https://github.com/rgrove/crass -

Security

• High: Fixed a denial of service vulnerability in which a large numeric exponent could consume disproportionate CPU and memory before the value was clamped. Exponents are now bounded before 10**exponent is computed. (GHSA-6wmf-3r64-vcwv)

• Moderate: Fixed a scenario in which deeply nested simple blocks or functions could exhaust the Ruby stack and raise SystemStackError, or could result in excessive memory usage. Parser nesting is now limited to a configurable maximum depth via a new option (:maximum_depth, with a conservative default of 25). Constructs nested more deeply are discarded as an :error node with the value "maximum-depth-exceeded". (GHSA-6jxj-px6v-747w)

• Moderate: Fixed a scenario in which a long run of adjacent comments could exhaust the Ruby stack and raise SystemStackError. Discarded comments are now skipped iteratively rather than recursively. (GHSA-wwpr-jff3-395c)

• Moderate: Fixed a denial of service vulnerability in which inputs containing many non-ASCII characters could cause excessive CPU usage due to inefficient handling of multi-byte characters during tokenization. (GHSA-8vfg-2r28-hvhj)

- Ruby
Published by rgrove about 2 months ago

https://github.com/rgrove/crass -

• Number values are now limited to a maximum of Float::MAX and a minimum of negative Float::MAX. (#11)

• Added project metadata to the gemspec. (#9 - @orien)

- Ruby
Published by rgrove over 6 years ago

https://github.com/rgrove/crass -

• Removed test files from the gem. (#8 - @t-richards)

- Ruby
Published by rgrove almost 7 years ago

https://github.com/rgrove/crass -

• Fixed whitespace warnings. (#7 - @yahonda)

- Ruby
Published by rgrove over 8 years ago

https://github.com/rgrove/crass -

• Added support for frozen string literals. (#3 - @flavorjones)

- Ruby
Published by rgrove almost 9 years ago

https://github.com/rgrove/crass -

• Fixed: An at-rule immediately followed by a {} simple block would have the block (and subsequent tokens until a semicolon) incorrectly appended to its prelude. This was super dumb and made me very sad.

- Ruby
Published by rgrove over 11 years ago

https://github.com/rgrove/crass -

• Fixed: Modifications made to the block of an :at_rule node in a parse tree weren't reflected when that node was stringified. This was a regression introduced in 1.0.0.

- Ruby
Published by rgrove almost 12 years ago

https://github.com/rgrove/crass -

• Many parsing and tokenization tweaks to bring us into full compliance with the 14 November 2014 editor's draft of the CSS syntax spec. The most significant outwardly visible change is that quoted URLs like url("foo") are now returned as :function tokens and not :url tokens due to a change in the tokenization spec.
• Teensy tiny speed and memory usage improvements that you almost certainly won't notice.
• Fixed: A semicolon following a @charset rule would be omitted during serialization.
• Fixed: A multibyte char at the beginning of an id token could trigger an encoding error because StringScanner#peek is a jerkface.

- Ruby
Published by rgrove almost 12 years ago