diff options
| -rw-r--r-- | lib/redmine/wiki_formatting/textile/redcloth3.rb | 8 | ||||
| -rw-r--r-- | test/helpers/application_helper_test.rb | 5 |
2 files changed, 7 insertions, 6 deletions
diff --git a/lib/redmine/wiki_formatting/textile/redcloth3.rb b/lib/redmine/wiki_formatting/textile/redcloth3.rb index 532283e7e..569f719c5 100644 --- a/lib/redmine/wiki_formatting/textile/redcloth3.rb +++ b/lib/redmine/wiki_formatting/textile/redcloth3.rb @@ -840,7 +840,7 @@ class RedCloth3 < String end url = htmlesc(url.dup) - next all if url.downcase.start_with?('javascript:') + next all unless uri_with_link_safe_scheme?(url) atts = pba(atts) atts = +" href=\"#{url}#{slash}\"#{atts}" @@ -964,7 +964,7 @@ class RedCloth3 < String next m unless uri_with_safe_scheme?(url.partition('?').first) if href href = htmlesc(href.dup) - next m if href.downcase.start_with?('javascript:') + next m unless uri_with_link_safe_scheme?(href) end out = +'' @@ -1213,9 +1213,9 @@ class RedCloth3 < String all, tag, close = $1, $2, $3 if close.present? && (ALLOWED_TAGS.include?(tag) || (tag =~ /\Aredpre#\d+\z/)) - "<#{all}#{close}" + "<#{htmlesc all}#{close}" else - "<#{all}#{'>' unless close.blank?}" + "<#{htmlesc all}#{'>' unless close.blank?}" end end end diff --git a/test/helpers/application_helper_test.rb b/test/helpers/application_helper_test.rb index 617c79c6e..b7c28c10e 100644 --- a/test/helpers/application_helper_test.rb +++ b/test/helpers/application_helper_test.rb @@ -1220,12 +1220,13 @@ class ApplicationHelperTest < Redmine::HelperTest def test_html_tags to_test = { "<div>content</div>" => "<p><div>content</div></p>", - "<div class=\"bold\">content</div>" => "<p><div class=\"bold\">content</div></p>", + "<div class=\"bold\">content</div>" => "<p><div class="bold">content</div></p>", "<script>some script;</script>" => "<p><script>some script;</script></p>", # do not escape pre/code tags "<pre>\nline 1\nline2</pre>" => "<pre>\nline 1\nline2</pre>", "<pre><code>\nline 1\nline2</code></pre>" => "<pre><code>\nline 1\nline2</code></pre>", - "<pre><div>content</div></pre>" => "<pre><div>content</div></pre>", + "<pre><div class=\"foo\">content</div></pre>" => "<pre><div class=\"foo\">content</div></pre>", + "<pre><div class=\"<foo\">content</div></pre>" => "<pre><div class=\"<foo\">content</div></pre>", "HTML comment: <!-- no comments -->" => "<p>HTML comment: <!-- no comments --></p>", "<!-- opening comment" => "<p><!-- opening comment</p>", # remove attributes including class |