BSD Ports

www/ruby-loofah 2.25.2 NetBSD

HTML sanitizer for Rails applications

System
NetBSD
Repository
pkgsrc
Maintainer
[email protected]
Last update
Commit
61edb85869
License
mit
Categories
www, ruby
Package size
78.6 KiB, 246.3 KiB installed

Description

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments. It's built on top of Nokogiri and libxml2, so it's fast and has a nice API. Loofah excels at HTML sanitization (XSS prevention). It includes some nice HTML sanitizers, which are based on HTML5lib's whitelist, so it most likely won't make your codes less secure.

Install

Binary package:

pkgin install ruby33-loofah

From pkgsrc:

cd /usr/pkgsrc/www/ruby-loofah && make install clean

Packages

The version each package repository carries. “-” means the repository builds no package of it, “n/a” that there is no such repository.

RepositoryVersion
NetBSD 10.1 x86_642.25.2
NetBSD 10.1 aarch642.25.2
SmartOS / illumos x86_642.25.2
macOS 15 arm642.25.2

Dependencies

Run dependencies 3

Configuration

No options to configure.

Service scripts
none
Flavors
ruby34-loofah-2.25.2, ruby40-loofah-2.25.2

Commit history 1

DateCommitCreditsLog message
61edb85869 taca www/ruby-loofah: update to 2.25.2
2.25.2 (2026-07-15) Security * Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes numeric character references without semicolons (e.g. javascript&#58alert(1)), which browsers decode and execute, and rejects schemes split by them. See GHSA-5qhf-9phg-95m2. @flavorjones * Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character references 	 and 
, which CGI.unescapeHTML does not decode and browsers strip from URIs, and rejects schemes split by them (e.g. java	script:alert(1)). See GHSA-8whx-365g-h9vv. @flavorjones * Ensure that both href and xlink:href attributes on SVG elements like use are restricted to local (same-document) references. Previously only xlink:href was restricted, allowing the SVG 2 href attribute to reference …