Defect #44634 ยป 0001-Escape-tags-that-commonmarker-escaped-with-its-tagfi.patch
| Gemfile | ||
|---|---|---|
| 20 | 20 |
gem 'rack', '>= 3.1.3' |
| 21 | 21 |
gem "stimulus-rails", "~> 1.3" |
| 22 | 22 |
gem "importmap-rails", "~> 2.0" |
| 23 |
gem 'commonmarker', '2.10.0' |
|
| 23 |
gem 'commonmarker', '~> 2.10.0'
|
|
| 24 | 24 |
gem 'doorkeeper', '~> 5.9.6' |
| 25 | 25 |
gem "bcrypt", require: false |
| 26 | 26 |
gem "doorkeeper-i18n", "~> 5.2" |
| lib/redmine/wiki_formatting/common_mark/formatter.rb | ||
|---|---|---|
| 26 | 26 |
commonmarker_extensions: {
|
| 27 | 27 |
table: true, |
| 28 | 28 |
strikethrough: true, |
| 29 |
tagfilter: true, |
|
| 30 | 29 |
autolink: true, |
| 31 | 30 |
footnotes: true, |
| 32 | 31 |
header_ids: nil, |
| lib/redmine/wiki_formatting/common_mark/markdown_filter.rb | ||
|---|---|---|
| 26 | 26 |
# does not allow for straightforward configuration of render and parsing |
| 27 | 27 |
# options |
| 28 | 28 |
class MarkdownFilter |
| 29 |
# Tags that the commonmarker tagfilter extension escaped before its |
|
| 30 |
# removal |
|
| 31 |
DISALLOWED_RAW_HTML_TAG = %r{<(?=/?(?:title|textarea|style|xmp|iframe|noembed|noframes|script|plaintext)(?:[\s/>]|\z))}i
|
|
| 32 | ||
| 29 | 33 |
attr_reader :context |
| 30 | 34 |
def initialize(text, context = nil) |
| ... | ... | |
| 40 | 44 |
parse: parse_options |
| 41 | 45 |
}, plugins: plugins) |
| 46 |
# Escape these tags in raw HTML as the commonmarker tagfilter |
|
| 47 |
# extension did, since the extension was removed in commonmarker |
|
| 48 |
# 2.10.1. |
|
| 49 |
html.gsub!(DISALLOWED_RAW_HTML_TAG, '<') |
|
| 42 | 50 |
html.rstrip! |
| 43 | 51 |
html |
| 44 | 52 |
end |
| test/unit/lib/redmine/wiki_formatting/common_mark/formatter_test.rb | ||
|---|---|---|
| 273 | 273 |
[ |
| 274 | 274 |
%[<p>sit<br>amet <style>.foo { color: #fff; }</style> <script>alert("hello world");</script></p>],
|
| 275 | 275 |
%[sit<br/>amet <style>.foo { color: #fff; }</style> <script>alert("hello world");</script>]
|
| 276 |
], |
|
| 277 |
[ |
|
| 278 |
%[<p>Unclosed <script> tag</p>\n<p>Next paragraph</p>], |
|
| 279 |
%[Unclosed <script> tag\n\nNext paragraph] |
|
| 276 | 280 |
] |
| 277 | 281 |
].each do |expected, input| |
| 278 | 282 |
assert_equal expected, to_html(input) |