Fetching contributors…
Cannot retrieve contributors at this time
71 lines (59 sloc) 3.09 KB
Sanitize History
Version (git)
* Requires Nokogiri >= 1.4.0.
* Added elements h1 through h6 to the Relaxed whitelist. [Suggested by David
Version 1.1.0 (2009-10-11)
* Migrated from Hpricot to Nokogiri. Requires libxml2 >= 2.7.2 [Adam Hooper]
* Added an :output config setting to allow the output format to be specified.
Supported formats are :xhtml (the default) and :html (which outputs HTML4).
* Changed protocol regex to ensure Sanitize doesn't kill URLs with colons in
path segments. [Peter Cooper]
Version 1.0.8 (2009-04-23)
* Added a workaround for an Hpricot bug that prevents attribute names from
being downcased in recent versions of Hpricot. This was exploitable to
prevent non-whitelisted protocols from being cleaned. [Reported by Ben
Version 1.0.7 (2009-04-11)
* Requires Hpricot 0.8.1+, which is finally compatible with Ruby 1.9.1.
* Fixed a bug that caused named character entities containing digits (like
²) to be escaped when they shouldn't have been. [Reported by Sebastian
Version 1.0.6 (2009-02-23)
* Removed htmlentities gem dependency.
* Existing well-formed character entity references in the input string are now
preserved rather than being decoded and re-encoded.
* The ' character is now encoded as ' instead of ' to prevent
problems in IE6.
* You can now specify the symbol :all in place of an element name in the
attributes config hash to allow certain attributes on all elements. [Thanks
to Mutwin Kraus]
Version 1.0.5 (2009-02-05)
* Fixed a bug introduced in version 1.0.3 that prevented non-whitelisted
protocols from being cleaned when relative URLs were allowed. [Reported by
Dev Purkayastha]
* Fixed "undefined method `parent='" exceptions caused by parser changes in
edge Hpricot.
Version 1.0.4 (2009-01-16)
* Fixed a bug that made it possible to sneak a non-whitelisted element through
by repeating it several times in a row. All versions of Sanitize prior to
1.0.4 are vulnerable. [Reported by Cristobal]
Version 1.0.3 (2009-01-15)
* Fixed a bug whereby incomplete Unicode or hex entities could be used to
prevent non-whitelisted protocols from being cleaned. Since IE6 and Opera
still decode the incomplete entities, users of those browsers may be
vulnerable to malicious script injection on websites using versions of
Sanitize prior to 1.0.3.
Version 1.0.2 (2009-01-04)
* Fixed a bug that caused an exception to be thrown when parsing a valueless
attribute that's expected to contain a URL.
Version 1.0.1 (2009-01-01)
* You can now specify :relative in a protocol config array to allow attributes
containing relative URLs with no protocol. The Basic and Relaxed configs
have been updated to allow relative URLs.
* Added a workaround for an Hpricot bug that causes HTML entities for
non-ASCII characters to be replaced by question marks, and all other
entities to be destructively decoded.
Version 1.0.0 (2008-12-25)
* First release.