Sanitize History
================================================================================

Version 1.1.0 (2009-10-11)
  * Migrated from Hpricot to Nokogiri. Requires libxml2 >= 2.7.2 [Adam Hooper]
  * Added an :output config setting to allow the output format to be specified.
    Supported formats are :xhtml (the default) and :html (which outputs HTML4).
  * Changed protocol regex to ensure Sanitize doesn't kill URLs with colons in 
    path segments. [Peter Cooper]

Version 1.0.8 (2009-04-23)
  * Added a workaround for an Hpricot bug that prevents attribute names from
    being downcased in recent versions of Hpricot. This was exploitable to
    prevent non-whitelisted protocols from being cleaned. [Reported by Ben
    Wanicur]

Version 1.0.7 (2009-04-11)
  * Requires Hpricot 0.8.1+, which is finally compatible with Ruby 1.9.1.
  * Fixed a bug that caused named character entities containing digits (like
    ²) to be escaped when they shouldn't have been. [Reported by Sebastian
    Steinmetz]

Version 1.0.6 (2009-02-23)
  * Removed htmlentities gem dependency.
  * Existing well-formed character entity references in the input string are now
    preserved rather than being decoded and re-encoded.
  * The ' character is now encoded as ' instead of ' to prevent
    problems in IE6.
  * You can now specify the symbol :all in place of an element name in the
    attributes config hash to allow certain attributes on all elements. [Thanks
    to Mutwin Kraus]

Version 1.0.5 (2009-02-05)
  * Fixed a bug introduced in version 1.0.3 that prevented non-whitelisted
    protocols from being cleaned when relative URLs were allowed. [Reported by
    Dev Purkayastha]
  * Fixed "undefined method `parent='" exceptions caused by parser changes in
    edge Hpricot.

Version 1.0.4 (2009-01-16)
  * Fixed a bug that made it possible to sneak a non-whitelisted element through
    by repeating it several times in a row. All versions of Sanitize prior to
    1.0.4 are vulnerable. [Reported by Cristobal]

Version 1.0.3 (2009-01-15)
  * Fixed a bug whereby incomplete Unicode or hex entities could be used to
    prevent non-whitelisted protocols from being cleaned. Since IE6 and Opera
    still decode the incomplete entities, users of those browsers may be
    vulnerable to malicious script injection on websites using versions of
    Sanitize prior to 1.0.3.

Version 1.0.2 (2009-01-04)
  * Fixed a bug that caused an exception to be thrown when parsing a valueless
    attribute that's expected to contain a URL.

Version 1.0.1 (2009-01-01)
  * You can now specify :relative in a protocol config array to allow attributes
    containing relative URLs with no protocol. The Basic and Relaxed configs
    have been updated to allow relative URLs.
  * Added a workaround for an Hpricot bug that causes HTML entities for
    non-ASCII characters to be replaced by question marks, and all other
    entities to be destructively decoded.

Version 1.0.0 (2008-12-25)
  * First release.