* Bump thruster 0.1.15 → 0.1.23
* Scrub disallowed attributes on allowed tags in message rendering
SanitizeTags removes disallowed tags from message presentation, but
attributes on the tags it allows passed through untouched. Extend the
content-filter chain with a SanitizeAttributes filter that runs Rails'
safe-list sanitizer over the remaining markup, stripping event-handler
attributes and unsafe URI schemes as defense-in-depth alongside the
existing Content-Security-Policy.
Running it after SanitizeTags with the same allowed-tags list makes the
sanitizer's tag pass a no-op, preserving SanitizeTags' remove-not-unwrap
semantics while scrubbing attributes. The attribute allowlist is the
standard ActionText set (which keeps attachments intact) plus class,
which presentation styling relies on.
If deploying Campfire to a path other than the root (for example, using
Kamal's path-based routing) then the Action Cable endpoint needs to be
adjusted to include that path.
Prepending the script name to the cable path means it will be adjusted
to the path in the same way that the application routes are. When script
name is the default, the behaviour is unchanged.
Jeremy Daer
Kevin McConnell
Stanko Krtalić
Keshav Kk
Dmitri Kondratjev
sjdonado