diff options
| -rw-r--r-- | lib/redcloth3.rb | 2 | ||||
| -rw-r--r-- | test/unit/lib/redmine/wiki_formatting/textile_formatter_test.rb | 9 |
2 files changed, 9 insertions, 2 deletions
diff --git a/lib/redcloth3.rb b/lib/redcloth3.rb index 0c44346d0..ba50bb8eb 100644 --- a/lib/redcloth3.rb +++ b/lib/redcloth3.rb @@ -1202,7 +1202,7 @@ class RedCloth3 < String ALLOWED_TAGS = %w(redpre pre code notextile) def escape_html_tags(text) - text.gsub!(%r{<(\/?([!\w]+)[^<>\n]*)(>?)}) {|m| ALLOWED_TAGS.include?($2) ? "<#{$1}#{$3}" : "<#{$1}#{'>' unless $3.blank?}" } + text.gsub!(%r{<(\/?([!\w]+)[^<>\n]*)?(>?)}) {|m| $2 && ALLOWED_TAGS.include?($2) ? "<#{$1}#{$3}" : "<#{$1}#{'>' unless $3.blank?}" } end end diff --git a/test/unit/lib/redmine/wiki_formatting/textile_formatter_test.rb b/test/unit/lib/redmine/wiki_formatting/textile_formatter_test.rb index 6d816537e..b15893744 100644 --- a/test/unit/lib/redmine/wiki_formatting/textile_formatter_test.rb +++ b/test/unit/lib/redmine/wiki_formatting/textile_formatter_test.rb @@ -160,12 +160,19 @@ EXPECTED assert_equal expected.gsub(%r{\s+}, ''), to_html(raw).gsub(%r{\s+}, '') end - def test_escaping + def test_should_escape_unallowed_tags assert_html_output( 'this is a <script>' => 'this is a <script>' ) end + def test_should_escape_less_than_signs + assert_html_output( + '<' => '<', + '1 < 2' => '1 < 2' + ) + end + def test_use_of_backslashes_followed_by_numbers_in_headers assert_html_output({ 'h1. 2009\02\09' => '<h1>2009\02\09</h1>' |