references.  Previously
     SVG_ALLOW_LOCAL_HREF spelled textPath in lowercase, which never matched
     the name the HTML5 parser assigns inside <svg>, and omitted mpath
     entirely.  See GHSA-345x-3rq2-jfrm.  @flavorjones

   * Fix quadratic-time scrubbing of the href and xlink:href attributes of SVG
     elements.  Only Ruby 3.1 and earlier are affected, because Ruby 3.2
     introduced linear-time regexp matching.  See GHSA-mf2j-8f84-cc9q.
     @flavorjones

   * Ensure HTML5 scrubber output does not turn into new markup when a browser
     parses it again.  The fix is in Nokogiri v1.19.5, which escapes < and > in
     attribute values as the HTML standard requires, so Loofah now requires
     Nokogiri >= 1.19.5.  See GHSA-h6v6-rg66-fqj4. @flavorjones @hackvertor

   Dependencies

   * Loofah now requires Ruby >= 3.2, the minimum that Nokogiri v1.19.x
     supports.  We don't like dropping Ruby versions in a patch release, and
     we're sorry for the inconvenience, but it's the only way to make sure
     everyone gets the security fix in GHSA-h6v6-rg66-fqj4.

   Added

   * Loofah::HTML5::Scrub.prefixed_attribute_name and
     Loofah::HTML5::Scrub.scrub_attribute_value expose the html5lib attribute
     name and value rules, so downstream consumers can apply them instead of
     carrying their own copy.  @flavorjones

   Fixed

   * Fix :double_breakpoint, which left document fragments unchanged despite
     its documented example.  The scrubber now changes only paragraphs inside
     the scrubbed node, and its run time on a document grows linearly, not
     quadratically, with the paragraph count.  #309 @OskarEichler

   * Fix :whitewash, which passed CDATA sections through unchanged.  Markup
     inside a CDATA section in Loofah.xml_fragment or Loofah.xml_document
     survived scrubbing and became live elements if the output was later parsed
     as HTML.  The scrubber now escapes CDATA content, as :strip, :prune and
     :escape already do.  On JRuby, every sanitizer now emits escaped CDATA
     content as a CDATA section, as on CRuby, instead of a text node that
     double-escaped it.  #313 @flavorjones (reported by @MegaManSec)

   * Fix :double_breakpoint, which raised NoMethodError on a paragraph that
     ends with a <br> after a double break.  #314 @flavorjones (reported by
     @MegaManSec)

   * Fix Loofah::HTML5::Scrub.allowed_uri?, which raised
     Encoding::CompatibilityError on a string in an encoding other than UTF-8
     and ArgumentError on invalid UTF-8.  It now transcodes the input to UTF-8
     and returns false when the input has an invalid byte sequence or no UTF-8
     representation.  #315 @flavorjones

   New Contributors

   * @OskarEichler made their first contribution in #309


To generate a diff of this commit:
cvs rdiff -u -r1.28 -r1.28.2.1 pkgsrc/www/ruby-loofah/Makefile
cvs rdiff -u -r1.30 -r1.30.2.1 pkgsrc/www/ruby-loofah/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/ruby-loofah/Makefile
diff -u pkgsrc/www/ruby-loofah/Makefile:1.28 pkgsrc/www/ruby-loofah/Makefile:1.28.2.1
--- pkgsrc/www/ruby-loofah/Makefile:1.28        Tue Jul 21 14:12:19 2026
+++ pkgsrc/www/ruby-loofah/Makefile     Wed Nov 11 10:49:26 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.28 2026/07/21 14:12:19 taca Exp $
+# $NetBSD: Makefile,v 1.28.2.1 2026/11/11 10:49:26 maya Exp $
 
-DISTNAME=      loofah-2.25.2
+DISTNAME=      loofah-2.25.3
 CATEGORIES=    www
 
 MAINTAINER=    minskim%NetBSD.org@localhost

Index: pkgsrc/www/ruby-loofah/distinfo
diff -u pkgsrc/www/ruby-loofah/distinfo:1.30 pkgsrc/www/ruby-loofah/distinfo:1.30.2.1
--- pkgsrc/www/ruby-loofah/distinfo:1.30        Tue Jul 21 14:12:19 2026
+++ pkgsrc/www/ruby-loofah/distinfo     Wed Nov 11 10:49:26 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.30 2026/07/21 14:12:19 taca Exp $
+$NetBSD: distinfo,v 1.30.2.1 2026/11/11 10:49:26 maya Exp $
 
-BLAKE2s (loofah-2.25.2.gem) = bff2f5e2029869f6a0f2d2dc2bba3d1108194b953b2e08fe724c5166eccb8c92
-SHA512 (loofah-2.25.2.gem) = 7c5fe099c01266eadcb48f79837fa645c04c6c1a6d334c93f207f2a8a5e8878b256eee07e5476adfc3f849e202237a51f5d5d0a91a1bd2b65b8dadbc26616209
-Size (loofah-2.25.2.gem) = 36864 bytes
+BLAKE2s (loofah-2.25.3.gem) = f255e263b858475161f4461c628e78ba07899b0c9a0460d6c9fa885bff829f45
+SHA512 (loofah-2.25.3.gem) = 856731b5ddd1d32994209b0bf973b37fbb19ba29bc320b5434949b8d39c8006475f06166c0552d275103fa33a58d014b4926fedfa15f2e158c3369da2b89d008
+Size (loofah-2.25.3.gem) = 38912 bytes