From 496f88afe10f95a7aa64ea8ab10e57412f827283 Mon Sep 17 00:00:00 2001 From: Robert Speicher Date: Wed, 19 Sep 2012 19:42:26 -0400 Subject: [PATCH 1/3] Escape text passed to gfm by link_to_gfm --- app/helpers/gitlab_markdown_helper.rb | 4 ++-- app/views/commits/_commit_box.html.haml | 4 ++-- spec/helpers/gitlab_markdown_helper_spec.rb | 9 ++++++++- 3 files changed, 12 insertions(+), 5 deletions(-) diff --git a/app/helpers/gitlab_markdown_helper.rb b/app/helpers/gitlab_markdown_helper.rb index 511d4628..111982e9 100644 --- a/app/helpers/gitlab_markdown_helper.rb +++ b/app/helpers/gitlab_markdown_helper.rb @@ -12,8 +12,8 @@ module GitlabMarkdownHelper # "outer text gfm ref more outer text"). def link_to_gfm(body, url, html_options = {}) return "" if body.blank? - - gfm_body = gfm(body, html_options) + + gfm_body = gfm(escape_once(body), html_options) gfm_body.gsub!(%r{.*?}m) do |match| "#{match}#{link_to("", url, html_options)[0..-5]}" # "".length +1 diff --git a/app/views/commits/_commit_box.html.haml b/app/views/commits/_commit_box.html.haml index 506f4e09..572337de 100644 --- a/app/views/commits/_commit_box.html.haml +++ b/app/views/commits/_commit_box.html.haml @@ -11,10 +11,10 @@ = link_to tree_project_ref_path(@project, @commit.id), class: "browse-button primary grouped" do %strong Browse Code ยป %h3.commit-title.page_title - = gfm @commit.title + = gfm escape_once(@commit.title) - if @commit.description.present? %pre.commit-description - = gfm @commit.description + = gfm escape_once(@commit.description) .commit-info .row .span4 diff --git a/spec/helpers/gitlab_markdown_helper_spec.rb b/spec/helpers/gitlab_markdown_helper_spec.rb index 0af33142..a6708a7a 100644 --- a/spec/helpers/gitlab_markdown_helper_spec.rb +++ b/spec/helpers/gitlab_markdown_helper_spec.rb @@ -292,11 +292,18 @@ describe GitlabMarkdownHelper do actual = link_to_gfm("Fixed in #{commit.id}", commit_path, class: 'foo') actual.should have_selector 'a.gfm.gfm-commit.foo' end + + it "escapes HTML passed in as the body" do + actual = "This is a

test

- see ##{issues[0].id}" + link_to_gfm(actual, commit_path).should match('<h1>test</h1>') + end end describe "#markdown" do it "should handle references in paragraphs" do - markdown("\n\nLorem ipsum dolor sit amet, consectetur adipiscing elit. #{commit.id} Nam pulvinar sapien eget odio adipiscing at faucibus orci vestibulum.\n").should == "

Lorem ipsum dolor sit amet, consectetur adipiscing elit. #{link_to commit.id, project_commit_path(project, commit), title: commit.link_title, class: "gfm gfm-commit "} Nam pulvinar sapien eget odio adipiscing at faucibus orci vestibulum.

\n" + actual = "\n\nLorem ipsum dolor sit amet. #{commit.id} Nam pulvinar sapien eget.\n" + expected = project_commit_path(project, commit) + markdown(actual).should match(expected) end it "should handle references in headers" do From ba72c6f683fc52a3223c45c5044abf1361e059fd Mon Sep 17 00:00:00 2001 From: Robert Speicher Date: Wed, 19 Sep 2012 20:21:12 -0400 Subject: [PATCH 2/3] Escape text passed directly to gfm --- app/views/events/_commit.html.haml | 2 +- app/views/issues/show.html.haml | 2 +- app/views/merge_requests/show/_mr_box.html.haml | 2 +- app/views/milestones/show.html.haml | 2 +- app/views/repositories/_branch.html.haml | 2 +- app/views/repositories/_feed.html.haml | 2 +- app/views/repositories/tags.html.haml | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/app/views/events/_commit.html.haml b/app/views/events/_commit.html.haml index 1e5c00cb..cb25d831 100644 --- a/app/views/events/_commit.html.haml +++ b/app/views/events/_commit.html.haml @@ -5,4 +5,4 @@ %strong.cdark= commit.author_name – = image_tag gravatar_icon(commit.author_email), class: "avatar", width: 16 - = gfm truncate(commit.title, length: 50) rescue "--broken encoding" + = gfm escape_once(truncate(commit.title, length: 50)) rescue "--broken encoding" diff --git a/app/views/issues/show.html.haml b/app/views/issues/show.html.haml index e7365e10..da2aeac4 100644 --- a/app/views/issues/show.html.haml +++ b/app/views/issues/show.html.haml @@ -31,7 +31,7 @@ .alert-message.error.status_info Closed - else .alert-message.success.status_info Open - = gfm @issue.title + = gfm escape_once(@issue.title) .middle_box_content %cite.cgray Created by diff --git a/app/views/merge_requests/show/_mr_box.html.haml b/app/views/merge_requests/show/_mr_box.html.haml index 81ab83f3..89c3110b 100644 --- a/app/views/merge_requests/show/_mr_box.html.haml +++ b/app/views/merge_requests/show/_mr_box.html.haml @@ -5,7 +5,7 @@ .alert-message.error.status_info Closed - else .alert-message.success.status_info Open - = gfm @merge_request.title + = gfm escape_once(@merge_request.title) .middle_box_content %div diff --git a/app/views/milestones/show.html.haml b/app/views/milestones/show.html.haml index 0d6cb2a0..ba71ead7 100644 --- a/app/views/milestones/show.html.haml +++ b/app/views/milestones/show.html.haml @@ -21,7 +21,7 @@ .alert-message.error.status_info Closed - else .alert-message.success.status_info Open - = gfm @milestone.title + = gfm escape_once(@milestone.title) %small.right= @milestone.expires_at .middle_box_content diff --git a/app/views/repositories/_branch.html.haml b/app/views/repositories/_branch.html.haml index cf8558ec..64a633be 100644 --- a/app/views/repositories/_branch.html.haml +++ b/app/views/repositories/_branch.html.haml @@ -11,7 +11,7 @@ %code= commit.short_id = image_tag gravatar_icon(commit.author_email), class: "", width: 16 - = gfm truncate(commit.title, length: 40) + = gfm escape_once(truncate(commit.title, length: 40)) %span.update-author.right = time_ago_in_words(commit.committed_date) ago diff --git a/app/views/repositories/_feed.html.haml b/app/views/repositories/_feed.html.haml index ac4eb483..0c13551d 100644 --- a/app/views/repositories/_feed.html.haml +++ b/app/views/repositories/_feed.html.haml @@ -13,7 +13,7 @@ = link_to project_commits_path(@project, commit.id) do %code= commit.short_id = image_tag gravatar_icon(commit.author_email), class: "", width: 16 - = gfm truncate(commit.title, length: 40) + = gfm escape_once(truncate(commit.title, length: 40)) %td %span.right.cgray = time_ago_in_words(commit.committed_date) diff --git a/app/views/repositories/tags.html.haml b/app/views/repositories/tags.html.haml index 0e870c80..a4114586 100644 --- a/app/views/repositories/tags.html.haml +++ b/app/views/repositories/tags.html.haml @@ -17,7 +17,7 @@ = link_to project_commit_path(@project, commit.id) do %code= commit.short_id = image_tag gravatar_icon(commit.author_email), class: "", width: 16 - = gfm truncate(commit.title, length: 40) + = gfm escape_once(truncate(commit.title, length: 40)) %td %span.update-author.right = time_ago_in_words(commit.committed_date) From 345c4d2a776c3e30d0c05e5954adbfe4142f3519 Mon Sep 17 00:00:00 2001 From: Robert Speicher Date: Wed, 19 Sep 2012 20:21:35 -0400 Subject: [PATCH 3/3] Update gfm so escaped text is still parsed for references --- lib/gitlab/markdown.rb | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/lib/gitlab/markdown.rb b/lib/gitlab/markdown.rb index 0a467a8d..9201003e 100644 --- a/lib/gitlab/markdown.rb +++ b/lib/gitlab/markdown.rb @@ -48,8 +48,10 @@ module Gitlab def gfm(text, html_options = {}) return text if text.nil? - # prevents the string supplied through the _text_ argument to be altered - text = text.dup + # Duplicate the string so we don't alter the original, then call to_str + # to cast it back to a String instead of a SafeBuffer. This is required + # for gsub calls to work as we need them to. + text = text.dup.to_str @html_options = html_options