diff options
| -rw-r--r-- | lib/redmine/wiki_formatting/textile/redcloth3.rb | 12 | ||||
| -rw-r--r-- | test/unit/lib/redmine/wiki_formatting/textile_formatter_test.rb | 11 |
2 files changed, 18 insertions, 5 deletions
diff --git a/lib/redmine/wiki_formatting/textile/redcloth3.rb b/lib/redmine/wiki_formatting/textile/redcloth3.rb index 347743105..532283e7e 100644 --- a/lib/redmine/wiki_formatting/textile/redcloth3.rb +++ b/lib/redmine/wiki_formatting/textile/redcloth3.rb @@ -1207,13 +1207,15 @@ class RedCloth3 < String end end - ALLOWED_TAGS = %w(redpre pre code kbd notextile) + ALLOWED_TAGS = %w(pre code kbd notextile) def escape_html_tags(text) - text.gsub!(%r{<(\/?([!\w]+)[^<>\n]*)(>?)}) do |m| - if ALLOWED_TAGS.include?($2) && $3.present? - "<#{$1}#{$3}" + text.gsub!(%r{<(\/?([!\w][^ >\t\f\r\n]*)[^<>\n]*)(>?)}) do |m| + all, tag, close = $1, $2, $3 + + if close.present? && (ALLOWED_TAGS.include?(tag) || (tag =~ /\Aredpre#\d+\z/)) + "<#{all}#{close}" else - "<#{$1}#{'>' unless $3.blank?}" + "<#{all}#{'>' unless close.blank?}" end end end diff --git a/test/unit/lib/redmine/wiki_formatting/textile_formatter_test.rb b/test/unit/lib/redmine/wiki_formatting/textile_formatter_test.rb index 28a3d92ab..2cf06680e 100644 --- a/test/unit/lib/redmine/wiki_formatting/textile_formatter_test.rb +++ b/test/unit/lib/redmine/wiki_formatting/textile_formatter_test.rb @@ -703,6 +703,17 @@ class Redmine::WikiFormatting::TextileFormatterTest < ActionView::TestCase assert_equal expected.gsub(%r{[\r\n\t]}, ''), to_html(text).gsub(%r{[\r\n\t]}, '') end + def test_should_escape_tags_that_start_with_pre + text = <<~STR + <preä demo>Text + STR + + expected = <<~EXPECTED + <p><preä demo>Text</p> + EXPECTED + assert_equal expected.gsub(%r{[\r\n\t]}, ''), to_html(text).gsub(%r{[\r\n\t]}, '') + end + def test_should_escape_bq_citations assert_html_output({ %{bq.:http://x/"onmouseover="alert(document.domain) Hover me} => |