Bump loofah from 2.22.0 to 2.25.2

[dependabot]

Bumps loofah from 2.22.0 to 2.25.2.

Release notes

Sourced from loofah's releases.

2.25.2 / 2026-07-15

Security

• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes numeric character references without semicolons (e.g. javascript&#58alert(1)), which browsers decode and execute, and rejects schemes split by them. See GHSA-5qhf-9phg-95m2. @​flavorjones
• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character references 	 and 
, which CGI.unescapeHTML does not decode and browsers strip from URIs, and rejects schemes split by them (e.g. java	script:alert(1)). See GHSA-8whx-365g-h9vv. @​flavorjones
• Ensure that both href and xlink:href attributes on SVG elements like use are restricted to local (same-document) references. Previously only xlink:href was restricted, allowing the SVG 2 href attribute to reference external documents. See GHSA-9wjq-cp2p-hrgf. @​flavorjones

Improved

• Harden data: URI mediatype parsing in Loofah::HTML5::Scrub.allowed_uri?. The mediatype is now parsed following the WHATWG data: URL spec and RFC 2397 instead of simply being split on a colon. A data: URI with an omitted or malformed mediatype is now treated as text/plain and allowed, and one without the required comma is now rejected. #305 @​flavorjones
• Remove feed from the default set of allowed protocols. The feed URI scheme was never accepted as a standard protocol, and no major browser supports it. Removing it reduces the attack surface particularly for non-browser contexts. #304 @​flavorjones
• Remove a vestigial &#x70 alternative from Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR. This appears to be an ancient typo dating back to pre-extraction Rails circa 2007. #305 @​flavorjones

2.25.1 / 2026-03-17

• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes unescaped whitespace entities and rejects schemas containing them. See GHSA-46fp-8f5p-pf2m. #302 @​flavorjones

2.25.0 / 2025-12-15

• Extract Loofah::HTML5::Scrub.allowed_uri? which operates on a string. Previously this logic was coupled to the parsed tree in .scrub_uri_attribute. #300 @​flavorjones
• Tightened up how entities and control characters are handled when detecting allowed URIs. #301 @​flavorjones

Full Changelog: flavorjones/loofah@v2.24.1...v2.25.0

2.24.1 / 2025-05-12

Ruby support

• Import only what's needed from cgi for support for Ruby 3.5 #296 @​Earlopain

2.24.0 / 2024-12-24

Added

• Built-in scrubber :double_breakpoint which sees <br><br> and wraps the surrounding content in <p> tags. #279, #284 @​josecolella @​torihuang

Improved

• Built-in scrubber :targetblank now skips a tags whose href attribute is an anchor link. Previously, all a tags were modified to have target='_blank'. #291 @​fnando

New Contributors

• @​andrew made their first contribution in flavorjones/loofah#289
• @​fnando made their first contribution in flavorjones/loofah#291
• @​josecolella and @​torihuang made their first contribution in flavorjones/loofah#284

Full Changelog: flavorjones/loofah@v2.23.1...v2.24.0

... (truncated)

Changelog

Sourced from loofah's changelog.

2.25.2 / 2026-07-15

Security

• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes numeric character references without semicolons (e.g. javascript&#58alert(1)), which browsers decode and execute, and rejects schemes split by them. See GHSA-5qhf-9phg-95m2. @​flavorjones
• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character references 	 and 
, which CGI.unescapeHTML does not decode and browsers strip from URIs, and rejects schemes split by them (e.g. java	script:alert(1)). See GHSA-8whx-365g-h9vv. @​flavorjones
• Ensure that both href and xlink:href attributes on SVG elements like use are restricted to local (same-document) references. Previously only xlink:href was restricted, allowing the SVG 2 href attribute to reference external documents. See GHSA-9wjq-cp2p-hrgf. @​flavorjones

Improved

• Harden data: URI mediatype parsing in Loofah::HTML5::Scrub.allowed_uri?. The mediatype is now parsed following the WHATWG data: URL spec and RFC 2397 instead of simply being split on a colon. A data: URI with an omitted or malformed mediatype is now treated as text/plain and allowed, and one without the required comma is now rejected. #305 @​flavorjones
• Remove feed from the default set of allowed protocols. The feed URI scheme was never accepted as a standard protocol, and no major browser supports it. Removing it reduces the attack surface particularly for non-browser contexts. #304 @​flavorjones
• Remove a vestigial &#x70 alternative from Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR. This appears to be an ancient typo dating back to pre-extraction Rails circa 2007. #305 @​flavorjones

2.25.1 / 2026-03-17

• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes unescaped whitespace entities and rejects schemas containing them. See GHSA-46fp-8f5p-pf2m. #302 @​flavorjones

2.25.0 / 2025-12-15

• Extract Loofah::HTML5::Scrub.allowed_uri? which operates on a string. Previously this logic was coupled to the parsed tree in .scrub_uri_attribute. #300 @​flavorjones
• Tightened up how entities and control characters are handled when detecting allowed URIs. #301 @​flavorjones

2.24.1 / 2025-05-12

Ruby support

• Import only what's needed from cgi for support for Ruby 3.5 #296 @​Earlopain

2.24.0 / 2024-12-24

Added

• Built-in scrubber :double_breakpoint which sees <br><br> and wraps the surrounding content in <p> tags. #279, #284 @​josecolella @​torihuang

Improved

• Built-in scrubber :targetblank now skips a tags whose href attribute is an anchor link. Previously, all a tags were modified to have target='_blank'. #291 @​fnando

2.23.1 / 2024-10-25

Added

• Allow CSS properties min-height and max-height. #288 @​lazyatom

... (truncated)

Commits

• 2706d7e version bump to v2.25.2
• 1afde0c Merge pull request #308 from flavorjones/security-2252
• f1be9d8 Update allowed_uri? to decode semicolon-less numeric character references
• 5e91af8 Update allowed_uri? to handle named whitespace character references
• 20867b9 Properly restrict SVG href attributes
• 5f3bff4 test: opt into JSON comment parsing for sanitizer testdata (#307)
• b07713d test: do not run in verbose mode
• babe7a8 doc: update CHANGELOG
• a8d8d96 Merge pull request #305 from flavorjones/drop-protocol-typo
• b52f4b0 version bump to 2.25.2.beta1
• Additional commits viewable in compare view

[jrhoads]

@dependabot rebase