security alerts

glossarist · Aug 23, 2024 · 26aa16f · 26aa16f
1 parent beae4f4
commit 26aa16f
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/lib/iev.rb b/lib/iev.rb
@@ -43,7 +43,7 @@ def self.get(code, lang)
     a = doc&.at(xpath)&.children&.to_xml
     a&.sub(%r{<br/>.*$}, "")
       &.sub(%r{, &lt;.*$}, "")
-      &.gsub(%r{<[^>]*>}, "")&.strip
+      &.gsub(%r{<[^<>]*>}, "")&.strip
   end
 end
 

diff --git a/lib/iev/utilities.rb b/lib/iev/utilities.rb
@@ -27,7 +27,7 @@ def parse_anchor_tag(text, term_domain)
           /<a href="?(IEV)?\s*(\d\d\d-\d\d-\d\d\d?)"?>(.*?)$/,
           '{{\3, IEV:\2}}',
         ).gsub(
-          /<a href="?(.*?)"?>(.*?)<\/a>/,
+          /<a href="?([^<>]*?)"?>(.*?)<\/a>/,
           '\1[\2]',
         ).gsub(
           Regexp.new([SIMG_PATH_REGEX, "\\s*", FIGURE_TWO_REGEX].join),
@@ -36,7 +36,7 @@ def parse_anchor_tag(text, term_domain)
           Regexp.new([SIMG_PATH_REGEX, "\\s*", FIGURE_ONE_REGEX].join),
           "#{IMAGE_PATH_PREFIX}/#{term_domain}/\\1[Figure \\2 - \\3]",
         ).gsub(
-          /<img\s+(.+?)\s*>/,
+          /<img\s+([^<>]+?)\s*>/,
           "#{IMAGE_PATH_PREFIX}/#{term_domain}/\\1[]",
         ).gsub(
           /<br>/,