jro_apps/redmine Commit - r2190:35f5e3683895

Disable textile inline styles to prevent XSS attacks (#2377)....

Jean-Philippe Lang -

r2190:35f5e3683895

parent child

Context file:

r2190:35f5e3683895

lib/redcloth3.rb +1 -2

                         style << "vertical-align:#{ v_align( $& ) };" if text =~ A_VLGN
                     end
-                    style << "#{ htmlesc $1 };" if not filter_styles and
+                    style << "#{ htmlesc $1 };" if text.sub!( /\{([^}]*)\}/, '' ) && !filter_styles
-                        text.sub!( /\{([^}]*)\}/, '' )
                     lang = $1 if
                         text.sub!( /\[([^)]+?)\]/, '' )

lib/redmine/wiki_formatting/textile/formatter.rb +1 0

                       super
                       self.hard_breaks=true
                       self.no_span_caps=true
+                      self.filter_styles=true
                     end
                     def to_html(*rules, &block)

test/unit/helpers/application_helper_test.rb +2 -1

                   '!http://foo.bar/image.jpg!' => '<img src="http://foo.bar/image.jpg" alt="" />',
                   'floating !>http://foo.bar/image.jpg!' => 'floating <div style="float:right"><img src="http://foo.bar/image.jpg" alt="" /></div>',
                   'with class !(some-class)http://foo.bar/image.jpg!' => 'with class <img src="http://foo.bar/image.jpg" class="some-class" alt="" />',
-                  'with style !{width:100px;height100px}http://foo.bar/image.jpg!' => 'with style <img src="http://foo.bar/image.jpg" style="width:100px;height100px;" alt="" />',
+                  # inline styles should be stripped
+                  'with style !{width:100px;height100px}http://foo.bar/image.jpg!' => 'with style <img src="http://foo.bar/image.jpg" alt="" />',
                   'with title !http://foo.bar/image.jpg(This is a title)!' => 'with title <img src="http://foo.bar/image.jpg" title="This is a title" alt="This is a title" />',
                   'with title !http://foo.bar/image.jpg(This is a double-quoted "title")!' => 'with title <img src="http://foo.bar/image.jpg" title="This is a double-quoted &quot;title&quot;" alt="This is a double-quoted &quot;title&quot;" />',
                 }

General Comments 0

You need to be logged in to leave comments. Login now

No TODOs yet

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages