gunghogeoduck/osem-fcy
1
0
Fork 0
mirror of https://github.com/openSUSE/osem.git synced 2026-08-13 19:54:02 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #2894 from hennevogel/security/2892

Browse source 
Sanitize rendered markdown
This commit is contained in:
Henne Vogelsang 2021-10-11 18:22:14 +02:00 • committed by GitHub
commit ff0bdf2462
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
app/helpers/format_helper.rb
View file

@ -195,10 +195,11 @@ module FormatHelper
space_after_headers: true, space_after_headers: true,
no_intra_emphasis: true, no_intra_emphasis: true,
fenced_code_blocks: true, fenced_code_blocks: true,
disable_indented_code_blocks: true disable_indented_code_blocks: true,
safe_links_only: true
} }
markdown = Redcarpet::Markdown.new(Redcarpet::Render::HTML.new(escape_html: escape_html), options) markdown = Redcarpet::Markdown.new(Redcarpet::Render::HTML.new(escape_html: escape_html), options)
markdown.render(text).html_safe sanitize(markdown.render(text))
end end
def markdown_hint(text='') def markdown_hint(text='')

2
spec/helpers/format_helper_spec.rb
View file

@ -11,7 +11,7 @@ describe FormatHelper, type: :helper do
it 'should return HTML for header markdown' do it 'should return HTML for header markdown' do
expect(Redcarpet::Markdown).to receive(:new) expect(Redcarpet::Markdown).to receive(:new)
.with(Redcarpet::Render::HTML, autolink: true, space_after_headers: true, no_intra_emphasis: true, fenced_code_blocks: true, disable_indented_code_blocks: true) .with(Redcarpet::Render::HTML, autolink: true, space_after_headers: true, no_intra_emphasis: true, fenced_code_blocks: true, disable_indented_code_blocks: true, safe_links_only: true)
.and_call_original .and_call_original
expect(markdown('# this is my header')).to eq "<h1>this is my header</h1>\n" expect(markdown('# this is my header')).to eq "<h1>this is my header</h1>\n"