#263 chore(deps-dev): bump loofah from 2.25.2 to 2.25.3

Sourced from loofah's releases.

2.25.3 / 2026-11-01

Security

• Ensure Loofah::HTML5::Scrub.allowed_uri? rejects schemes split by a numeric character reference without a semicolon that ends at a character allowed_uri? strips (e.g. javascript&#x3a alert(1)) or at another character reference (e.g. javascript&#x3aalert(1)). Character references are now decoded before anything is stripped, as browsers do. See GHSA-p9wj-w8xq-vjx6. @​flavorjones
• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character reference /, which CGI.unescapeHTML does not decode and browsers read as /, and rejects data: URIs that disguise a disallowed mediatype with it (e.g. data:text&sol;html,<script>alert(1)</script>). Previously that mediatype was treated as malformed and fell back to the allowed text/plain. Only v2.25.2 is affected. See GHSA-jcff-cj73-4w4f. @​flavorjones
• Ensure Loofah::HTML5::Scrub.scrub_css does not decode CSS escapes in identifiers. Previously, escaped parentheses (e.g. url\28 http://example.com/\29) came out as a live url(), which could make the viewer's browser fetch an attacker-chosen URL. See GHSA-m3x9-938q-5767. @​flavorjones
• Ensure that href and xlink:href on SVG textPath and mpath elements are restricted to local (same-document) references. Previously SVG_ALLOW_LOCAL_HREF spelled textPath in lowercase, which never matched the name the HTML5 parser assigns inside <svg>, and omitted mpath entirely. See GHSA-345x-3rq2-jfrm. @​flavorjones
• Fix quadratic-time scrubbing of the href and xlink:href attributes of SVG elements. Only Ruby 3.1 and earlier are affected, because Ruby 3.2 introduced linear-time regexp matching. See GHSA-mf2j-8f84-cc9q. @​flavorjones
• Ensure HTML5 scrubber output does not turn into new markup when a browser parses it again. The fix is in Nokogiri v1.19.5, which escapes < and > in attribute values as the HTML standard requires, so Loofah now requires Nokogiri >= 1.19.5. See GHSA-h6v6-rg66-fqj4. @​flavorjones @​hackvertor

Dependencies

• Loofah now requires Ruby >= 3.2, the minimum that Nokogiri v1.19.x supports. We don't like dropping Ruby versions in a patch release, and we're sorry for the inconvenience, but it's the only way to make sure everyone gets the security fix in GHSA-h6v6-rg66-fqj4.

Added

• Loofah::HTML5::Scrub.prefixed_attribute_name and Loofah::HTML5::Scrub.scrub_attribute_value expose the html5lib attribute name and value rules, so downstream consumers can apply them instead of carrying their own copy. @​flavorjones

Fixed

• Fix :double_breakpoint, which left document fragments unchanged despite its documented example. The scrubber now changes only paragraphs inside the scrubbed node, and its run time on a document grows linearly, not quadratically, with the paragraph count. #309 @​OskarEichler
• Fix :whitewash, which passed CDATA sections through unchanged. Markup inside a CDATA section in Loofah.xml_fragment or Loofah.xml_document survived scrubbing and became live elements if the output was later parsed as HTML. The scrubber now escapes CDATA content, as :strip, :prune and :escape already do. On JRuby, every sanitizer now emits escaped CDATA content as a CDATA section, as on CRuby, instead of a text node that double-escaped it. #313 @​flavorjones (reported by @​MegaManSec)
• Fix :double_breakpoint, which raised NoMethodError on a paragraph that ends with a <br> after a double break. #314 @​flavorjones (reported by @​MegaManSec)
• Fix Loofah::HTML5::Scrub.allowed_uri?, which raised Encoding::CompatibilityError on a string in an encoding other than UTF-8 and ArgumentError on invalid UTF-8. It now transcodes the input to UTF-8 and returns false when the input has an invalid byte sequence or no UTF-8 representation. #315 @​flavorjones

New Contributors

• @​OskarEichler made their first contribution in flavorjones/loofah#309

Full Changelog: https://github.com/flavorjones/loofah/compare/v2.25.2...v2.25.3

Sourced from loofah's changelog.

2.25.3 / 2026-11-01

Security

• Ensure Loofah::HTML5::Scrub.allowed_uri? rejects schemes split by a numeric character reference without a semicolon that ends at a character allowed_uri? strips (e.g. javascript&#x3a alert(1)) or at another character reference (e.g. javascript&#x3aalert(1)). Character references are now decoded before anything is stripped, as browsers do. See GHSA-p9wj-w8xq-vjx6. @​flavorjones
• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character reference /, which CGI.unescapeHTML does not decode and browsers read as /, and rejects data: URIs that disguise a disallowed mediatype with it (e.g. data:text&sol;html,<script>alert(1)</script>). Previously that mediatype was treated as malformed and fell back to the allowed text/plain. Only v2.25.2 is affected. See GHSA-jcff-cj73-4w4f. @​flavorjones
• Ensure Loofah::HTML5::Scrub.scrub_css does not decode CSS escapes in identifiers. Previously, escaped parentheses (e.g. url\28 http://example.com/\29) came out as a live url(), which could make the viewer's browser fetch an attacker-chosen URL. See GHSA-m3x9-938q-5767. @​flavorjones
• Ensure that href and xlink:href on SVG textPath and mpath elements are restricted to local (same-document) references. Previously SVG_ALLOW_LOCAL_HREF spelled textPath in lowercase, which never matched the name the HTML5 parser assigns inside <svg>, and omitted mpath entirely. See GHSA-345x-3rq2-jfrm. @​flavorjones
• Fix quadratic-time scrubbing of the href and xlink:href attributes of SVG elements. Only Ruby 3.1 and earlier are affected, because Ruby 3.2 introduced linear-time regexp matching. See GHSA-mf2j-8f84-cc9q. @​flavorjones
• Ensure HTML5 scrubber output does not turn into new markup when a browser parses it again. The fix is in Nokogiri v1.19.5, which escapes < and > in attribute values as the HTML standard requires, so Loofah now requires Nokogiri >= 1.19.5. See GHSA-h6v6-rg66-fqj4. @​flavorjones @​hackvertor

Dependencies

• Loofah now requires Ruby >= 3.2, the minimum that Nokogiri v1.19.x supports. We don't like dropping Ruby versions in a patch release, and we're sorry for the inconvenience, but it's the only way to make sure everyone gets the security fix in GHSA-h6v6-rg66-fqj4.

Added

• Loofah::HTML5::Scrub.prefixed_attribute_name and Loofah::HTML5::Scrub.scrub_attribute_value expose the html5lib attribute name and value rules, so downstream consumers can apply them instead of carrying their own copy. @​flavorjones

Fixed

• Fix :double_breakpoint, which left document fragments unchanged despite its documented example. The scrubber now changes only paragraphs inside the scrubbed node, and its run time on a document grows linearly, not quadratically, with the paragraph count. #309 @​OskarEichler
• Fix :whitewash, which passed CDATA sections through unchanged. Markup inside a CDATA section in Loofah.xml_fragment or Loofah.xml_document survived scrubbing and became live elements if the output was later parsed as HTML. The scrubber now escapes CDATA content, as :strip, :prune and :escape already do. On JRuby, every sanitizer now emits escaped CDATA content as a CDATA section, as on CRuby, instead of a text node that double-escaped it. #313 @​flavorjones (reported by @​MegaManSec)
• Fix :double_breakpoint, which raised NoMethodError on a paragraph that ends with a <br> after a double break. #314 @​flavorjones (reported by @​MegaManSec)
• Fix Loofah::HTML5::Scrub.allowed_uri?, which raised Encoding::CompatibilityError on a string in an encoding other than UTF-8 and ArgumentError on invalid UTF-8. It now transcodes the input to UTF-8 and returns false when the input has an invalid byte sequence or no UTF-8 representation. #315 @​flavorjones

• bbe007e version bump to v2.25.3
• a390863 Merge pull request #324 from flavorjones/card-933-release-v2-25-3
• 7f20aba doc: fix up CHANGELOG
• 30924ba build: require Ruby >= 3.2
• 7ba1e7b fix: require Nokogiri >= 1.19.5 to prevent mXSS in HTML5 scrubbers
• 41c681b doc: fix up CHANGELOG
• 5431ea9 doc: update CHANGELOG
• 62c0484 fix: allowed_uri? bypass via a stripped reference terminator
• ad92002 Update allowed_uri? to handle the named solidus character reference
• d3ae9eb doc: update CHANGELOG
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.