jro_apps/redmine Commit - r14905:25eb92c0dc33

Text in the "removed" part of a diff is double-escaped (#22115)....

Jean-Philippe Lang -

r14905:25eb92c0dc33

parent child

Context file:

r14905:25eb92c0dc33

Collapse all files

lib/redmine/helpers/diff.rb +5 -3

             # Redmine - project management software
             # Copyright (C) 2006-2016  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require 'diff'
             module Redmine
               module Helpers
                 class Diff
                   include ERB::Util
                   include ActionView::Helpers::TagHelper
                   include ActionView::Helpers::TextHelper
+                  include ActionView::Helpers::OutputSafetyHelper
                   attr_reader :diff, :words
                   def initialize(content_to, content_from)
                     @words = content_to.to_s.split(/(\s+)/)
                     @words = @words.select {|word| word != ' '}
                     words_from = content_from.to_s.split(/(\s+)/)
                     words_from = words_from.select {|word| word != ' '}
                     @diff = words_from.diff @words
                   end
                   def to_html
                     words = self.words.collect{|word| h(word)}
                     words_add = 0
                     words_del = 0
                     dels = 0
                     del_off = 0
                     diff.diffs.each do |diff|
                       add_at = nil
                       add_to = nil
                       del_at = nil
                       deleted = ""
                       diff.each do |change|
                         pos = change[1]
                         if change[0] == "+"
                           add_at = pos + dels unless add_at
                           add_to = pos + dels
                           words_add += 1
                         else
                           del_at = pos unless del_at
                           deleted << ' ' unless deleted.empty?
-                          deleted << h(change[2])
+                          deleted << change[2]
                           words_del  += 1
                         end
                       end
                       if add_at
                         words[add_at] = '<span class="diff_in">'.html_safe + words[add_at]
                         words[add_to] = words[add_to] + '</span>'.html_safe
                       end
                       if del_at
-                        words.insert del_at - del_off + dels + words_add, '<span class="diff_out">'.html_safe + deleted + '</span>'.html_safe
+                        # deleted is not safe html at this point
+                        words.insert del_at - del_off + dels + words_add, '<span class="diff_out">'.html_safe + h(deleted) + '</span>'.html_safe
                         dels += 1
                         del_off += words_del
                         words_del = 0
                       end
                     end
-                    words.join(' ').html_safe
+                    safe_join(words, ' ')
                   end
                 end
               end
             end

test/unit/lib/redmine/helpers/diff_test.rb +12 0

             # Redmine - project management software
             # Copyright (C) 2006-2016  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.expand_path('../../../../../test_helper', __FILE__)
             class DiffTest < ActiveSupport::TestCase
               def test_diff
                 diff = Redmine::Helpers::Diff.new("foo", "bar")
                 assert_not_nil diff
               end
+              def test_dont_double_escape
+                # 3 cases to test in the before: first word, last word, everything inbetween
+                before = "<stuff> with html & special chars</danger>"
+                # all words in after are treated equal
+                after  = "other stuff <script>alert('foo');</alert>"
+                computed_diff = Redmine::Helpers::Diff.new(before, after).to_html
+                expected_diff = '<span class="diff_in">&lt;stuff&gt; with html &amp; special chars&lt;/danger&gt;</span> <span class="diff_out">other stuff &lt;script&gt;alert(&#39;foo&#39;);&lt;/alert&gt;</span>'
+                assert_equal computed_diff, expected_diff
+              end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages