Sanitize History
================================================================================
Version 1.0.4 (2009-01-16)
* Fixed a bug that made it possible to sneak a non-whitelisted element through
by repeating it several times in a row. All versions of Sanitize prior to
1.0.4 are vulnerable. [Reported by Cristobal]
Version 1.0.3 (2009-01-15)
* Fixed a bug whereby incomplete Unicode or hex entities could be used to
prevent non-whitelisted protocols from being cleaned. Since IE6 and Opera
still decode the incomplete entities, users of those browsers may be
vulnerable to malicious script injection on websites using versions of
Sanitize prior to 1.0.3.
Version 1.0.2 (2009-01-04)
* Fixed a bug that caused an exception to be thrown when parsing a valueless
attribute that's expected to contain a URL.
Version 1.0.1 (2009-01-01)
* You can now specify :relative in a protocol config array to allow attributes
containing relative URLs with no protocol. The Basic and Relaxed configs
have been updated to allow relative URLs.
* Added a workaround for an Hpricot bug that causes HTML entities for
non-ASCII characters to be replaced by question marks, and all other
entities to be destructively decoded.
Version 1.0.0 (2008-12-25)
* First release.
