git-svn-id: https://svn.redmine.org/redmine/branches/5.0-stable@21903 e93f8b46-1217-0410-a6f0-8f06a7374b81tags/5.0.4
@@ -1208,13 +1208,15 @@ class RedCloth3 < String | |||
end | |||
end | |||
ALLOWED_TAGS = %w(redpre pre code kbd notextile) | |||
ALLOWED_TAGS = %w(pre code kbd notextile) | |||
def escape_html_tags(text) | |||
text.gsub!(%r{<(\/?([!\w]+)[^<>\n]*)(>?)}) do |m| | |||
if ALLOWED_TAGS.include?($2) && $3.present? | |||
"<#{$1}#{$3}" | |||
text.gsub!(%r{<(\/?([!\w][^ >\t\f\r\n]*)[^<>\n]*)(>?)}) do |m| | |||
all, tag, close = $1, $2, $3 | |||
if close.present? && (ALLOWED_TAGS.include?(tag) || (tag =~ /\Aredpre#\d+\z/)) | |||
"<#{all}#{close}" | |||
else | |||
"<#{$1}#{'>' unless $3.blank?}" | |||
"<#{all}#{'>' unless close.blank?}" | |||
end | |||
end | |||
end |
@@ -719,6 +719,17 @@ class Redmine::WikiFormatting::TextileFormatterTest < ActionView::TestCase | |||
assert_equal expected.gsub(%r{[\r\n\t]}, ''), to_html(text).gsub(%r{[\r\n\t]}, '') | |||
end | |||
def test_should_escape_tags_that_start_with_pre | |||
text = <<~STR | |||
<preä demo>Text | |||
STR | |||
expected = <<~EXPECTED | |||
<p><preä demo>Text</p> | |||
EXPECTED | |||
assert_equal expected.gsub(%r{[\r\n\t]}, ''), to_html(text).gsub(%r{[\r\n\t]}, '') | |||
end | |||
def test_should_remove_html_comments | |||
text = <<~STR | |||
<!-- begin --> |