Releases: flavorjones/loofah
Releases · flavorjones/loofah
Release list
2.25.2
2706d7e
This commit was signed with the committer’s verified signature.
2.25.2 / 2026-07-15
Security
- Ensure
Loofah::HTML5::Scrub.allowed_uri?recognizes numeric character references without semicolons (e.g.javascript:alert(1)), which browsers decode and execute, and rejects schemes split by them. See GHSA-5qhf-9phg-95m2. @flavorjones - Ensure
Loofah::HTML5::Scrub.allowed_uri?recognizes the named character references	and
, whichCGI.unescapeHTMLdoes not decode and browsers strip from URIs, and rejects schemes split by them (e.g.java	script:alert(1)). See GHSA-8whx-365g-h9vv. @flavorjones - Ensure that both
hrefandxlink:hrefattributes on SVG elements likeuseare restricted to local (same-document) references. Previously onlyxlink:hrefwas restricted, allowing the SVG 2hrefattribute to reference external documents. See GHSA-9wjq-cp2p-hrgf. @flavorjones
Improved
- Harden
data:URI mediatype parsing inLoofah::HTML5::Scrub.allowed_uri?. The mediatype is now parsed following the WHATWG data: URL spec and RFC 2397 instead of simply being split on a colon. Adata:URI with an omitted or malformed mediatype is now treated astext/plainand allowed, and one without the required comma is now rejected. #305 @flavorjones - Remove
feedfrom the default set of allowed protocols. The feed URI scheme was never accepted as a standard protocol, and no major browser supports it. Removing it reduces the attack surface particularly for non-browser contexts. #304 @flavorjones - Remove a vestigial
܊lternative fromLoofah::HTML5::SafeList::PROTOCOL_SEPARATOR. This appears to be an ancient typo dating back to pre-extraction Rails circa 2007. #305 @flavorjones
Contributors
flavorjones
Assets 2
2.25.1
c895c8b
This commit was signed with the committer’s verified signature.
2.25.1 / 2026-03-17
- Ensure
Loofah::HTML5::Scrub.allowed_uri?recognizes unescaped whitespace entities and rejects schemas containing them. See GHSA-46fp-8f5p-pf2m. #302 @flavorjones
Contributors
flavorjones
Assets 2
2.25.0 / 2025-12-15
e65bddd
This commit was signed with the committer’s verified signature.
2.25.0 / 2025-12-15
- Extract
Loofah::HTML5::Scrub.allowed_uri?which operates on a string. Previously this logic was coupled to the parsed tree in.scrub_uri_attribute. #300 @flavorjones - Tightened up how entities and control characters are handled when detecting allowed URIs. #301 @flavorjones
Full Changelog: v2.24.1...v2.25.0
Contributors
flavorjones
Assets 2
2.24.1 / 2025-05-12
6cadc8a
This commit was signed with the committer’s verified signature.
2.24.1 / 2025-05-12
Ruby support
- Import only what's needed from
cgifor support for Ruby 3.5 #296 @Earlopain
Contributors
Earlopain
Assets 2
2.24.0 / 2024-12-24
8599060
This commit was signed with the committer’s verified signature.
2.24.0 / 2024-12-24
Added
- Built-in scrubber
:double_breakpointwhich sees<br><br>and wraps the surrounding content in<p>tags. #279, #284 @josecolella @torihuang
Improved
- Built-in scrubber
:targetblanknow skipsatags whosehrefattribute is an anchor link. Previously, allatags were modified to havetarget='_blank'. #291 @fnando
New Contributors
- @andrew made their first contribution in #289
- @fnando made their first contribution in #291
- @josecolella and @torihuang made their first contribution in #284
Full Changelog: v2.23.1...v2.24.0
Contributors
andrew, fnando, and 2 other contributors
Assets 2
2.23.1 / 2024-10-25
3c09a93
This commit was signed with the committer’s verified signature.
Contributors
lazyatom
Assets 2
2.23.0 / 2024-10-24
5ac17a8
This commit was signed with the committer’s verified signature.
2.23.0 / 2024-10-24
Added
New Contributors
- @m-nakamura145 made their first contribution in #280
- @lazyatom made their first contribution in #287
Full Changelog: v2.22.0...v2.23.0
Contributors
lazyatom and m-nakamura145
Assets 2
2.22.0 / 2023-11-13
cb14ea7
This commit was signed with the committer’s verified signature.
The key has expired.
2.22.0 / 2023-11-13
Added
- A
:targetblankHTML scrubber which ensures all hyperlinks havetarget="_blank". [#275] @stefannibrasil and @thdaraujo - A
:noreferrerHTML scrubber which ensures all hyperlinks haverel=noreferrer, similar to the:nofollowand:noopenerscrubbers. [#277] @wynksaiddestroy
Contributors
thdaraujo, wynksaiddestroy, and stefannibrasil
Assets 2
2.21.4 / 2023-10-10
992b054
This commit was signed with the committer’s verified signature.
The key has expired.
2.21.3 / 2023-05-15
e34118a
This commit was signed with the committer’s verified signature.
2.21.3 / 2023-05-15
- Quash "instance variable not initialized" warning in Ruby < 3.0. [#268] (Thanks, @dharamgollapudi!)