File CVE-2015-7580.patch of Package rubygem-rails-html-sanitizer.1908
@@ -, +, @@
---
lib/rails/html/scrubbers.rb | 7 ++++++-
test/sanitizer_test.rb | 10 ++++++++++
2 files changed, 16 insertions(+), 1 deletion(-)
--- a/lib/rails/html/scrubbers.rb
+++ a/lib/rails/html/scrubbers.rb
@@ -60,6 +60,11 @@ module Rails
end
def scrub(node)
+ if node.cdata?
+ text = node.document.create_text_node node.text
+ node.replace text
+ return CONTINUE
+ end
return CONTINUE if skip_node?(node)
unless keep_node?(node)
@@ -76,7 +81,7 @@ module Rails
end
def skip_node?(node)
- node.text? || node.cdata?
+ node.text?
end
def scrub_attribute?(name)