From 25e184cb253a253f6053498b2c0f65290ccc5cce Mon Sep 17 00:00:00 2001
From: MAEDA Go <maeda@farend.jp>
Date: Sun, 18 Oct 2026 13:25:33 +0900
Subject: [PATCH] Escape tags that commonmarker escaped with its tagfilter
 extension before 2.10.1

---
 Gemfile                                                   | 2 +-
 lib/redmine/wiki_formatting/common_mark/formatter.rb      | 1 -
 .../wiki_formatting/common_mark/markdown_filter.rb        | 8 ++++++++
 .../redmine/wiki_formatting/common_mark/formatter_test.rb | 4 ++++
 4 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/Gemfile b/Gemfile
index 7ce0547c7..37ed814fa 100644
--- a/Gemfile
+++ b/Gemfile
@@ -20,7 +20,7 @@ gem 'propshaft', '~> 1.3.0'
 gem 'rack', '>= 3.1.3'
 gem "stimulus-rails", "~> 1.3"
 gem "importmap-rails", "~> 2.0"
-gem 'commonmarker', '2.10.0'
+gem 'commonmarker', '~> 2.10.0'
 gem 'doorkeeper', '~> 5.9.6'
 gem "bcrypt", require: false
 gem "doorkeeper-i18n", "~> 5.2"
diff --git a/lib/redmine/wiki_formatting/common_mark/formatter.rb b/lib/redmine/wiki_formatting/common_mark/formatter.rb
index 3efc0e09a..c8abf523e 100644
--- a/lib/redmine/wiki_formatting/common_mark/formatter.rb
+++ b/lib/redmine/wiki_formatting/common_mark/formatter.rb
@@ -26,7 +26,6 @@ module Redmine
         commonmarker_extensions: {
           table: true,
           strikethrough: true,
-          tagfilter: true,
           autolink: true,
           footnotes: true,
           header_ids: nil,
diff --git a/lib/redmine/wiki_formatting/common_mark/markdown_filter.rb b/lib/redmine/wiki_formatting/common_mark/markdown_filter.rb
index 3e19ae48b..b95fe22db 100644
--- a/lib/redmine/wiki_formatting/common_mark/markdown_filter.rb
+++ b/lib/redmine/wiki_formatting/common_mark/markdown_filter.rb
@@ -26,6 +26,10 @@ module Redmine
       # does not allow for straightforward configuration of render and parsing
       # options
       class MarkdownFilter
+        # Tags that the commonmarker tagfilter extension escaped before its
+        # removal
+        DISALLOWED_RAW_HTML_TAG = %r{<(?=/?(?:title|textarea|style|xmp|iframe|noembed|noframes|script|plaintext)(?:[\s/>]|\z))}i
+
         attr_reader :context

         def initialize(text, context = nil)
@@ -40,6 +44,10 @@ module Redmine
             parse: parse_options
                                       }, plugins: plugins)

+          # Escape these tags in raw HTML as the commonmarker tagfilter
+          # extension did, since the extension was removed in commonmarker
+          # 2.10.1.
+          html.gsub!(DISALLOWED_RAW_HTML_TAG, '&lt;')
           html.rstrip!
           html
         end
diff --git a/test/unit/lib/redmine/wiki_formatting/common_mark/formatter_test.rb b/test/unit/lib/redmine/wiki_formatting/common_mark/formatter_test.rb
index 973aba6e3..b57aea2db 100644
--- a/test/unit/lib/redmine/wiki_formatting/common_mark/formatter_test.rb
+++ b/test/unit/lib/redmine/wiki_formatting/common_mark/formatter_test.rb
@@ -273,6 +273,10 @@ class Redmine::WikiFormatting::CommonMark::FormatterTest < Redmine::HelperTest
         [
           %[<p>sit<br>amet &lt;style&gt;.foo { color: #fff; }&lt;/style&gt; &lt;script&gt;alert("hello world");&lt;/script&gt;</p>],
           %[sit<br/>amet <style>.foo { color: #fff; }</style> <script>alert("hello world");</script>]
+        ],
+        [
+          %[<p>Unclosed &lt;script&gt; tag</p>\n<p>Next paragraph</p>],
+          %[Unclosed <script> tag\n\nNext paragraph]
         ]
       ].each do |expected, input|
         assert_equal expected, to_html(input)
--
2.55.0