Escape tags that start with pre (#37767).

Patch by Holger Just.

git-svn-id: https://svn.redmine.org/redmine/trunk@21902 e93f8b46-1217-0410-a6f0-8f06a7374b81

diff --git a/lib/redmine/wiki_formatting/textile/redcloth3.rb b/lib/redmine/wiki_formatting/textile/redcloth3.rb
index b935db6b9f2924e08caab541e70c04af0f7d6d7a..c292926a548e84a9906051eef222364f93c817c8 100644 (file)
--- a/lib/redmine/wiki_formatting/textile/redcloth3.rb
+++ b/lib/redmine/wiki_formatting/textile/redcloth3.rb
@@ -1208,13 +1208,15 @@ class RedCloth3 < String
         end
     end
 
-    ALLOWED_TAGS = %w(redpre pre code kbd notextile)
+    ALLOWED_TAGS = %w(pre code kbd notextile)
     def escape_html_tags(text)
-        text.gsub!(%r{<(\/?([!\w]+)[^<>\n]*)(>?)}) do |m|
-            if ALLOWED_TAGS.include?($2) && $3.present?
-                "<#{$1}#{$3}"
+        text.gsub!(%r{<(\/?([!\w][^ >\t\f\r\n]*)[^<>\n]*)(>?)}) do |m|
+            all, tag, close = $1, $2, $3
+
+            if close.present? && (ALLOWED_TAGS.include?(tag) || (tag =~ /\Aredpre#\d+\z/))
+                "<#{all}#{close}"
             else
-                "&lt;#{$1}#{'&gt;' unless $3.blank?}"
+                "&lt;#{all}#{'&gt;' unless close.blank?}"
             end
         end
     end

diff --git a/test/unit/lib/redmine/wiki_formatting/textile_formatter_test.rb b/test/unit/lib/redmine/wiki_formatting/textile_formatter_test.rb
index 23f6d7538c0f964ca15d9cc699d0c13335cdbee4..9d2a1815d3305c74b6a3ded6936909205650485d 100644 (file)
--- a/test/unit/lib/redmine/wiki_formatting/textile_formatter_test.rb
+++ b/test/unit/lib/redmine/wiki_formatting/textile_formatter_test.rb
@@ -719,6 +719,17 @@ class Redmine::WikiFormatting::TextileFormatterTest < ActionView::TestCase
     assert_equal expected.gsub(%r{[\r\n\t]}, ''), to_html(text).gsub(%r{[\r\n\t]}, '')
   end
 
+  def test_should_escape_tags_that_start_with_pre
+    text = <<~STR
+      <preä demo>Text
+    STR
+
+    expected = <<~EXPECTED
+      <p>&lt;preä demo&gt;Text</p>
+    EXPECTED
+    assert_equal expected.gsub(%r{[\r\n\t]}, ''), to_html(text).gsub(%r{[\r\n\t]}, '')
+  end
+
   def test_should_remove_html_comments
     text = <<~STR
       <!-- begin -->