Sanitize History ================================================================================ Version 1.0.3 (2009-01-15) * Fixed a bug whereby incomplete Unicode or hex entities could be used to prevent non-whitelisted protocols from being cleaned. Since IE6 and Opera still decode the incomplete entities, users of those browsers may be vulnerable to malicious script injection on websites using versions of Sanitize prior to 1.0.3. Version 1.0.2 (2009-01-04) * Fixed a bug that caused an exception to be thrown when parsing a valueless attribute that's expected to contain a URL. Version 1.0.1 (2009-01-01) * You can now specify :relative in a protocol config array to allow attributes containing relative URLs with no protocol. The Basic and Relaxed configs have been updated to allow relative URLs. * Added a workaround for an Hpricot bug that causes HTML entities for non-ASCII characters to be replaced by question marks, and all other entities to be destructively decoded. Version 1.0.0 (2008-12-25) * First release.