All Versions
Latest Version
Avg Release Cycle
105 days
Latest Release
993 days ago

Changelog History
Page 1

  • v6.0.0 Changes

    August 03, 2021

    Potentially Breaking Changes

    • πŸ’Ž Ruby 2.5.0 is now the oldest officially supported Ruby version.

    • Sanitize now requires Nokogiri 1.12.0 or higher, which includes Nokogumbo. The separate dependency on Nokogumbo has been removed. @lis2 - #211

  • v5.2.3 Changes

    January 11, 2021

    πŸ› Bug Fixes

    • Ensure protocol sanitization is applied to data attributes. @ccutrer - #207
  • v5.2.2 Changes

    January 06, 2021

    πŸ› Bug Fixes

    • πŸ›  Fixed a deprecation warning in Ruby 2.7+ when using keyword arguments in a custom transformer. @mscrivo - #206
  • v5.2.1 Changes

    June 16, 2020

    πŸ› Bug Fixes

    • πŸ›  Fixed an HTML sanitization bypass that could allow XSS. This issue affects Sanitize versions 3.0.0 through 5.2.0.

    When HTML was sanitized using the "relaxed" config or a custom config that allows certain elements, some content in a <math> or <svg> element may not have beeen sanitized correctly even if math and svg were not in the allowlist. This could allow carefully crafted input to sneak arbitrary HTML through Sanitize, potentially enabling an XSS (cross-site scripting) attack.

    You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements:

    -   `iframe`
    -   `math`
    -   `noembed`
    -   `noframes`
    -   `noscript`
    -   `plaintext`
    -   `script`
    -   `style`
    -   `svg`
    -   `xmp`

    See the security advisory for more details, including a workaround if you're not able to upgrade: [GHSA-p4x4-rw2p-8j8m]

    Many thanks to MichaΕ‚ Bentkowski of Securitum for reporting this issue and helping to verify the fix.

    πŸ”’ [GHSA-p4x4-rw2p-8j8m]:

  • v5.2.0 Changes

    June 06, 2020

    πŸ”„ Changes

    • The term "whitelist" has been replaced with "allowlist" throughout Sanitize's source and documentation.

    While the etymology of "whitelist" may not be explicitly racist in origin or intent, there are inherent racial connotations in the implication that white is good and black (as in "blacklist") is not.

    This is a change I should have made long ago, and I apologize for not making it sooner.

    • In transformer input, the :is_whitelisted and :node_whitelist keys are now deprecated. New :is_allowlisted and :node_allowlist keys have been added. The old keys will continue to work in order to avoid breaking existing code, but they are no longer documented and may be removed in a future semver major release.
  • v5.1.0 Changes

    September 07, 2019

    πŸ”‹ Features

    • βž• Added a :parser_options config hash, which makes it possible to pass custom parsing options to Nokogumbo. @austin-wang - #194

    πŸ› Bug Fixes

    • Non-characters and non-whitespace control characters are now stripped from HTML input before parsing to comply with the HTML Standard's [preprocessing guidelines][html-preprocessing]. Prior to this Sanitize had adhered to older W3C guidelines that have since been withdrawn. #179

    πŸ“œ [html-preprocessing]:

  • v5.0.0 Changes

    October 14, 2018

    ⬆️ For most users, upgrading from 4.x shouldn't require any changes. However, the πŸ’Ž minimum required Ruby version has changed, and Sanitize 5.x's HTML output may differ in some small ways from 4.x's output. If this matters to you, please review the changes below carefully.

    Potentially Breaking Changes

    • πŸ’Ž Ruby 2.3.0 is now the oldest officially supported Ruby version. Sanitize may work in older 2.x Rubies, but they aren't actively tested. Sanitize definitely no longer works in Ruby 1.9.x.

    • ⬆️ Upgraded to Nokogumbo 2.x, which fixes various bugs and adds standard-compliant HTML serialization. @stevecheckoway - #189

    • 🚚 Children of the following elements are now removed by default when these elements are removed, rather than being preserved and escaped:

      • iframe
      • noembed
      • noframes
      • noscript
      • script
      • style
    • 🚚 Children of allowlisted iframe elements are now always removed. In modern HTML, iframe elements should never have children. In HTML 4 and earlier iframe elements were allowed to contain fallback content for legacy browsers, but it's been almost two decades since that was useful.

    • πŸ›  Fixed a bug that caused :remove_contents to behave as if it were set to true when it was actually an Array.

  • v4.6.6 Changes

    July 23, 2018
    • πŸ‘Œ Improved performance and memory usage by optimizing Sanitize#transform_node! @stanhu - #183
  • v4.6.5 Changes

    May 16, 2018
    • πŸ‘Œ Improved performance slightly by tweaking the order of built-in transformers. @rafbm - #180
  • v4.6.4 Changes

    March 20, 2018
    • πŸ›  Fixed: A change introduced in 4.6.2 broke certain transformers that relied on being able to mutate the name of an HTML node. That change has been reverted and a test has been added to cover this case. @zetter - #177