| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: ruby4.0-rubygem-loofah | Distribution: openSUSE Tumbleweed |
| Version: 2.25.3 | Vendor: openSUSE |
| Release: 1.1 | Build date: Wed Nov 4 11:29:15 2026 |
| Group: Unspecified | Build host: reproducible |
| Size: 168407 | Source RPM: rubygem-loofah-2.25.3-1.1.src.rpm |
| Packager: https://bugs.opensuse.org | |
| Url: https://github.com/flavorjones/loofah | |
| Summary: HTML/XML manipulation and sanitization based on Nokogiri | |
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments. It's built on top of Nokogiri and libxml2, so it's fast and has a nice API. Loofah excels at HTML sanitization (XSS prevention). It includes some nice HTML sanitizers, which are based on HTML5lib's whitelist, so it most likely won't make your codes less secure.
MIT
* Wed Nov 04 2026 Marcus Rueckert <mrueckert@suse.de>
- update to 2.25.3
- Security
- Ensure `Loofah::HTML5::Scrub.allowed_uri?` rejects schemes
split by a numeric character reference without a semicolon
that ends at a character `allowed_uri?` strips (e.g.
`javascript: alert(1)`) or at another character reference
(e.g. `javascript:alert(1)`). Character references
are now decoded before anything is stripped, as browsers do.
See GHSA-p9wj-w8xq-vjx6. @flavorjones
- Ensure `Loofah::HTML5::Scrub.allowed_uri?` recognizes the
named character reference `/`, which `CGI.unescapeHTML`
does not decode and browsers read as `/`, and rejects `data:`
URIs that disguise a disallowed mediatype with it (e.g.
`data:text/html,<script>alert(1)</script>`). Previously
that mediatype was treated as malformed and fell back to the
allowed `text/plain`. Only v2.25.2 is affected. See
GHSA-jcff-cj73-4w4f. @flavorjones
- Ensure `Loofah::HTML5::Scrub.scrub_css` does not decode CSS
escapes in identifiers. Previously, escaped parentheses (e.g.
`url\28 http://example.com/\29`) came out as a live `url()`,
which could make the viewer's browser fetch an
attacker-chosen URL. See GHSA-m3x9-938q-5767. @flavorjones
- Ensure that `href` and `xlink:href` on SVG `textPath` and
`mpath` elements are restricted to local (same-document)
references. Previously `SVG_ALLOW_LOCAL_HREF` spelled
`textPath` in lowercase, which never matched the name the
HTML5 parser assigns inside `<svg>`, and omitted `mpath`
entirely. See GHSA-345x-3rq2-jfrm. @flavorjones
- Fix quadratic-time scrubbing of the `href` and `xlink:href`
attributes of SVG elements. Only Ruby 3.1 and earlier are
affected, because Ruby 3.2 introduced linear-time regexp
matching. See GHSA-mf2j-8f84-cc9q. @flavorjones
- Ensure HTML5 scrubber output does not turn into new markup
when a browser parses it again. The fix is in Nokogiri
v1.19.5, which escapes `<` and `>` in attribute values as the
HTML standard requires, so Loofah now requires Nokogiri >=
1.19.5. See GHSA-h6v6-rg66-fqj4 @flavorjones @hackvertor
- Dependencies
- Loofah now requires Ruby >= 3.2, the minimum that Nokogiri
v1.19.x supports. We don't like dropping Ruby versions in a
patch release, and we're sorry for the inconvenience, but
it's the only way to make sure everyone gets the security fix
in GHSA-h6v6-rg66-fqj4
- Added
- `Loofah::HTML5::Scrub.prefixed_attribute_name` and
`Loofah::HTML5::Scrub.scrub_attribute_value` expose the
html5lib attribute name and value rules, so downstream
consumers can apply them instead of carrying their own copy.
@flavorjones
- Fixed
- Fix `:double_breakpoint`, which left document fragments
unchanged despite its documented example. The scrubber now
changes only paragraphs inside the scrubbed node, and its run
time on a document grows linearly, not quadratically, with
the paragraph count. #309 @OskarEichler
- Fix `:whitewash`, which passed CDATA sections through
unchanged. Markup inside a CDATA section in
`Loofah.xml_fragment` or `Loofah.xml_document` survived
scrubbing and became live elements if the output was later
parsed as HTML. The scrubber now escapes CDATA content, as
`:strip`, `:prune` and `:escape` already do. On JRuby, every
sanitizer now emits escaped CDATA content as a CDATA section,
as on CRuby, instead of a text node that double-escaped it.
[#313] @flavorjones (reported by @MegaManSec)
- Fix `:double_breakpoint`, which raised `NoMethodError` on a
paragraph that ends with a `<br>` after a double break. #314
@flavorjones (reported by @MegaManSec)
- Fix `Loofah::HTML5::Scrub.allowed_uri?`, which raised
`Encoding::CompatibilityError` on a string in an encoding
other than UTF-8 and `ArgumentError` on invalid UTF-8. It now
transcodes the input to UTF-8 and returns `false` when the
input has an invalid byte sequence or no UTF-8
representation. #315 @flavorjones
* Wed Sep 09 2026 Johannes Segitz <jsegitz@suse.com>
- update to 2.25.2
* Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes numeric character
references without semicolons (e.g. javascript:alert(1)), which browsers
decode and execute, and rejects schemes split by them. See
GHSA-5qhf-9phg-95m2. @flavorjones
* Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character
references 	 and 
, which CGI.unescapeHTML does not decode and
browsers strip from URIs, and rejects schemes split by them (e.g.
java	script:alert(1)). See GHSA-8whx-365g-h9vv. @flavorjones
* Ensure that both href and xlink:href attributes on SVG elements like use
are restricted to local (same-document) references. Previously only
xlink:href was restricted, allowing the SVG 2 href attribute to reference
external documents. See GHSA-9wjq-cp2p-hrgf. @flavorjones
* Harden data: URI mediatype parsing in Loofah::HTML5::Scrub.allowed_uri?.
The mediatype is now parsed following the WHATWG data: URL spec and RFC
2397 instead of simply being split on a colon. A data: URI with an omitted
or malformed mediatype is now treated as text/plain and allowed, and one
without the required comma is now rejected. #305 @flavorjones
* Remove feed from the default set of allowed protocols
* Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes unescaped whitespace
entities and rejects schemas containing them. See GHSA-46fp-8f5p-pf2m. #302
@flavorjones
* Fri Mar 13 2026 Marcus Rueckert <mrueckert@suse.de>
- update to 2.25.0
* Extract `Loofah::HTML5::Scrub.allowed_uri?` which operates on
a string. Previously this logic was coupled to the parsed tree
in `.scrub_uri_attribute`. #300 @flavorjones
* Tightened up how entities and control characters are handled
when detecting allowed URIs. #301 @flavorjones
* Fri Jul 18 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 2.24.1
* Import only what's needed from `cgi` for support for Ruby 3.5
[#296] @Earlopain
* Wed Jan 22 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 2.24.0
* Built-in scrubber `:double_breakpoint` which sees `<br><br>`
and wraps the surrounding content in `<p>` tags. #279, #284
@josecolella @torihuang
* Built-in scrubber `:targetblank` now skips `a` tags whose
`href` attribute is an anchor link. Previously, all `a` tags
were modified to have `target='_blank'`. #291 @fnando
* Mon Nov 04 2024 Dan Čermák <dan.cermak@posteo.net>
- ## 2.23.1 / 2024-10-25
[#]## Added
* Allow CSS properties `min-height` and `max-height`. [#288] @lazyatom
[#]# 2.23.0 / 2024-10-24
[#]## Added
* Allow CSS property `min-width`. [#287] @lazyatom
* Tue Nov 14 2023 Dan Čermák <dan.cermak@posteo.net>
- ## 2.22.0 / 2023-11-13
[#]## Added
* A `:targetblank` HTML scrubber which ensures all hyperlinks have `target="_blank"`. [#275] @stefannibrasil and @thdaraujo
* A `:noreferrer` HTML scrubber which ensures all hyperlinks have `rel=noreferrer`, similar to the `:nofollow` and `:noopener` scrubbers. [#277] @wynksaiddestroy
* Fri Nov 03 2023 Dan Čermák <dan.cermak@posteo.net>
- ## 2.21.4 / 2023-10-10
[#]## Fixed
* `Loofah::HTML5::Scrub.scrub_css` is more consistent in preserving whitespace (and lack of whitespace) in CSS property values. In particular, `.scrub_css` no longer inserts whitespace between tokens that did not already have whitespace between them. [[#273](https://github.com/flavorjones/loofah/issues/273), fixes [#271](https://github.com/flavorjones/loofah/issues/271)]
[#]# 2.21.3 / 2023-05-15
[#]## Fixed
* Quash "instance variable not initialized" warning in Ruby < 3.0. [[#268](https://github.com/flavorjones/loofah/issues/268)] (Thanks, [@dharamgollapudi](https://github.com/dharamgollapudi)!)
[#]# 2.21.2 / 2023-05-11
[#]## Dependencies
* Update the dependency on Nokogiri to be `>= 1.12.0`. The dependency in 2.21.0 and 2.21.1 was left at `>= 1.5.9` but versions before 1.12 would result in a `NameError` exception. [[#266](https://github.com/flavorjones/loofah/issues/266)]
[#]# 2.21.1 / 2023-05-10
[#]## Fixed
* Don't define `HTML5::Document` and `HTML5::DocumentFragment` when Nokogiri is `< 1.14`. In 2.21.0 these classes were defined whenever `Nokogiri::HTML5` was defined, but Nokogiri v1.12 and v1.13 do not support Loofah subclassing properly.
[#]# 2.21.0 / 2023-05-10
[#]## HTML5 Support
Classes `Loofah::HTML5::Document` and `Loofah::HTML5::DocumentFragment` are introduced, along with helper methods:
- `Loofah.html5_document`
- `Loofah.html5_fragment`
- `Loofah.scrub_html5_document`
- `Loofah.scrub_html5_fragment`
These classes and methods use Nokogiri's HTML5 parser to ensure modern web standards are used.
⚠ HTML5 functionality is only available with Nokogiri v1.14.0 and higher.
⚠ HTML5 functionality is not available for JRuby. Please see [this upstream Nokogiri issue](https://github.com/sparklemotion/nokogiri/issues/2227) if you're interested in helping implement and support HTML5 support.
[#]## `Loofah::HTML4` module and namespace
`Loofah::HTML` has been renamed to `Loofah::HTML4`, and `Loofah::HTML` is aliased to preserve backwards-compatibility. `Nokogiri::HTML` and `Nokogiri::HTML4` parse methods still use libxml2's (or NekoHTML's) HTML4 parser.
Take special note that if you rely on the class name of an object in your code, objects will now report a class of `Loofah::HTML4::Foo` where they previously reported `Loofah::HTML::Foo`. Instead of relying on the string returned by `Object#class`, prefer `Class#===` or `Object#is_a?` or `Object#instance_of?`.
Future releases of Nokogiri may deprecate `HTML` classes and methods or otherwise change this behavior, so please start using `HTML4` in place of `HTML`.
[#]## Official support for JRuby
This version introduces official support for JRuby. Previously, the test suite had never been green due to differences in behavior in the underlying HTML parser used by Nokogiri. We've updated the test suite to accommodate those differences, and have added JRuby to the CI suite.
[#]# 2.20.0 / 2023-04-01
[#]## Features
* Allow SVG attributes `color-profile`, `cursor`, `filter`, `marker`, and `mask`. [[#246](https://github.com/flavorjones/loofah/issues/246)]
* Allow SVG elements `altGlyph`, `cursor`, `feImage`, `pattern`, and `tref`. [[#246](https://github.com/flavorjones/loofah/issues/246)]
* Allow protocols `fax` and `modem`. [[#255](https://github.com/flavorjones/loofah/issues/255)] (Thanks, [@cjba7](https://github.com/cjba7)!)
* Mon Mar 06 2023 Paolo Perego <paolo.perego@suse.com>
- udpated to version 2.19.1
[#]# 2.19.1 / 2022-12-13
[#]## SecurityAddress
* Address CVE-2022-23514, inefficient regular expression complexity. See GHSA-486f-hjj9-9vhh for more information.
* Address CVE-2022-23515, improper neutralization of data URIs. See GHSA-228g-948r-83gx for more information.
* Address CVE-2022-23516, uncontrolled recursion. See GHSA-3x8r-x6xp-q4vm for more information.
* Mon Oct 10 2022 Stephan Kulow <coolo@suse.com>
updated to version 2.19.0
see installed CHANGELOG.md
[#]# 2.19.0 / 2022-09-14
[#]## Features
* Allow SVG 1.0 color keyword names in CSS attributes. These colors are part of the [CSS Color Module Level 3](https://www.w3.org/TR/css-color-3/#svg-color) recommendation released 2022-01-18. [[#243](https://github.com/flavorjones/loofah/issues/243)]
/usr/lib64/ruby/gems/4.0.0/build_info /usr/lib64/ruby/gems/4.0.0/cache/loofah-2.25.3.gem /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3 /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/CHANGELOG.md /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/MIT-LICENSE.txt /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/README.md /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/SECURITY.md /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/lib /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/lib/loofah /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/lib/loofah.rb /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/lib/loofah/concerns.rb /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/lib/loofah/elements.rb /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/lib/loofah/helpers.rb /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/lib/loofah/html4 /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/lib/loofah/html4/document.rb /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/lib/loofah/html4/document_fragment.rb /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/lib/loofah/html5 /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/lib/loofah/html5/document.rb /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/lib/loofah/html5/document_fragment.rb /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/lib/loofah/html5/libxml2_workarounds.rb /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/lib/loofah/html5/safelist.rb /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/lib/loofah/html5/scrub.rb /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/lib/loofah/metahelpers.rb /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/lib/loofah/scrubber.rb /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/lib/loofah/scrubbers.rb /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/lib/loofah/version.rb /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/lib/loofah/xml /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/lib/loofah/xml/document.rb /usr/lib64/ruby/gems/4.0.0/gems/loofah-2.25.3/lib/loofah/xml/document_fragment.rb /usr/lib64/ruby/gems/4.0.0/specifications/loofah-2.25.3.gemspec /usr/share/doc/packages/ruby4.0-rubygem-loofah /usr/share/doc/packages/ruby4.0-rubygem-loofah/CHANGELOG.md /usr/share/doc/packages/ruby4.0-rubygem-loofah/MIT-LICENSE.txt /usr/share/doc/packages/ruby4.0-rubygem-loofah/README.md
Generated by rpm2html 1.8.1
Fabrice Bellet, Mon Nov 9 22:58:56 2026