v2.3.0

grosser · grosser · commit f02be347d3a4 · 2026-06-01T16:43:37.000-07:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,9 @@
 
 ### Unreleased
 
+### Version 3.0.0
+* Harden read_remote_file, use `allow_local_network: true` and `allow_file_uris: true` to bypass
+
 ### Version 2.2.0
 * Accept CSS `<number>` values with an omitted integer part (e.g. `.1`) inside `rgb()`/`rgba()`/`hsl()`/`hsla()`. Previously `RE_COLOUR_NUMERIC` and `RE_COLOUR_NUMERIC_ALPHA` required at least one digit before the decimal point, which caused colours such as `rgba(0,0,0,.1)` to be silently dropped during shorthand expansion (`background-color` from `background:`, `border-*-color` from `border:`).
 
diff --git a/Gemfile.lock b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    css_parser (2.2.0)
+    css_parser (3.0.0)
       addressable
       ssrf_filter (~> 1.5)
 
diff --git a/lib/css_parser/parser.rb b/lib/css_parser/parser.rb
@@ -38,7 +38,7 @@ class Parser
     REMOTE_ALLOWED_SCHEMES = %w[http https].freeze
 
     # Array of CSS files that have been loaded.
-    attr_reader   :loaded_uris
+    attr_reader :loaded_uris
 
     def initialize(options = {})
       @options = {
@@ -644,7 +644,7 @@ def read_local_file(uri) # :nodoc:
       # LFI gate; refuse to read rather than silently leak.
       unless @options[:allow_file_uris]
         raise "BUG: #{self.class}##{__method__} reached with " \
-              "allow_file_uris=false (LFI gate bypassed)"
+              'allow_file_uris=false (LFI gate bypassed)'
       end
 
       return nil unless circular_reference_check(uri.to_s)
@@ -735,7 +735,7 @@ def fetch_via_net_http(uri, redirect_count = 0) # :nodoc:
       # because the option does not change mid-request.
       unless @options[:allow_local_network]
         raise "BUG: #{self.class}##{__method__} reached with " \
-              "allow_local_network=false (SSRF gate bypassed)"
+              'allow_local_network=false (SSRF gate bypassed)'
       end
 
       raise RemoteFileError, uri.to_s unless REMOTE_ALLOWED_SCHEMES.include?(uri.scheme)
diff --git a/lib/css_parser/version.rb b/lib/css_parser/version.rb
@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module CssParser
-  VERSION = '2.2.0'.freeze
+  VERSION = '3.0.0'.freeze
 end
