Nemcio/Redmine
1
0
Fork 0
mirror of https://github.com/redmine/redmine.git synced 2026-01-22 15:33:22 +01:00
Code Issues Packages Projects Releases Activity

HTML-escape the entire tag content of escaped HTML tags in textile (#38807).

Browse Source 
Patch by Holger Just.


git-svn-id: https://svn.redmine.org/redmine/trunk@22302 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Go MAEDA
2023-09-18 07:45:03 +00:00
parent 5e07a72413
commit ba181c7328
2 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
lib/redmine/wiki_formatting/textile/redcloth3.rb
View File

@@ -1214,9 +1214,9 @@ class RedCloth3 < String
all, tag, close = $1, $2, $3
if close.present? && (ALLOWED_TAGS.include?(tag) || (tag =~ /\Aredpre#\d+\z/))
"<#{all}#{close}"
"<#{htmlesc all}#{close}"
else
"&lt;#{all}#{'&gt;' unless close.blank?}"
"&lt;#{htmlesc all}#{'&gt;' unless close.blank?}"
end
end
end

5
test/helpers/application_helper_test.rb
View File

@@ -1296,12 +1296,13 @@ class ApplicationHelperTest < Redmine::HelperTest
def test_html_tags
to_test = {
"<div>content</div>" => "<p>&lt;div&gt;content&lt;/div&gt;</p>",
"<div class=\"bold\">content</div>" => "<p>&lt;div class=\"bold\"&gt;content&lt;/div&gt;</p>",
"<div class=\"bold\">content</div>" => "<p>&lt;div class=&quot;bold&quot;&gt;content&lt;/div&gt;</p>",
"<script>some script;</script>" => "<p>&lt;script&gt;some script;&lt;/script&gt;</p>",
# do not escape pre/code tags
"<pre>\nline 1\nline2</pre>" => "<pre>\nline 1\nline2</pre>",
"<pre><code>\nline 1\nline2</code></pre>" => "<pre><code>\nline 1\nline2</code></pre>",
"<pre><div>content</div></pre>" => "<pre>&lt;div&gt;content&lt;/div&gt;</pre>",
"<pre><div class=\"foo\">content</div></pre>" => "<pre>&lt;div class=\"foo\"&gt;content&lt;/div&gt;</pre>",
"<pre><div class=\"<foo\">content</div></pre>" => "<pre>&lt;div class=\"&lt;foo\"&gt;content&lt;/div&gt;</pre>",
"<!-- opening comment" => "<p>&lt;!-- opening comment</p>",
# remove attributes including class
"<pre class='foo'>some text</pre>" => "<pre>some text</pre>",