Redmine

      SANITIZER = SanitizationFilter.new

          SANITIZER.call(fragment)

# frozen_string_literal: true

# Redmine - project management software

# Copyright (C) 2006-  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

module Redmine

  module WikiFormatting

    module Textile

      # Sanitizes the HTML generated by the Textile formatter

      class SanitizationFilter < Redmine::WikiFormatting::SanitizationFilter

        ALLOWED_CLASS_RE = /\A(wiki-class-\S+|external|email|footnote)\z/

        ALLOWED_ID_RE = /\A(wiki-id-\S+|fn\d+)\z/

        # Same properties as the ones accepted by RedCloth3::STYLES_RE

        STYLE_PROPERTY_RE = /\A(color|(min-|max-)?(width|height)|border|background|padding|margin|font|text|float)(-[a-z]+)*\z/

        STYLE_PROPERTIES =

          (Sanitize::Config::RELAXED[:css][:properties].grep(STYLE_PROPERTY_RE) + %w[vertical-align]).freeze

        private

        def default_allowlist

          allowlist = super

          allowlist[:elements] += %w[font]

          allowlist[:attributes][:all] += %w[class id]

          allowlist[:attributes]['font'] = %w[face]

          allowlist[:css][:properties] |= STYLE_PROPERTIES

          allowlist

        end

        def add_transformers

          super

          allowlist[:transformers].push method(:remove_disallowed_classes_and_ids)

        end

        def remove_disallowed_classes_and_ids(env)

          node = env[:node]

          return unless node.element?

          # The class of <code> holds the language for syntax highlighting

          if node['class'] && node.name != 'code'

            allowed_classes = node['class'].split.grep(ALLOWED_CLASS_RE)

            if allowed_classes.any?

              node['class'] = allowed_classes.join(' ')

            else

              node.remove_attribute('class')

            end

          end

          node.remove_attribute('id') if node['id'] && !ALLOWED_ID_RE.match?(node['id'])

        end

      end

    end

  end

end

      'http://foo"bar' => '<a class="external" href="http://foo%22bar">http://foo"bar</a>',

      '"test":http://foo"bar' => '<a href="http://foo%22bar" class="external">test</a>',

# frozen_string_literal: true

# Redmine - project management software

# Copyright (C) 2006-  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

require_relative '../../../../../test_helper'

class Redmine::WikiFormatting::Textile::SanitizationFilterTest < ActiveSupport::TestCase

  def filter(html)

    fragment = Redmine::WikiFormatting::HtmlParser.parse(html)

    sanitizer = Redmine::WikiFormatting::Textile::SanitizationFilter.new

    sanitizer.call(fragment)

    fragment.to_s

  end

  def test_should_filter_tags

    input = %(<script>alert(1)</script><iframe src="https://example.com/"></iframe><input type="text"> <b>foo</b>)

    assert_equal %( <b>foo</b>), filter(input)

  end

  def test_should_sanitize_attributes

    input = %(<img src="foo.png" onerror="alert(1)"> <a href="foo" onclick="alert(1)">link</a>)

    assert_equal %(<img src="foo.png"> <a href="foo">link</a>), filter(input)

  end

  def test_should_remove_links_with_unsafe_scheme

    input = %(<a href="javascript:alert(1)">link</a>)

    assert_equal %(<a>link</a>), filter(input)

  end

  def test_should_allow_classes_and_ids_generated_by_textile

    [

      %(<p class="wiki-class-foo wiki-class-bar" id="wiki-id-baz">foo</p>),

      %(<a class="external" href="https://example.com/">foo</a>),

      %(<a class="email" href="mailto:foo@example.com">foo</a>),

      %(<p id="fn1" class="footnote"><sup>1</sup> foo</p>),

      %(<pre><code class="ruby">foo</code></pre>),

    ].each do |input|

      assert_equal input, filter(input)

    end

  end

  def test_should_remove_other_classes_and_ids

    input = %(<p class="wiki-class-foo flash error" id="main-menu">foo</p>)

    assert_equal %(<p class="wiki-class-foo">foo</p>), filter(input)

  end

  def test_should_allow_styles_generated_by_textile

    [

      %(<p style="vertical-align:top;">foo</p>),

      %(<p style="background:#fdd;">foo</p>),

      %(<p style="border-top-left-radius: 10px 5px;">foo</p>),

    ].each do |input|

      assert_equal input, filter(input)

    end

  end

  def test_should_remove_other_styles

    [

      %(<p style="position:fixed;">foo</p>),

      %(<p style="background:url(https://example.com/foo.png);">foo</p>),

    ].each do |input|

      assert_equal %(<p>foo</p>), filter(input)

    end

  end

end

      |^. top|

        <tr><td style="vertical-align:top;">top</td></tr>

      '<p><img src="/images/comment.png%22onclick=' \

    assert_includes html, 'href="https://example.com/?a:%22onmouseover', 'quotes inside the href must stay escaped'