From: Go MAEDA <maeda@farend.jp>
Date: Mon, 17 Oct 2022 13:59:56 +0000 (+0000)
Subject: Merged r21902 from trunk to 4.2-stable (#37767).
X-Git-Tag: 4.2.9~11
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=919bbdc9ce43d52c74672bd972a49880c4c7a559;p=redmine.git

Merged r21902 from trunk to 4.2-stable (#37767).


git-svn-id: https://svn.redmine.org/redmine/branches/4.2-stable@21904 e93f8b46-1217-0410-a6f0-8f06a7374b81
---

diff --git a/lib/redmine/wiki_formatting/textile/redcloth3.rb b/lib/redmine/wiki_formatting/textile/redcloth3.rb
index 347743105..532283e7e 100644
--- a/lib/redmine/wiki_formatting/textile/redcloth3.rb
+++ b/lib/redmine/wiki_formatting/textile/redcloth3.rb
@@ -1207,13 +1207,15 @@ class RedCloth3 < String
         end
     end
 
-    ALLOWED_TAGS = %w(redpre pre code kbd notextile)
+    ALLOWED_TAGS = %w(pre code kbd notextile)
     def escape_html_tags(text)
-        text.gsub!(%r{<(\/?([!\w]+)[^<>\n]*)(>?)}) do |m|
-            if ALLOWED_TAGS.include?($2) && $3.present?
-                "<#{$1}#{$3}"
+        text.gsub!(%r{<(\/?([!\w][^ >\t\f\r\n]*)[^<>\n]*)(>?)}) do |m|
+            all, tag, close = $1, $2, $3
+
+            if close.present? && (ALLOWED_TAGS.include?(tag) || (tag =~ /\Aredpre#\d+\z/))
+                "<#{all}#{close}"
             else
-                "&lt;#{$1}#{'&gt;' unless $3.blank?}"
+                "&lt;#{all}#{'&gt;' unless close.blank?}"
             end
         end
     end
diff --git a/test/unit/lib/redmine/wiki_formatting/textile_formatter_test.rb b/test/unit/lib/redmine/wiki_formatting/textile_formatter_test.rb
index 28a3d92ab..2cf06680e 100644
--- a/test/unit/lib/redmine/wiki_formatting/textile_formatter_test.rb
+++ b/test/unit/lib/redmine/wiki_formatting/textile_formatter_test.rb
@@ -703,6 +703,17 @@ class Redmine::WikiFormatting::TextileFormatterTest < ActionView::TestCase
     assert_equal expected.gsub(%r{[\r\n\t]}, ''), to_html(text).gsub(%r{[\r\n\t]}, '')
   end
 
+  def test_should_escape_tags_that_start_with_pre
+    text = <<~STR
+      <preä demo>Text
+    STR
+
+    expected = <<~EXPECTED
+      <p>&lt;preä demo&gt;Text</p>
+    EXPECTED
+    assert_equal expected.gsub(%r{[\r\n\t]}, ''), to_html(text).gsub(%r{[\r\n\t]}, '')
+  end
+
   def test_should_escape_bq_citations
     assert_html_output({
       %{bq.:http://x/"onmouseover="alert(document.domain) Hover me} =>