diff options
| author | Go MAEDA <maeda@farend.jp> | 2023-09-18 07:45:03 +0000 |
|---|---|---|
| committer | Go MAEDA <maeda@farend.jp> | 2023-09-18 07:45:03 +0000 |
| commit | ba181c732806eed652e8b9990f22621c19590d77 (patch) | |
| tree | 7681ceda324d9acce7d4b8ab38d6b707a4f9f5d1 | |
| parent | 5e07a7241392a82586054613896e4da73069bcbb (diff) | |
| download | redmine-ba181c732806eed652e8b9990f22621c19590d77.tar.gz redmine-ba181c732806eed652e8b9990f22621c19590d77.zip | |
HTML-escape the entire tag content of escaped HTML tags in textile (#38807).
Patch by Holger Just.
git-svn-id: https://svn.redmine.org/redmine/trunk@22302 e93f8b46-1217-0410-a6f0-8f06a7374b81
| -rw-r--r-- | lib/redmine/wiki_formatting/textile/redcloth3.rb | 4 | ||||
| -rw-r--r-- | test/helpers/application_helper_test.rb | 5 |
2 files changed, 5 insertions, 4 deletions
diff --git a/lib/redmine/wiki_formatting/textile/redcloth3.rb b/lib/redmine/wiki_formatting/textile/redcloth3.rb index f0595f438..a2b53997f 100644 --- a/lib/redmine/wiki_formatting/textile/redcloth3.rb +++ b/lib/redmine/wiki_formatting/textile/redcloth3.rb @@ -1214,9 +1214,9 @@ class RedCloth3 < String all, tag, close = $1, $2, $3 if close.present? && (ALLOWED_TAGS.include?(tag) || (tag =~ /\Aredpre#\d+\z/)) - "<#{all}#{close}" + "<#{htmlesc all}#{close}" else - "<#{all}#{'>' unless close.blank?}" + "<#{htmlesc all}#{'>' unless close.blank?}" end end end diff --git a/test/helpers/application_helper_test.rb b/test/helpers/application_helper_test.rb index ddc55dcb8..a9e3b3a74 100644 --- a/test/helpers/application_helper_test.rb +++ b/test/helpers/application_helper_test.rb @@ -1296,12 +1296,13 @@ class ApplicationHelperTest < Redmine::HelperTest def test_html_tags to_test = { "<div>content</div>" => "<p><div>content</div></p>", - "<div class=\"bold\">content</div>" => "<p><div class=\"bold\">content</div></p>", + "<div class=\"bold\">content</div>" => "<p><div class="bold">content</div></p>", "<script>some script;</script>" => "<p><script>some script;</script></p>", # do not escape pre/code tags "<pre>\nline 1\nline2</pre>" => "<pre>\nline 1\nline2</pre>", "<pre><code>\nline 1\nline2</code></pre>" => "<pre><code>\nline 1\nline2</code></pre>", - "<pre><div>content</div></pre>" => "<pre><div>content</div></pre>", + "<pre><div class=\"foo\">content</div></pre>" => "<pre><div class=\"foo\">content</div></pre>", + "<pre><div class=\"<foo\">content</div></pre>" => "<pre><div class=\"<foo\">content</div></pre>", "<!-- opening comment" => "<p><!-- opening comment</p>", # remove attributes including class "<pre class='foo'>some text</pre>" => "<pre>some text</pre>", |