gunghogeoduck/osem-fcy
1
0
Fork 0
mirror of https://github.com/openSUSE/osem.git synced 2026-08-16 05:04:03 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #2970 from AndrewKvalheim/safe_links_only

Browse source 
Correct use of Redcarpet’s `safe_links_only` flag
This commit is contained in:
Henne Vogelsang 2022-03-29 15:11:58 +02:00 • committed by GitHub
commit 85cae7d093
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 12 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

2
.rubocop_todo.yml
View file

@ -457,7 +457,7 @@ Metrics/MethodLength:
# Offense count: 5
# Configuration parameters: CountComments, CountAsOne.
Metrics/ModuleLength:
Max: 173
Max: 174
# Offense count: 26
# Configuration parameters: IgnoredMethods.

11
app/helpers/format_helper.rb
View file

@ -190,15 +190,18 @@ module FormatHelper
def markdown(text, escape_html=true)
return '' if text.nil?
options = {
markdown_options = {
autolink: true,
space_after_headers: true,
no_intra_emphasis: true,
fenced_code_blocks: true,
disable_indented_code_blocks: true,
safe_links_only: true
disable_indented_code_blocks: true
}
markdown = Redcarpet::Markdown.new(Redcarpet::Render::HTML.new(escape_html: escape_html), options)
render_options = {
escape_html: escape_html,
safe_links_only: true
}
markdown = Redcarpet::Markdown.new(Redcarpet::Render::HTML.new(render_options), markdown_options)
sanitize(markdown.render(text))
end

8
spec/helpers/format_helper_spec.rb
View file

@ -9,11 +9,11 @@ describe FormatHelper, type: :helper do
expect(markdown(nil)).to eq ''
end
it 'should return HTML for header markdown' do
expect(Redcarpet::Markdown).to receive(:new)
.with(Redcarpet::Render::HTML, autolink: true, space_after_headers: true, no_intra_emphasis: true, fenced_code_blocks: true, disable_indented_code_blocks: true, safe_links_only: true)
.and_call_original
it "doesn't render links with unsafe URI schemes" do
expect(markdown('[a](javascript:b)')).to eq "<p>[a](javascript:b)</p>\n"
end
it 'should return HTML for header markdown' do
expect(markdown('# this is my header')).to eq "<h1>this is my header</h1>\n"
end
end