Defect #8701
closedHTML Entities are not escaped
0%
Description
If you enter & or " in a text field in redmine, it will display just & or " in preview or if you save the entry (I double escaped the entities here to get them displayed here). Since it is a text input, I would expect redmine to display everything as entered. We had just an issue about entities and it was hard to understand because of this bug.
Updated by Chris Hart almost 14 years ago
This is not technically a defect but the intended behavior of the RedCloth library. I'm investigating what the options are to make this a configurable option as a patch to RedCloth as I don't think this is what the vast majority of users would expect to happen. However, if you'd like to directly patch RedCloth as a complete hack, the following patch to lib/redcloth3.rb will work (though it's obviously pretty messy):
diff --git a/lib/redcloth3.rb b/lib/redcloth3.rb
index f4c6244..3948931 100644
--- a/lib/redcloth3.rb
+++ b/lib/redcloth3.rb@ -308,6 +308,7
@ class RedCloth3 < String
retrieve text
+ text.gsub!(/&(amp|euro|quot|gt|lt|nbsp|iexcl|cent|pound|curren|yen|brvbar|sect|uml|copy|ordf|not|shy|reg|macr|deg|plusmn|sup2|sup3|acute|micro|para|middot|cedil|sup1|ordm|raquo|frac14|frac12|frac34|iquest|Agrave|Aacute|Acirc|Atilde|Auml|Aring|AElig|Ccedil|Egrave|Eacute|Ecirc|Euml|Igrave|Iacute|Icirc|Iuml|ETH|Ntilde|Ograve|Oacute|Ocirc|Otilde|Ouml|times|Oslash|Ugrave|Uacute|Ucirc|Uuml|Yacute|THORN|szlig|agrave|aacute|acirc|atilde|auml|aring|aelig|ccedil|egrave|eacute|ecirc|euml|igrave|iacute|icirc|iuml|eth|ntilde|ograve|oacute|ocirc|otilde|ouml|divide|oslash|ugrave|uacute|ucirc|uuml|yacute|thorn);/, '&\1;')
text.gsub!( /<\/?notextile>/, '' )
text.gsub!( /&/, '&' )
clean_html text if filter_html
Updated by Etienne Massip almost 14 years ago
Indeed, it looks like a intentional behavior for textile parsers (this occurs also with http://www.textism.com/tools/textile) although I can't find anything in any documentation.
Updated by Etienne Massip over 13 years ago
- Status changed from New to Closed
- Resolution set to Wont fix