CVS commit: [pkgsrc-2026Q2] pkgsrc/www/ruby-loofah

Module Name:	pkgsrc
Committed By:	maya
Date:		Mon Aug  3 03:40:04 UTC 2026

Modified Files:
	pkgsrc/www/ruby-loofah [pkgsrc-2026Q2]: Makefile distinfo

Log Message:
Pullup ticket #7210 - requested by taca
www/ruby-loofah: Security fix

Revisions pulled up:
- www/ruby-loofah/Makefile                                      1.28
- www/ruby-loofah/distinfo                                      1.30

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Tue Jul 21 14:12:19 UTC 2026

   Modified Files:
   	pkgsrc/www/ruby-loofah: Makefile distinfo

   Log Message:
   www/ruby-loofah: update to 2.25.2

   2.25.2 (2026-07-15)

   Security

   * Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes numeric character
     references without semicolons (e.g. javascript&#58alert(1)), which
     browsers decode and execute, and rejects schemes split by them.  See
     GHSA-5qhf-9phg-95m2.  @flavorjones

   * Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character
     references 	 and 
, which CGI.unescapeHTML does not decode and
     browsers strip from URIs, and rejects schemes split by them
     (e.g. java	script:alert(1)).  See GHSA-8whx-365g-h9vv.  @flavorjones

   * Ensure that both href and xlink:href attributes on SVG elements like use
     are restricted to local (same-document) references.  Previously only
     xlink:href was restricted, allowing the SVG 2 href attribute to reference
     external documents.  See GHSA-9wjq-cp2p-hrgf.  @flavorjones

   Improved

   * Harden data: URI mediatype parsing in Loofah::HTML5::Scrub.allowed_uri?.
     The mediatype is now parsed following the WHATWG data: URL spec and RFC
     2397 instead of simply being split on a colon.  A data: URI with an
     omitted or malformed mediatype is now treated as text/plain and allowed,
     and one without the required comma is now rejected.  #305 @flavorjones

   * Remove feed from the default set of allowed protocols.  The feed URI
     scheme was never accepted as a standard protocol, and no major browser
     supports it.  Removing it reduces the attack surface particularly for
     non-browser contexts.  #304 @flavorjones

   * Remove a vestigial &#x70 alternative from
     Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR.  This appears to be an
     ancient typo dating back to pre-extraction Rails circa 2007. #305
     @flavorjones


To generate a diff of this commit:
cvs rdiff -u -r1.27 -r1.27.2.1 pkgsrc/www/ruby-loofah/Makefile
cvs rdiff -u -r1.29 -r1.29.2.1 pkgsrc/www/ruby-loofah/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/ruby-loofah/Makefile
diff -u pkgsrc/www/ruby-loofah/Makefile:1.27 pkgsrc/www/ruby-loofah/Makefile:1.27.2.1
--- pkgsrc/www/ruby-loofah/Makefile:1.27	Sun Mar 29 13:47:19 2026
+++ pkgsrc/www/ruby-loofah/Makefile	Mon Aug  3 03:40:04 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.27 2026/03/29 13:47:19 taca Exp $
+# $NetBSD: Makefile,v 1.27.2.1 2026/08/03 03:40:04 maya Exp $
 
-DISTNAME=	loofah-2.25.1
+DISTNAME=	loofah-2.25.2
 CATEGORIES=	www
 
 MAINTAINER=	[email protected]

Index: pkgsrc/www/ruby-loofah/distinfo
diff -u pkgsrc/www/ruby-loofah/distinfo:1.29 pkgsrc/www/ruby-loofah/distinfo:1.29.2.1
--- pkgsrc/www/ruby-loofah/distinfo:1.29	Sun Mar 29 13:47:19 2026
+++ pkgsrc/www/ruby-loofah/distinfo	Mon Aug  3 03:40:04 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.29 2026/03/29 13:47:19 taca Exp $
+$NetBSD: distinfo,v 1.29.2.1 2026/08/03 03:40:04 maya Exp $
 
-BLAKE2s (loofah-2.25.1.gem) = 30cd892cfed52141241c9f4efc619b5bbc6372745a0188cb555241971733e7d3
-SHA512 (loofah-2.25.1.gem) = 8cccfc6ab2009e8f997a4595cc00d9621061ac4ec044391ae4893be95775a0218fd1fd9e3e34ae6167449c2506b87f713219c7273209b898972e21736bf9be50
-Size (loofah-2.25.1.gem) = 34816 bytes
+BLAKE2s (loofah-2.25.2.gem) = bff2f5e2029869f6a0f2d2dc2bba3d1108194b953b2e08fe724c5166eccb8c92
+SHA512 (loofah-2.25.2.gem) = 7c5fe099c01266eadcb48f79837fa645c04c6c1a6d334c93f207f2a8a5e8878b256eee07e5476adfc3f849e202237a51f5d5d0a91a1bd2b65b8dadbc26616209
+Size (loofah-2.25.2.gem) = 36864 bytes