Project

General

Profile

Actions

Defect #8701

closed

HTML Entities are not escaped

Added by Johannes Barre almost 14 years ago. Updated over 13 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Category:
Text formatting
Target version:
-
Start date:
2011-06-28
Due date:
% Done:

0%

Estimated time:
Resolution:
Wont fix
Affected version:

Description

If you enter & or " in a text field in redmine, it will display just & or " in preview or if you save the entry (I double escaped the entities here to get them displayed here). Since it is a text input, I would expect redmine to display everything as entered. We had just an issue about entities and it was hard to understand because of this bug.

Actions #1

Updated by Etienne Massip almost 14 years ago

  • Category set to Text formatting
Actions #2

Updated by Chris Hart almost 14 years ago

This is not technically a defect but the intended behavior of the RedCloth library. I'm investigating what the options are to make this a configurable option as a patch to RedCloth as I don't think this is what the vast majority of users would expect to happen. However, if you'd like to directly patch RedCloth as a complete hack, the following patch to lib/redcloth3.rb will work (though it's obviously pretty messy):

diff --git a/lib/redcloth3.rb b/lib/redcloth3.rb
index f4c6244..3948931 100644
--- a/lib/redcloth3.rb
+++ b/lib/redcloth3.rb
@ -308,6 +308,7 @ class RedCloth3 < String

retrieve text

+ text.gsub!(/&(amp|euro|quot|gt|lt|nbsp|iexcl|cent|pound|curren|yen|brvbar|sect|uml|copy|ordf|not|shy|reg|macr|deg|plusmn|sup2|sup3|acute|micro|para|middot|cedil|sup1|ordm|raquo|frac14|frac12|frac34|iquest|Agrave|Aacute|Acirc|Atilde|Auml|Aring|AElig|Ccedil|Egrave|Eacute|Ecirc|Euml|Igrave|Iacute|Icirc|Iuml|ETH|Ntilde|Ograve|Oacute|Ocirc|Otilde|Ouml|times|Oslash|Ugrave|Uacute|Ucirc|Uuml|Yacute|THORN|szlig|agrave|aacute|acirc|atilde|auml|aring|aelig|ccedil|egrave|eacute|ecirc|euml|igrave|iacute|icirc|iuml|eth|ntilde|ograve|oacute|ocirc|otilde|ouml|divide|oslash|ugrave|uacute|ucirc|uuml|yacute|thorn);/, '&\1;')
text.gsub!( /<\/?notextile>/, '' )
text.gsub!( /&/, '&' )
clean_html text if filter_html

Actions #3

Updated by Etienne Massip almost 14 years ago

Indeed, it looks like a intentional behavior for textile parsers (this occurs also with http://www.textism.com/tools/textile) although I can't find anything in any documentation.

Actions #4

Updated by Etienne Massip over 13 years ago

  • Status changed from New to Closed
  • Resolution set to Wont fix
Actions

Also available in: Atom PDF