jro_apps/redmine Commit - r2190:35f5e3683895

Disable textile inline styles to prevent XSS attacks (#2377)....

Jean-Philippe Lang -

r2190:35f5e3683895

parent child

Context file:

r2190:35f5e3683895

Collapse all files

lib/redcloth3.rb +1 -2

             #                                vim:ts=4:sw=4:
             # = RedCloth - Textile and Markdown Hybrid for Ruby
             #
             # Homepage::  http://whytheluckystiff.net/ruby/redcloth/
             # Author::    why the lucky stiff (http://whytheluckystiff.net/)
             # Copyright:: (cc) 2004 why the lucky stiff (and his puppet organizations.)
             # License::   BSD
             #
             # (see http://hobix.com/textile/ for a Textile Reference.)
             #
             # Based on (and also inspired by) both:
             #
             # PyTextile: http://diveintomark.org/projects/textile/textile.py.txt
             # Textism for PHP: http://www.textism.com/tools/textile/
             #
             #
             # = RedCloth
             #
             # RedCloth is a Ruby library for converting Textile and/or Markdown
             # into HTML.  You can use either format, intermingled or separately.
             # You can also extend RedCloth to honor your own custom text stylings.
             #
             # RedCloth users are encouraged to use Textile if they are generating
             # HTML and to use Markdown if others will be viewing the plain text.
             #
             # == What is Textile?
             #
             # Textile is a simple formatting style for text
             # documents, loosely based on some HTML conventions.
             #
             # == Sample Textile Text
             #
             #  h2. This is a title
             #
             #  h3. This is a subhead
             #
             #  This is a bit of paragraph.
             #
             #  bq. This is a blockquote.
             #
             # = Writing Textile
             #
             # A Textile document consists of paragraphs.  Paragraphs
             # can be specially formatted by adding a small instruction
             # to the beginning of the paragraph.
             #
             #  h[n].   Header of size [n].
             #  bq.     Blockquote.
             #  #       Numeric list.
             #  *       Bulleted list.
             #
             # == Quick Phrase Modifiers
             #
             # Quick phrase modifiers are also included, to allow formatting
             # of small portions of text within a paragraph.
             #
             #  \_emphasis\_
             #  \_\_italicized\_\_
             #  \*strong\*
             #  \*\*bold\*\*
             #  ??citation??
             #  -deleted text-
             #  +inserted text+
             #  ^superscript^
             #  ~subscript~
             #  @code@
             #  %(classname)span%
             #
             #  ==notextile== (leave text alone)
             #
             # == Links
             #
             # To make a hypertext link, put the link text in "quotation
             # marks" followed immediately by a colon and the URL of the link.
             #
             # Optional: text in (parentheses) following the link text,
             # but before the closing quotation mark, will become a Title
             # attribute for the link, visible as a tool tip when a cursor is above it.
             #
             # Example:
             #
             #  "This is a link (This is a title) ":http://www.textism.com
             #
             # Will become:
             #
             #  <a href="http://www.textism.com" title="This is a title">This is a link</a>
             #
             # == Images
             #
             # To insert an image, put the URL for the image inside exclamation marks.
             #
             # Optional: text that immediately follows the URL in (parentheses) will
             # be used as the Alt text for the image. Images on the web should always
             # have descriptive Alt text for the benefit of readers using non-graphical
             # browsers.
             #
             # Optional: place a colon followed by a URL immediately after the
             # closing ! to make the image into a link.
             #
             # Example:
             #
             #  !http://www.textism.com/common/textist.gif(Textist)!
             #
             # Will become:
             #
             #  <img src="http://www.textism.com/common/textist.gif" alt="Textist" />
             #
             # With a link:
             #
             #  !/common/textist.gif(Textist)!:http://textism.com
             #
             # Will become:
             #
             #  <a href="http://textism.com"><img src="/common/textist.gif" alt="Textist" /></a>
             #
             # == Defining Acronyms
             #
             # HTML allows authors to define acronyms via the tag. The definition appears as a
             # tool tip when a cursor hovers over the acronym. A crucial aid to clear writing,
             # this should be used at least once for each acronym in documents where they appear.
             #
             # To quickly define an acronym in Textile, place the full text in (parentheses)
             # immediately following the acronym.
             #
             # Example:
             #
             #  ACLU(American Civil Liberties Union)
             #
             # Will become:
             #
             #  <acronym title="American Civil Liberties Union">ACLU</acronym>
             #
             # == Adding Tables
             #
             # In Textile, simple tables can be added by seperating each column by
             # a pipe.
             #
             #     |a|simple|table|row|
             #     |And|Another|table|row|
             #
             # Attributes are defined by style definitions in parentheses.
             #
             #     table(border:1px solid black).
             #     (background:#ddd;color:red). |{}| | | |
             #
             # == Using RedCloth
             #
             # RedCloth is simply an extension of the String class, which can handle
             # Textile formatting.  Use it like a String and output HTML with its
             # RedCloth#to_html method.
             #
             #  doc = RedCloth.new "
             #
             #  h2. Test document
             #
             #  Just a simple test."
             #
             #  puts doc.to_html
             #
             # By default, RedCloth uses both Textile and Markdown formatting, with
             # Textile formatting taking precedence.  If you want to turn off Markdown
             # formatting, to boost speed and limit the processor:
             #
             #  class RedCloth::Textile.new( str )
             class RedCloth3 < String
                 VERSION = '3.0.4'
                 DEFAULT_RULES = [:textile, :markdown]
                 #
                 # Two accessor for setting security restrictions.
                 #
                 # This is a nice thing if you're using RedCloth for
                 # formatting in public places (e.g. Wikis) where you
                 # don't want users to abuse HTML for bad things.
                 #
                 # If +:filter_html+ is set, HTML which wasn't
                 # created by the Textile processor will be escaped.
                 #
                 # If +:filter_styles+ is set, it will also disable
                 # the style markup specifier. ('{color: red}')
                 #
                 attr_accessor :filter_html, :filter_styles
                 #
                 # Accessor for toggling hard breaks.
                 #
                 # If +:hard_breaks+ is set, single newlines will
                 # be converted to HTML break tags.  This is the
                 # default behavior for traditional RedCloth.
                 #
                 attr_accessor :hard_breaks
                 # Accessor for toggling lite mode.
                 #
                 # In lite mode, block-level rules are ignored.  This means
                 # that tables, paragraphs, lists, and such aren't available.
                 # Only the inline markup for bold, italics, entities and so on.
                 #
                 #   r = RedCloth.new( "And then? She *fell*!", [:lite_mode] )
                 #   r.to_html
                 #   #=> "And then? She <strong>fell</strong>!"
                 #
                 attr_accessor :lite_mode
                 #
                 # Accessor for toggling span caps.
                 #
                 # Textile places `span' tags around capitalized
                 # words by default, but this wreaks havoc on Wikis.
                 # If +:no_span_caps+ is set, this will be
                 # suppressed.
                 #
                 attr_accessor :no_span_caps
                 #
                 # Establishes the markup predence.  Available rules include:
                 #
                 # == Textile Rules
                 #
                 # The following textile rules can be set individually.  Or add the complete
                 # set of rules with the single :textile rule, which supplies the rule set in
                 # the following precedence:
                 #
                 # refs_textile::          Textile references (i.e. [hobix]http://hobix.com/)
                 # block_textile_table::   Textile table block structures
                 # block_textile_lists::   Textile list structures
                 # block_textile_prefix::  Textile blocks with prefixes (i.e. bq., h2., etc.)
                 # inline_textile_image::  Textile inline images
                 # inline_textile_link::   Textile inline links
                 # inline_textile_span::   Textile inline spans
                 # glyphs_textile:: Textile entities (such as em-dashes and smart quotes)
                 #
                 # == Markdown
                 #
                 # refs_markdown::         Markdown references (for example: [hobix]: http://hobix.com/)
                 # block_markdown_setext:: Markdown setext headers
                 # block_markdown_atx::    Markdown atx headers
                 # block_markdown_rule::   Markdown horizontal rules
                 # block_markdown_bq::     Markdown blockquotes
                 # block_markdown_lists::  Markdown lists
                 # inline_markdown_link::  Markdown links
                 attr_accessor :rules
                 # Returns a new RedCloth object, based on _string_ and
                 # enforcing all the included _restrictions_.
                 #
                 #   r = RedCloth.new( "h1. A <b>bold</b> man", [:filter_html] )
                 #   r.to_html
                 #     #=>"<h1>A &lt;b&gt;bold&lt;/b&gt; man</h1>"
                 #
                 def initialize( string, restrictions = [] )
                     restrictions.each { |r| method( "#{ r }=" ).call( true ) }
                     super( string )
                 end
                 #
                 # Generates HTML from the Textile contents.
                 #
                 #   r = RedCloth.new( "And then? She *fell*!" )
                 #   r.to_html( true )
                 #     #=>"And then? She <strong>fell</strong>!"
                 #
                 def to_html( *rules )
                     rules = DEFAULT_RULES if rules.empty?
                     # make our working copy
                     text = self.dup
                     @urlrefs = {}
                     @shelf = []
                     textile_rules = [:refs_textile, :block_textile_table, :block_textile_lists,
                                      :block_textile_prefix, :inline_textile_image, :inline_textile_link,
                                      :inline_textile_code, :inline_textile_span, :glyphs_textile]
                     markdown_rules = [:refs_markdown, :block_markdown_setext, :block_markdown_atx, :block_markdown_rule,
                                       :block_markdown_bq, :block_markdown_lists,
                                       :inline_markdown_reflink, :inline_markdown_link]
                     @rules = rules.collect do |rule|
                         case rule
                         when :markdown
                             markdown_rules
                         when :textile
                             textile_rules
                         else
                             rule
                         end
                     end.flatten
                     # standard clean up
                     incoming_entities text
                     clean_white_space text
                     # start processor
                     @pre_list = []
                     rip_offtags text
                     no_textile text
                     escape_html_tags text
                     hard_break text
                     unless @lite_mode
                         refs text
                         # need to do this before text is split by #blocks
                         block_textile_quotes text
                         blocks text
                     end
                     inline text
                     smooth_offtags text
                     retrieve text
                     text.gsub!( /<\/?notextile>/, '' )
                     text.gsub!( /x%x%/, '&#38;' )
                     clean_html text if filter_html
                     text.strip!
                     text
                 end
                 #######
                 private
                 #######
                 #
                 # Mapping of 8-bit ASCII codes to HTML numerical entity equivalents.
                 # (from PyTextile)
                 #
                 TEXTILE_TAGS =
                     [[128, 8364], [129, 0], [130, 8218], [131, 402], [132, 8222], [133, 8230],
                      [134, 8224], [135, 8225], [136, 710], [137, 8240], [138, 352], [139, 8249],
                      [140, 338], [141, 0], [142, 0], [143, 0], [144, 0], [145, 8216], [146, 8217],
                      [147, 8220], [148, 8221], [149, 8226], [150, 8211], [151, 8212], [152, 732],
                      [153, 8482], [154, 353], [155, 8250], [156, 339], [157, 0], [158, 0], [159, 376]].
                     collect! do |a, b|
                         [a.chr, ( b.zero? and "" or "&#{ b };" )]
                     end
                 #
                 # Regular expressions to convert to HTML.
                 #
                 A_HLGN = /(?:(?:<>|<|>|\=|[()]+)+)/
                 A_VLGN = /[\-^~]/
                 C_CLAS = '(?:\([^)]+\))'
                 C_LNGE = '(?:\[[^\[\]]+\])'
                 C_STYL = '(?:\{[^}]+\})'
                 S_CSPN = '(?:\\\\\d+)'
                 S_RSPN = '(?:/\d+)'
                 A = "(?:#{A_HLGN}?#{A_VLGN}?|#{A_VLGN}?#{A_HLGN}?)"
                 S = "(?:#{S_CSPN}?#{S_RSPN}|#{S_RSPN}?#{S_CSPN}?)"
                 C = "(?:#{C_CLAS}?#{C_STYL}?#{C_LNGE}?|#{C_STYL}?#{C_LNGE}?#{C_CLAS}?|#{C_LNGE}?#{C_STYL}?#{C_CLAS}?)"
                 # PUNCT = Regexp::quote( '!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~' )
                 PUNCT = Regexp::quote( '!"#$%&\'*+,-./:;=?@\\^_`|~' )
                 PUNCT_NOQ = Regexp::quote( '!"#$&\',./:;=?@\\`|' )
                 PUNCT_Q = Regexp::quote( '*-_+^~%' )
                 HYPERLINK = '(\S+?)([^\w\s/;=\?]*?)(?=\s|<|$)'
                 # Text markup tags, don't conflict with block tags
                 SIMPLE_HTML_TAGS = [
                     'tt', 'b', 'i', 'big', 'small', 'em', 'strong', 'dfn', 'code',
                     'samp', 'kbd', 'var', 'cite', 'abbr', 'acronym', 'a', 'img', 'br',
                     'br', 'map', 'q', 'sub', 'sup', 'span', 'bdo'
                 ]
                 QTAGS = [
                     ['**', 'b', :limit],
                     ['*', 'strong', :limit],
                     ['??', 'cite', :limit],
                     ['-', 'del', :limit],
                     ['__', 'i', :limit],
                     ['_', 'em', :limit],
                     ['%', 'span', :limit],
                     ['+', 'ins', :limit],
                     ['^', 'sup', :limit],
                     ['~', 'sub', :limit]
                 ]
                 QTAGS.collect! do |rc, ht, rtype|
                     rcq = Regexp::quote rc
                     re =
                         case rtype
                         when :limit
                             /(^|[>\s\(])
                             (#{rcq})
                             (#{C})
                             (?::(\S+?))?
                             (\w|[^\s\-].*?[^\s\-])
                             #{rcq}
                             (?=[[:punct:]]|\s|\)|$)/x
                         else
                             /(#{rcq})
                             (#{C})
                             (?::(\S+))?
                             (\w|[^\s\-].*?[^\s\-])
                             #{rcq}/xm
                         end
                     [rc, ht, re, rtype]
                 end
                 # Elements to handle
                 GLYPHS = [
                 #   [ /([^\s\[{(>])?\'([dmst]\b|ll\b|ve\b|\s|:|$)/, '\1&#8217;\2' ], # single closing
                 #   [ /([^\s\[{(>#{PUNCT_Q}][#{PUNCT_Q}]*)\'/, '\1&#8217;' ], # single closing
                 #   [ /\'(?=[#{PUNCT_Q}]*(s\b|[\s#{PUNCT_NOQ}]))/, '&#8217;' ], # single closing
                 #   [ /\'/, '&#8216;' ], # single opening
                 #   [ /</, '&lt;' ], # less-than
                 #   [ />/, '&gt;' ], # greater-than
                 #   [ /([^\s\[{(])?"(\s|:|$)/, '\1&#8221;\2' ], # double closing
                 #   [ /([^\s\[{(>#{PUNCT_Q}][#{PUNCT_Q}]*)"/, '\1&#8221;' ], # double closing
                 #   [ /"(?=[#{PUNCT_Q}]*[\s#{PUNCT_NOQ}])/, '&#8221;' ], # double closing
                 #   [ /"/, '&#8220;' ], # double opening
                 #   [ /\b( )?\.{3}/, '\1&#8230;' ], # ellipsis
                 #   [ /\b([A-Z][A-Z0-9]{2,})\b(?:[(]([^)]*)[)])/, '<acronym title="\2">\1</acronym>' ], # 3+ uppercase acronym
                 #   [ /(^|[^"][>\s])([A-Z][A-Z0-9 ]+[A-Z0-9])([^<A-Za-z0-9]|$)/, '\1<span class="caps">\2</span>\3', :no_span_caps ], # 3+ uppercase caps
                 #   [ /(\.\s)?\s?--\s?/, '\1&#8212;' ], # em dash
                 #   [ /\s->\s/, ' &rarr; ' ], # right arrow
                 #   [ /\s-\s/, ' &#8211; ' ], # en dash
                 #   [ /(\d+) ?x ?(\d+)/, '\1&#215;\2' ], # dimension sign
                 #   [ /\b ?[(\[]TM[\])]/i, '&#8482;' ], # trademark
                 #   [ /\b ?[(\[]R[\])]/i, '&#174;' ], # registered
                 #   [ /\b ?[(\[]C[\])]/i, '&#169;' ] # copyright
                 ]
                 H_ALGN_VALS = {
                     '<' => 'left',
                     '=' => 'center',
                     '>' => 'right',
                     '<>' => 'justify'
                 }
                 V_ALGN_VALS = {
                     '^' => 'top',
                     '-' => 'middle',
                     '~' => 'bottom'
                 }
                 #
                 # Flexible HTML escaping
                 #
                 def htmlesc( str, mode=:Quotes )
                   if str
                     str.gsub!( '&', '&amp;' )
                     str.gsub!( '"', '&quot;' ) if mode != :NoQuotes
                     str.gsub!( "'", '&#039;' ) if mode == :Quotes
                     str.gsub!( '<', '&lt;')
                     str.gsub!( '>', '&gt;')
                   end
                   str
                 end
                 # Search and replace for Textile glyphs (quotes, dashes, other symbols)
                 def pgl( text )
                     #GLYPHS.each do |re, resub, tog|
                     #    next if tog and method( tog ).call
                     #    text.gsub! re, resub
                     #end
                     text.gsub!(/\b([A-Z][A-Z0-9]{2,})\b(?:[(]([^)]*)[)])/) do |m|
                       "<acronym title=\"#{htmlesc $2}\">#{$1}</acronym>"
                     end
                 end
                 # Parses Textile attribute lists and builds an HTML attribute string
                 def pba( text_in, element = "" )
                     return '' unless text_in
                     style = []
                     text = text_in.dup
                     if element == 'td'
                         colspan = $1 if text =~ /\\(\d+)/
                         rowspan = $1 if text =~ /\/(\d+)/
                         style << "vertical-align:#{ v_align( $& ) };" if text =~ A_VLGN
                     end
-                    style << "#{ htmlesc $1 };" if not filter_styles and
+                    style << "#{ htmlesc $1 };" if text.sub!( /\{([^}]*)\}/, '' ) && !filter_styles
-                        text.sub!( /\{([^}]*)\}/, '' )
                     lang = $1 if
                         text.sub!( /\[([^)]+?)\]/, '' )
                     cls = $1 if
                         text.sub!( /\(([^()]+?)\)/, '' )
                     style << "padding-left:#{ $1.length }em;" if
                         text.sub!( /([(]+)/, '' )
                     style << "padding-right:#{ $1.length }em;" if text.sub!( /([)]+)/, '' )
                     style << "text-align:#{ h_align( $& ) };" if text =~ A_HLGN
                     cls, id = $1, $2 if cls =~ /^(.*?)#(.*)$/
                     atts = ''
                     atts << " style=\"#{ style.join }\"" unless style.empty?
                     atts << " class=\"#{ cls }\"" unless cls.to_s.empty?
                     atts << " lang=\"#{ lang }\"" if lang
                     atts << " id=\"#{ id }\"" if id
                     atts << " colspan=\"#{ colspan }\"" if colspan
                     atts << " rowspan=\"#{ rowspan }\"" if rowspan
                     atts
                 end
                 TABLE_RE = /^(?:table(_?#{S}#{A}#{C})\. ?\n)?^(#{A}#{C}\.? ?\|.*?\|)(\n\n|\Z)/m
                 # Parses a Textile table block, building HTML from the result.
                 def block_textile_table( text )
                     text.gsub!( TABLE_RE ) do |matches|
                         tatts, fullrow = $~[1..2]
                         tatts = pba( tatts, 'table' )
                         tatts = shelve( tatts ) if tatts
                         rows = []
                         fullrow.each_line do |row|
                             ratts, row = pba( $1, 'tr' ), $2 if row =~ /^(#{A}#{C}\. )(.*)/m
                             cells = []
                             row.split( /(\|)(?![^\[\|]*\]\])/ )[1..-2].each do |cell|
                                 next if cell == '|'
                                 ctyp = 'd'
                                 ctyp = 'h' if cell =~ /^_/
                                 catts = ''
                                 catts, cell = pba( $1, 'td' ), $2 if cell =~ /^(_?#{S}#{A}#{C}\. ?)(.*)/
                                 catts = shelve( catts ) if catts
                                 cells << "\t\t\t<t#{ ctyp }#{ catts }>#{ cell }</t#{ ctyp }>"
                             end
                             ratts = shelve( ratts ) if ratts
                             rows << "\t\t<tr#{ ratts }>\n#{ cells.join( "\n" ) }\n\t\t</tr>"
                         end
                         "\t<table#{ tatts }>\n#{ rows.join( "\n" ) }\n\t</table>\n\n"
                     end
                 end
                 LISTS_RE = /^([#*]+?#{C} .*?)$(?![^#*])/m
                 LISTS_CONTENT_RE = /^([#*]+)(#{A}#{C}) (.*)$/m
                 # Parses Textile lists and generates HTML
                 def block_textile_lists( text )
                     text.gsub!( LISTS_RE ) do |match|
                         lines = match.split( /\n/ )
                         last_line = -1
                         depth = []
                         lines.each_with_index do |line, line_id|
                             if line =~ LISTS_CONTENT_RE
                                 tl,atts,content = $~[1..3]
                                 if depth.last
                                     if depth.last.length > tl.length
                                         (depth.length - 1).downto(0) do |i|
                                             break if depth[i].length == tl.length
                                             lines[line_id - 1] << "</li>\n\t</#{ lT( depth[i] ) }l>\n\t"
                                             depth.pop
                                         end
                                     end
                                     if depth.last and depth.last.length == tl.length
                                         lines[line_id - 1] << '</li>'
                                     end
                                 end
                                 unless depth.last == tl
                                     depth << tl
                                     atts = pba( atts )
                                     atts = shelve( atts ) if atts
                                     lines[line_id] = "\t<#{ lT(tl) }l#{ atts }>\n\t<li>#{ content }"
                                 else
                                     lines[line_id] = "\t\t<li>#{ content }"
                                 end
                                 last_line = line_id
                             else
                                 last_line = line_id
                             end
                             if line_id - last_line > 1 or line_id == lines.length - 1
                                 depth.delete_if do |v|
                                     lines[last_line] << "</li>\n\t</#{ lT( v ) }l>"
                                 end
                             end
                         end
                         lines.join( "\n" )
                     end
                 end
                 QUOTES_RE = /(^>+([^\n]*?)\n?)+/m
                 QUOTES_CONTENT_RE = /^([> ]+)(.*)$/m
                 def block_textile_quotes( text )
                   text.gsub!( QUOTES_RE ) do |match|
                     lines = match.split( /\n/ )
                     quotes = ''
                     indent = 0
                     lines.each do |line|
                       line =~ QUOTES_CONTENT_RE
                       bq,content = $1, $2
                       l = bq.count('>')
                       if l != indent
                         quotes << ("\n\n" + (l>indent ? '<blockquote>' * (l-indent) : '</blockquote>' * (indent-l)) + "\n\n")
                         indent = l
                       end
                       quotes << (content + "\n")
                     end
                     quotes << ("\n" + '</blockquote>' * indent + "\n\n")
                     quotes
                   end
                 end
                 CODE_RE = /(\W)
                     @
                     (?:\|(\w+?)\|)?
                     (.+?)
                     @
                     (?=\W)/x
                 def inline_textile_code( text )
                     text.gsub!( CODE_RE ) do |m|
                         before,lang,code,after = $~[1..4]
                         lang = " lang=\"#{ lang }\"" if lang
                         rip_offtags( "#{ before }<code#{ lang }>#{ code }</code>#{ after }" )
                     end
                 end
                 def lT( text )
                     text =~ /\#$/ ? 'o' : 'u'
                 end
                 def hard_break( text )
                     text.gsub!( /(.)\n(?!\Z| *([#*=]+(\s|$)|[{|]))/, "\\1<br />" ) if hard_breaks
                 end
                 BLOCKS_GROUP_RE = /\n{2,}(?! )/m
                 def blocks( text, deep_code = false )
                     text.replace( text.split( BLOCKS_GROUP_RE ).collect do |blk|
                         plain = blk !~ /\A[#*> ]/
                         # skip blocks that are complex HTML
                         if blk =~ /^<\/?(\w+).*>/ and not SIMPLE_HTML_TAGS.include? $1
                             blk
                         else
                             # search for indentation levels
                             blk.strip!
                             if blk.empty?
                                 blk
                             else
                                 code_blk = nil
                                 blk.gsub!( /((?:\n(?:\n^ +[^\n]*)+)+)/m ) do |iblk|
                                     flush_left iblk
                                     blocks iblk, plain
                                     iblk.gsub( /^(\S)/, "\t\\1" )
                                     if plain
                                         code_blk = iblk; ""
                                     else
                                         iblk
                                     end
                                 end
                                 block_applied = 0
                                 @rules.each do |rule_name|
                                     block_applied += 1 if ( rule_name.to_s.match /^block_/ and method( rule_name ).call( blk ) )
                                 end
                                 if block_applied.zero?
                                     if deep_code
                                         blk = "\t<pre><code>#{ blk }</code></pre>"
                                     else
                                         blk = "\t<p>#{ blk }</p>"
                                     end
                                 end
                                 # hard_break blk
                                 blk + "\n#{ code_blk }"
                             end
                         end
                     end.join( "\n\n" ) )
                 end
                 def textile_bq( tag, atts, cite, content )
                     cite, cite_title = check_refs( cite )
                     cite = " cite=\"#{ cite }\"" if cite
                     atts = shelve( atts ) if atts
                     "\t<blockquote#{ cite }>\n\t\t<p#{ atts }>#{ content }</p>\n\t</blockquote>"
                 end
                 def textile_p( tag, atts, cite, content )
                     atts = shelve( atts ) if atts
                     "\t<#{ tag }#{ atts }>#{ content }</#{ tag }>"
                 end
                 alias textile_h1 textile_p
                 alias textile_h2 textile_p
                 alias textile_h3 textile_p
                 alias textile_h4 textile_p
                 alias textile_h5 textile_p
                 alias textile_h6 textile_p
                 def textile_fn_( tag, num, atts, cite, content )
                     atts << " id=\"fn#{ num }\" class=\"footnote\""
                     content = "<sup>#{ num }</sup> #{ content }"
                     atts = shelve( atts ) if atts
                     "\t<p#{ atts }>#{ content }</p>"
                 end
                 BLOCK_RE = /^(([a-z]+)(\d*))(#{A}#{C})\.(?::(\S+))? (.*)$/m
                 def block_textile_prefix( text )
                     if text =~ BLOCK_RE
                         tag,tagpre,num,atts,cite,content = $~[1..6]
                         atts = pba( atts )
                         # pass to prefix handler
                         if respond_to? "textile_#{ tag }", true
                             text.gsub!( $&, method( "textile_#{ tag }" ).call( tag, atts, cite, content ) )
                         elsif respond_to? "textile_#{ tagpre }_", true
                             text.gsub!( $&, method( "textile_#{ tagpre }_" ).call( tagpre, num, atts, cite, content ) )
                         end
                     end
                 end
                 SETEXT_RE = /\A(.+?)\n([=-])[=-]* *$/m
                 def block_markdown_setext( text )
                     if text =~ SETEXT_RE
                         tag = if $2 == "="; "h1"; else; "h2"; end
                         blk, cont = "<#{ tag }>#{ $1 }</#{ tag }>", $'
                         blocks cont
                         text.replace( blk + cont )
                     end
                 end
                 ATX_RE = /\A(\#{1,6})  # $1 = string of #'s
                           [ ]*
                           (.+?)       # $2 = Header text
                           [ ]*
                           \#*         # optional closing #'s (not counted)
                           $/x
                 def block_markdown_atx( text )
                     if text =~ ATX_RE
                         tag = "h#{ $1.length }"
                         blk, cont = "<#{ tag }>#{ $2 }</#{ tag }>\n\n", $'
                         blocks cont
                         text.replace( blk + cont )
                     end
                 end
                 MARKDOWN_BQ_RE = /\A(^ *> ?.+$(.+\n)*\n*)+/m
                 def block_markdown_bq( text )
                     text.gsub!( MARKDOWN_BQ_RE ) do |blk|
                         blk.gsub!( /^ *> ?/, '' )
                         flush_left blk
                         blocks blk
                         blk.gsub!( /^(\S)/, "\t\\1" )
                         "<blockquote>\n#{ blk }\n</blockquote>\n\n"
                     end
                 end
                 MARKDOWN_RULE_RE = /^(#{
                     ['*', '-', '_'].collect { |ch| ' ?(' + Regexp::quote( ch ) + ' ?){3,}' }.join( '|' )
                 })$/
                 def block_markdown_rule( text )
                     text.gsub!( MARKDOWN_RULE_RE ) do |blk|
                         "<hr />"
                     end
                 end
                 # XXX TODO XXX
                 def block_markdown_lists( text )
                 end
                 def inline_textile_span( text )
                     QTAGS.each do |qtag_rc, ht, qtag_re, rtype|
                         text.gsub!( qtag_re ) do |m|
                             case rtype
                             when :limit
                                 sta,qtag,atts,cite,content = $~[1..5]
                             else
                                 qtag,atts,cite,content = $~[1..4]
                                 sta = ''
                             end
                             atts = pba( atts )
                             atts << " cite=\"#{ cite }\"" if cite
                             atts = shelve( atts ) if atts
                             "#{ sta }<#{ ht }#{ atts }>#{ content }</#{ ht }>"
                         end
                     end
                 end
                 LINK_RE = /
                         ([\s\[{(]|[#{PUNCT}])?     # $pre
                         "                          # start
                         (#{C})                     # $atts
                         ([^"\n]+?)                 # $text
                         \s?
                         (?:\(([^)]+?)\)(?="))?     # $title
                         ":
                         ([\w\/]\S+?)               # $url
                         (\/)?                      # $slash
                         ([^\w\=\/;\(\)]*?)         # $post
                         (?=<|\s|$)
                     /x
             #"
                 def inline_textile_link( text )
                     text.gsub!( LINK_RE ) do |m|
                         pre,atts,text,title,url,slash,post = $~[1..7]
                         url, url_title = check_refs( url )
                         title ||= url_title
                         # Idea below : an URL with unbalanced parethesis and
                         # ending by ')' is put into external parenthesis
                         if ( url[-1]==?) and ((url.count("(") - url.count(")")) < 0 ) )
                           url=url[0..-2] # discard closing parenth from url
                           post = ")"+post # add closing parenth to post
                         end
                         atts = pba( atts )
                         atts = " href=\"#{ url }#{ slash }\"#{ atts }"
                         atts << " title=\"#{ htmlesc title }\"" if title
                         atts = shelve( atts ) if atts
                         external = (url =~ /^https?:\/\//) ? ' class="external"' : ''
                         "#{ pre }<a#{ atts }#{ external }>#{ text }</a>#{ post }"
                     end
                 end
                 MARKDOWN_REFLINK_RE = /
                         \[([^\[\]]+)\]      # $text
                         [ ]?                # opt. space
                         (?:\n[ ]*)?         # one optional newline followed by spaces
                         \[(.*?)\]           # $id
                     /x
                 def inline_markdown_reflink( text )
                     text.gsub!( MARKDOWN_REFLINK_RE ) do |m|
                         text, id = $~[1..2]
                         if id.empty?
                             url, title = check_refs( text )
                         else
                             url, title = check_refs( id )
                         end
                         atts = " href=\"#{ url }\""
                         atts << " title=\"#{ title }\"" if title
                         atts = shelve( atts )
                         "<a#{ atts }>#{ text }</a>"
                     end
                 end
                 MARKDOWN_LINK_RE = /
                         \[([^\[\]]+)\]      # $text
                         \(                  # open paren
                         [ \t]*              # opt space
                         <?(.+?)>?           # $href
                         [ \t]*              # opt space
                         (?:                 # whole title
                         (['"])              # $quote
                         (.*?)               # $title
                         \3                  # matching quote
                         )?                  # title is optional
                         \)
                     /x
                 def inline_markdown_link( text )
                     text.gsub!( MARKDOWN_LINK_RE ) do |m|
                         text, url, quote, title = $~[1..4]
                         atts = " href=\"#{ url }\""
                         atts << " title=\"#{ title }\"" if title
                         atts = shelve( atts )
                         "<a#{ atts }>#{ text }</a>"
                     end
                 end
                 TEXTILE_REFS_RE =  /(^ *)\[([^\[\n]+?)\](#{HYPERLINK})(?=\s|$)/
                 MARKDOWN_REFS_RE = /(^ *)\[([^\n]+?)\]:\s+<?(#{HYPERLINK})>?(?:\s+"((?:[^"]|\\")+)")?(?=\s|$)/m
                 def refs( text )
                     @rules.each do |rule_name|
                         method( rule_name ).call( text ) if rule_name.to_s.match /^refs_/
                     end
                 end
                 def refs_textile( text )
                     text.gsub!( TEXTILE_REFS_RE ) do |m|
                         flag, url = $~[2..3]
                         @urlrefs[flag.downcase] = [url, nil]
                         nil
                     end
                 end
                 def refs_markdown( text )
                     text.gsub!( MARKDOWN_REFS_RE ) do |m|
                         flag, url = $~[2..3]
                         title = $~[6]
                         @urlrefs[flag.downcase] = [url, title]
                         nil
                     end
                 end
                 def check_refs( text )
                     ret = @urlrefs[text.downcase] if text
                     ret || [text, nil]
                 end
                 IMAGE_RE = /
                         (<p>|.|^)            # start of line?
                         \!                   # opening
                         (\<|\=|\>)?          # optional alignment atts
                         (#{C})               # optional style,class atts
                         (?:\. )?             # optional dot-space
                         ([^\s(!]+?)          # presume this is the src
                         \s?                  # optional space
                         (?:\(((?:[^\(\)]|\([^\)]+\))+?)\))?   # optional title
                         \!                   # closing
                         (?::#{ HYPERLINK })? # optional href
                     /x
                 def inline_textile_image( text )
                     text.gsub!( IMAGE_RE )  do |m|
                         stln,algn,atts,url,title,href,href_a1,href_a2 = $~[1..8]
                         htmlesc title
                         atts = pba( atts )
                         atts = " src=\"#{ url }\"#{ atts }"
                         atts << " title=\"#{ title }\"" if title
                         atts << " alt=\"#{ title }\""
                         # size = @getimagesize($url);
                         # if($size) $atts.= " $size[3]";
                         href, alt_title = check_refs( href ) if href
                         url, url_title = check_refs( url )
                         out = ''
                         out << "<a#{ shelve( " href=\"#{ href }\"" ) }>" if href
                         out << "<img#{ shelve( atts ) } />"
                         out << "</a>#{ href_a1 }#{ href_a2 }" if href
                         if algn
                             algn = h_align( algn )
                             if stln == "<p>"
                                 out = "<p style=\"float:#{ algn }\">#{ out }"
                             else
                                 out = "#{ stln }<div style=\"float:#{ algn }\">#{ out }</div>"
                             end
                         else
                             out = stln + out
                         end
                         out
                     end
                 end
                 def shelve( val )
                     @shelf << val
                     " :redsh##{ @shelf.length }:"
                 end
                 def retrieve( text )
                     @shelf.each_with_index do |r, i|
                         text.gsub!( " :redsh##{ i + 1 }:", r )
                     end
                 end
                 def incoming_entities( text )
                     ## turn any incoming ampersands into a dummy character for now.
                     ## This uses a negative lookahead for alphanumerics followed by a semicolon,
                     ## implying an incoming html entity, to be skipped
                     text.gsub!( /&(?![#a-z0-9]+;)/i, "x%x%" )
                 end
                 def no_textile( text )
                     text.gsub!( /(^|\s)==([^=]+.*?)==(\s|$)?/,
                         '\1<notextile>\2</notextile>\3' )
                     text.gsub!( /^ *==([^=]+.*?)==/m,
                         '\1<notextile>\2</notextile>\3' )
                 end
                 def clean_white_space( text )
                     # normalize line breaks
                     text.gsub!( /\r\n/, "\n" )
                     text.gsub!( /\r/, "\n" )
                     text.gsub!( /\t/, '    ' )
                     text.gsub!( /^ +$/, '' )
                     text.gsub!( /\n{3,}/, "\n\n" )
                     text.gsub!( /"$/, "\" " )
                     # if entire document is indented, flush
                     # to the left side
                     flush_left text
                 end
                 def flush_left( text )
                     indt = 0
                     if text =~ /^ /
                         while text !~ /^ {#{indt}}\S/
                             indt += 1
                         end unless text.empty?
                         if indt.nonzero?
                             text.gsub!( /^ {#{indt}}/, '' )
                         end
                     end
                 end
                 def footnote_ref( text )
                     text.gsub!( /\b\[([0-9]+?)\](\s)?/,
                         '<sup><a href="#fn\1">\1</a></sup>\2' )
                 end
                 OFFTAGS = /(code|pre|kbd|notextile)/
                 OFFTAG_MATCH = /(?:(<\/#{ OFFTAGS }>)|(<#{ OFFTAGS }[^>]*>))(.*?)(?=<\/?#{ OFFTAGS }|\Z)/mi
                 OFFTAG_OPEN = /<#{ OFFTAGS }/
                 OFFTAG_CLOSE = /<\/?#{ OFFTAGS }/
                 HASTAG_MATCH = /(<\/?\w[^\n]*?>)/m
                 ALLTAG_MATCH = /(<\/?\w[^\n]*?>)|.*?(?=<\/?\w[^\n]*?>|$)/m
                 def glyphs_textile( text, level = 0 )
                     if text !~ HASTAG_MATCH
                         pgl text
                         footnote_ref text
                     else
                         codepre = 0
                         text.gsub!( ALLTAG_MATCH ) do |line|
                             ## matches are off if we're between <code>, <pre> etc.
                             if $1
                                 if line =~ OFFTAG_OPEN
                                     codepre += 1
                                 elsif line =~ OFFTAG_CLOSE
                                     codepre -= 1
                                     codepre = 0 if codepre < 0
                                 end
                             elsif codepre.zero?
                                 glyphs_textile( line, level + 1 )
                             else
                                 htmlesc( line, :NoQuotes )
                             end
                             # p [level, codepre, line]
                             line
                         end
                     end
                 end
                 def rip_offtags( text )
                     if text =~ /<.*>/
                         ## strip and encode <pre> content
                         codepre, used_offtags = 0, {}
                         text.gsub!( OFFTAG_MATCH ) do |line|
                             if $3
                                 offtag, aftertag = $4, $5
                                 codepre += 1
                                 used_offtags[offtag] = true
                                 if codepre - used_offtags.length > 0
                                     htmlesc( line, :NoQuotes )
                                     @pre_list.last << line
                                     line = ""
                                 else
                                     htmlesc( aftertag, :NoQuotes ) if aftertag
                                     line = "<redpre##{ @pre_list.length }>"
                                     $3.match(/<#{ OFFTAGS }([^>]*)>/)
                                     tag = $1
                                     $2.to_s.match(/(class\=\S+)/i)
                                     tag << " #{$1}" if $1
                                     @pre_list << "<#{ tag }>#{ aftertag }"
                                 end
                             elsif $1 and codepre > 0
                                 if codepre - used_offtags.length > 0
                                     htmlesc( line, :NoQuotes )
                                     @pre_list.last << line
                                     line = ""
                                 end
                                 codepre -= 1 unless codepre.zero?
                                 used_offtags = {} if codepre.zero?
                             end
                             line
                         end
                     end
                     text
                 end
                 def smooth_offtags( text )
                     unless @pre_list.empty?
                         ## replace <pre> content
                         text.gsub!( /<redpre#(\d+)>/ ) { @pre_list[$1.to_i] }
                     end
                 end
                 def inline( text )
                     [/^inline_/, /^glyphs_/].each do |meth_re|
                         @rules.each do |rule_name|
                             method( rule_name ).call( text ) if rule_name.to_s.match( meth_re )
                         end
                     end
                 end
                 def h_align( text )
                     H_ALGN_VALS[text]
                 end
                 def v_align( text )
                     V_ALGN_VALS[text]
                 end
                 def textile_popup_help( name, windowW, windowH )
                     ' <a target="_blank" href="http://hobix.com/textile/#' + helpvar + '" onclick="window.open(this.href, \'popupwindow\', \'width=' + windowW + ',height=' + windowH + ',scrollbars,resizable\'); return false;">' + name + '</a><br />'
                 end
                 # HTML cleansing stuff
                 BASIC_TAGS = {
                     'a' => ['href', 'title'],
                     'img' => ['src', 'alt', 'title'],
                     'br' => [],
                     'i' => nil,
                     'u' => nil,
                     'b' => nil,
                     'pre' => nil,
                     'kbd' => nil,
                     'code' => ['lang'],
                     'cite' => nil,
                     'strong' => nil,
                     'em' => nil,
                     'ins' => nil,
                     'sup' => nil,
                     'sub' => nil,
                     'del' => nil,
                     'table' => nil,
                     'tr' => nil,
                     'td' => ['colspan', 'rowspan'],
                     'th' => nil,
                     'ol' => nil,
                     'ul' => nil,
                     'li' => nil,
                     'p' => nil,
                     'h1' => nil,
                     'h2' => nil,
                     'h3' => nil,
                     'h4' => nil,
                     'h5' => nil,
                     'h6' => nil,
                     'blockquote' => ['cite']
                 }
                 def clean_html( text, tags = BASIC_TAGS )
                     text.gsub!( /<!\[CDATA\[/, '' )
                     text.gsub!( /<(\/*)(\w+)([^>]*)>/ ) do
                         raw = $~
                         tag = raw[2].downcase
                         if tags.has_key? tag
                             pcs = [tag]
                             tags[tag].each do |prop|
                                 ['"', "'", ''].each do |q|
                                     q2 = ( q != '' ? q : '\s' )
                                     if raw[3] =~ /#{prop}\s*=\s*#{q}([^#{q2}]+)#{q}/i
                                         attrv = $1
                                         next if prop == 'src' and attrv =~ %r{^(?!http)\w+:}
                                         pcs << "#{prop}=\"#{$1.gsub('"', '\\"')}\""
                                         break
                                     end
                                 end
                             end if tags[tag]
                             "<#{raw[1]}#{pcs.join " "}>"
                         else
                             " "
                         end
                     end
                 end
                 ALLOWED_TAGS = %w(redpre pre code notextile)
                 def escape_html_tags(text)
                   text.gsub!(%r{<(\/?([!\w]+)[^<>\n]*)(>?)}) {|m| ALLOWED_TAGS.include?($2) ? "<#{$1}#{$3}" : "&lt;#{$1}#{'&gt;' unless $3.blank?}" }
                 end
             end

lib/redmine/wiki_formatting/textile/formatter.rb +1 0

             # Redmine - project management software
             # Copyright (C) 2006-2008  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require 'redcloth3'
             require 'coderay'
             module Redmine
               module WikiFormatting
                 module Textile
                   class Formatter < RedCloth3
                     # auto_link rule after textile rules so that it doesn't break !image_url! tags
                     RULES = [:textile, :block_markdown_rule, :inline_auto_link, :inline_auto_mailto, :inline_toc, :inline_macros]
                     def initialize(*args)
                       super
                       self.hard_breaks=true
                       self.no_span_caps=true
+                      self.filter_styles=true
                     end
                     def to_html(*rules, &block)
                       @toc = []
                       @macros_runner = block
                       super(*RULES).to_s
                     end
                   private
                     # Patch for RedCloth.  Fixed in RedCloth r128 but _why hasn't released it yet.
                     # <a href="http://code.whytheluckystiff.net/redcloth/changeset/128">http://code.whytheluckystiff.net/redcloth/changeset/128</a>
                     def hard_break( text )
                       text.gsub!( /(.)\n(?!\n|\Z|>| *(>? *[#*=]+(\s|$)|[{|]))/, "\\1<br />\n" ) if hard_breaks
                     end
                     # Patch to add code highlighting support to RedCloth
                     def smooth_offtags( text )
                       unless @pre_list.empty?
                         ## replace <pre> content
                         text.gsub!(/<redpre#(\d+)>/) do
                           content = @pre_list[$1.to_i]
                           if content.match(/<code\s+class="(\w+)">\s?(.+)/m)
                             content = "<code class=\"#{$1} CodeRay\">" +
                               CodeRay.scan($2, $1.downcase).html(:escape => false, :line_numbers => :inline)
                           end
                           content
                         end
                       end
                     end
                     # Patch to add 'table of content' support to RedCloth
                     def textile_p_withtoc(tag, atts, cite, content)
                       # removes wiki links from the item
                       toc_item = content.gsub(/(\[\[|\]\])/, '')
                       # removes styles
                       # eg. %{color:red}Triggers% => Triggers
                       toc_item.gsub! %r[%\{[^\}]*\}([^%]+)%], '\\1'
                       # replaces non word caracters by dashes
                       anchor = toc_item.gsub(%r{[^\w\s\-]}, '').gsub(%r{\s+(\-+\s*)?}, '-')
                       unless anchor.blank?
                         if tag =~ /^h(\d)$/
                           @toc << [$1.to_i, anchor, toc_item]
                         end
                         atts << " id=\"#{anchor}\""
                         content = content + "<a href=\"##{anchor}\" class=\"wiki-anchor\">&para;</a>"
                       end
                       textile_p(tag, atts, cite, content)
                     end
                     alias :textile_h1 :textile_p_withtoc
                     alias :textile_h2 :textile_p_withtoc
                     alias :textile_h3 :textile_p_withtoc
                     def inline_toc(text)
                       text.gsub!(/<p>\{\{([<>]?)toc\}\}<\/p>/i) do
                         div_class = 'toc'
                         div_class << ' right' if $1 == '>'
                         div_class << ' left' if $1 == '<'
                         out = "<ul class=\"#{div_class}\">"
                         @toc.each do |heading|
                           level, anchor, toc_item = heading
                           out << "<li class=\"heading#{level}\"><a href=\"##{anchor}\">#{toc_item}</a></li>\n"
                         end
                         out << '</ul>'
                         out
                       end
                     end
                     MACROS_RE = /
                                   (!)?                        # escaping
                                   (
                                   \{\{                        # opening tag
                                   ([\w]+)                     # macro name
                                   (\(([^\}]*)\))?             # optional arguments
                                   \}\}                        # closing tag
                                   )
                                 /x unless const_defined?(:MACROS_RE)
                     def inline_macros(text)
                       text.gsub!(MACROS_RE) do
                         esc, all, macro = $1, $2, $3.downcase
                         args = ($5 || '').split(',').each(&:strip)
                         if esc.nil?
                           begin
                             @macros_runner.call(macro, args)
                           rescue => e
                             "<div class=\"flash error\">Error executing the <strong>#{macro}</strong> macro (#{e})</div>"
                           end || all
                         else
                           all
                         end
                       end
                     end
                     AUTO_LINK_RE = %r{
                                     (                          # leading text
                                       <\w+.*?>|                # leading HTML tag, or
                                       [^=<>!:'"/]|             # leading punctuation, or
                                       ^                        # beginning of line
                                     )
                                     (
                                       (?:https?://)|           # protocol spec, or
                                       (?:s?ftps?://)|
                                       (?:www\.)                # www.*
                                     )
                                     (
                                       (\S+?)                   # url
                                       (\/)?                    # slash
                                     )
                                     ([^\w\=\/;\(\)]*?)               # post
                                     (?=<|\s|$)
                                    }x unless const_defined?(:AUTO_LINK_RE)
                     # Turns all urls into clickable links (code from Rails).
                     def inline_auto_link(text)
                       text.gsub!(AUTO_LINK_RE) do
                         all, leading, proto, url, post = $&, $1, $2, $3, $6
                         if leading =~ /<a\s/i || leading =~ /![<>=]?/
                           # don't replace URL's that are already linked
                           # and URL's prefixed with ! !> !< != (textile images)
                           all
                         else
                           # Idea below : an URL with unbalanced parethesis and
                           # ending by ')' is put into external parenthesis
                           if ( url[-1]==?) and ((url.count("(") - url.count(")")) < 0 ) )
                             url=url[0..-2] # discard closing parenth from url
                             post = ")"+post # add closing parenth to post
                           end
                           %(#{leading}<a class="external" href="#{proto=="www."?"http://www.":proto}#{url}">#{proto + url}</a>#{post})
                         end
                       end
                     end
                     # Turns all email addresses into clickable links (code from Rails).
                     def inline_auto_mailto(text)
                       text.gsub!(/([\w\.!#\$%\-+.]+@[A-Za-z0-9\-]+(\.[A-Za-z0-9\-]+)+)/) do
                         mail = $1
                         if text.match(/<a\b[^>]*>(.*)(#{Regexp.escape(mail)})(.*)<\/a>/)
                           mail
                         else
                           %{<a href="mailto:#{mail}" class="email">#{mail}</a>}
                         end
                       end
                     end
                   end
                 end
               end
             end

test/unit/helpers/application_helper_test.rb +2 -1

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.dirname(__FILE__) + '/../../test_helper'
             class ApplicationHelperTest < HelperTestCase
               include ApplicationHelper
               include ActionView::Helpers::TextHelper
               fixtures :projects, :roles, :enabled_modules, :users,
                                   :repositories, :changesets,
                                   :trackers, :issue_statuses, :issues, :versions, :documents,
                                   :wikis, :wiki_pages, :wiki_contents,
                                   :boards, :messages,
                                   :attachments
               def setup
                 super
               end
               def test_auto_links
                 to_test = {
                   'http://foo.bar' => '<a class="external" href="http://foo.bar">http://foo.bar</a>',
                   'http://foo.bar/~user' => '<a class="external" href="http://foo.bar/~user">http://foo.bar/~user</a>',
                   'http://foo.bar.' => '<a class="external" href="http://foo.bar">http://foo.bar</a>.',
                   'https://foo.bar.' => '<a class="external" href="https://foo.bar">https://foo.bar</a>.',
                   'This is a link: http://foo.bar.' => 'This is a link: <a class="external" href="http://foo.bar">http://foo.bar</a>.',
                   'A link (eg. http://foo.bar).' => 'A link (eg. <a class="external" href="http://foo.bar">http://foo.bar</a>).',
                   'http://foo.bar/foo.bar#foo.bar.' => '<a class="external" href="http://foo.bar/foo.bar#foo.bar">http://foo.bar/foo.bar#foo.bar</a>.',
                   'http://www.foo.bar/Test_(foobar)' => '<a class="external" href="http://www.foo.bar/Test_(foobar)">http://www.foo.bar/Test_(foobar)</a>',
                   '(see inline link : http://www.foo.bar/Test_(foobar))' => '(see inline link : <a class="external" href="http://www.foo.bar/Test_(foobar)">http://www.foo.bar/Test_(foobar)</a>)',
                   '(see inline link : http://www.foo.bar/Test)' => '(see inline link : <a class="external" href="http://www.foo.bar/Test">http://www.foo.bar/Test</a>)',
                   '(see inline link : http://www.foo.bar/Test).' => '(see inline link : <a class="external" href="http://www.foo.bar/Test">http://www.foo.bar/Test</a>).',
                   '(see "inline link":http://www.foo.bar/Test_(foobar))' => '(see <a href="http://www.foo.bar/Test_(foobar)" class="external">inline link</a>)',
                   '(see "inline link":http://www.foo.bar/Test)' => '(see <a href="http://www.foo.bar/Test" class="external">inline link</a>)',
                   '(see "inline link":http://www.foo.bar/Test).' => '(see <a href="http://www.foo.bar/Test" class="external">inline link</a>).',
                   'www.foo.bar' => '<a class="external" href="http://www.foo.bar">www.foo.bar</a>',
                   'http://foo.bar/page?p=1&t=z&s=' => '<a class="external" href="http://foo.bar/page?p=1&#38;t=z&#38;s=">http://foo.bar/page?p=1&#38;t=z&#38;s=</a>',
                   'http://foo.bar/page#125' => '<a class="external" href="http://foo.bar/page#125">http://foo.bar/page#125</a>',
                   'http://foo@www.bar.com' => '<a class="external" href="http://foo@www.bar.com">http://foo@www.bar.com</a>',
                   'http://foo:bar@www.bar.com' => '<a class="external" href="http://foo:bar@www.bar.com">http://foo:bar@www.bar.com</a>',
                   'ftp://foo.bar' => '<a class="external" href="ftp://foo.bar">ftp://foo.bar</a>',
                   'ftps://foo.bar' => '<a class="external" href="ftps://foo.bar">ftps://foo.bar</a>',
                   'sftp://foo.bar' => '<a class="external" href="sftp://foo.bar">sftp://foo.bar</a>',
                 }
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
               end
               def test_auto_mailto
                 assert_equal '<p><a href="mailto:test@foo.bar" class="email">test@foo.bar</a></p>',
                   textilizable('test@foo.bar')
               end
               def test_inline_images
                 to_test = {
                   '!http://foo.bar/image.jpg!' => '<img src="http://foo.bar/image.jpg" alt="" />',
                   'floating !>http://foo.bar/image.jpg!' => 'floating <div style="float:right"><img src="http://foo.bar/image.jpg" alt="" /></div>',
                   'with class !(some-class)http://foo.bar/image.jpg!' => 'with class <img src="http://foo.bar/image.jpg" class="some-class" alt="" />',
-                  'with style !{width:100px;height100px}http://foo.bar/image.jpg!' => 'with style <img src="http://foo.bar/image.jpg" style="width:100px;height100px;" alt="" />',
+                  # inline styles should be stripped
+                  'with style !{width:100px;height100px}http://foo.bar/image.jpg!' => 'with style <img src="http://foo.bar/image.jpg" alt="" />',
                   'with title !http://foo.bar/image.jpg(This is a title)!' => 'with title <img src="http://foo.bar/image.jpg" title="This is a title" alt="This is a title" />',
                   'with title !http://foo.bar/image.jpg(This is a double-quoted "title")!' => 'with title <img src="http://foo.bar/image.jpg" title="This is a double-quoted &quot;title&quot;" alt="This is a double-quoted &quot;title&quot;" />',
                 }
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
               end
               def test_acronyms
                 to_test = {
                   'this is an acronym: GPL(General Public License)' => 'this is an acronym: <acronym title="General Public License">GPL</acronym>',
                   'GPL(This is a double-quoted "title")' => '<acronym title="This is a double-quoted &quot;title&quot;">GPL</acronym>',
                 }
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
               end
               def test_attached_images
                 to_test = {
                   'Inline image: !logo.gif!' => 'Inline image: <img src="/attachments/download/3" title="This is a logo" alt="This is a logo" />',
                   'Inline image: !logo.GIF!' => 'Inline image: <img src="/attachments/download/3" title="This is a logo" alt="This is a logo" />'
                 }
                 attachments = Attachment.find(:all)
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text, :attachments => attachments) }
               end
               def test_textile_external_links
                 to_test = {
                   'This is a "link":http://foo.bar' => 'This is a <a href="http://foo.bar" class="external">link</a>',
                   'This is an intern "link":/foo/bar' => 'This is an intern <a href="/foo/bar">link</a>',
                   '"link (Link title)":http://foo.bar' => '<a href="http://foo.bar" title="Link title" class="external">link</a>',
                   '"link (Link title with "double-quotes")":http://foo.bar' => '<a href="http://foo.bar" title="Link title with &quot;double-quotes&quot;" class="external">link</a>',
                   "This is not a \"Link\":\n\nAnother paragraph" => "This is not a \"Link\":</p>\n\n\n\t<p>Another paragraph",
                   # no multiline link text
                   "This is a double quote \"on the first line\nand another on a second line\":test" => "This is a double quote \"on the first line<br />\nand another on a second line\":test"
                 }
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
               end
               def test_redmine_links
                 issue_link = link_to('#3', {:controller => 'issues', :action => 'show', :id => 3},
                                            :class => 'issue', :title => 'Error 281 when updating a recipe (New)')
                 changeset_link = link_to('r1', {:controller => 'repositories', :action => 'revision', :id => 'ecookbook', :rev => 1},
                                                :class => 'changeset', :title => 'My very first commit')
                 document_link = link_to('Test document', {:controller => 'documents', :action => 'show', :id => 1},
                                                          :class => 'document')
                 version_link = link_to('1.0', {:controller => 'versions', :action => 'show', :id => 2},
                                               :class => 'version')
                 message_url = {:controller => 'messages', :action => 'show', :board_id => 1, :id => 4}
                 source_url = {:controller => 'repositories', :action => 'entry', :id => 'ecookbook', :path => ['some', 'file']}
                 source_url_with_ext = {:controller => 'repositories', :action => 'entry', :id => 'ecookbook', :path => ['some', 'file.ext']}
                 to_test = {
                   # tickets
                   '#3, #3 and #3.'              => "#{issue_link}, #{issue_link} and #{issue_link}.",
                   # changesets
                   'r1'                          => changeset_link,
                   # documents
                   'document#1'                  => document_link,
                   'document:"Test document"'    => document_link,
                   # versions
                   'version#2'                   => version_link,
                   'version:1.0'                 => version_link,
                   'version:"1.0"'               => version_link,
                   # source
                   'source:/some/file'           => link_to('source:/some/file', source_url, :class => 'source'),
                   'source:/some/file.'          => link_to('source:/some/file', source_url, :class => 'source') + ".",
                   'source:/some/file.ext.'      => link_to('source:/some/file.ext', source_url_with_ext, :class => 'source') + ".",
                   'source:/some/file. '         => link_to('source:/some/file', source_url, :class => 'source') + ".",
                   'source:/some/file.ext. '     => link_to('source:/some/file.ext', source_url_with_ext, :class => 'source') + ".",
                   'source:/some/file, '         => link_to('source:/some/file', source_url, :class => 'source') + ",",
                   'source:/some/file@52'        => link_to('source:/some/file@52', source_url.merge(:rev => 52), :class => 'source'),
                   'source:/some/file.ext@52'    => link_to('source:/some/file.ext@52', source_url_with_ext.merge(:rev => 52), :class => 'source'),
                   'source:/some/file#L110'      => link_to('source:/some/file#L110', source_url.merge(:anchor => 'L110'), :class => 'source'),
                   'source:/some/file.ext#L110'  => link_to('source:/some/file.ext#L110', source_url_with_ext.merge(:anchor => 'L110'), :class => 'source'),
                   'source:/some/file@52#L110'   => link_to('source:/some/file@52#L110', source_url.merge(:rev => 52, :anchor => 'L110'), :class => 'source'),
                   'export:/some/file'           => link_to('export:/some/file', source_url.merge(:format => 'raw'), :class => 'source download'),
                   # message
                   'message#4'                   => link_to('Post 2', message_url, :class => 'message'),
                   'message#5'                   => link_to('RE: post 2', message_url.merge(:anchor => 'message-5'), :class => 'message'),
                   # escaping
                   '!#3.'                        => '#3.',
                   '!r1'                         => 'r1',
                   '!document#1'                 => 'document#1',
                   '!document:"Test document"'   => 'document:"Test document"',
                   '!version#2'                  => 'version#2',
                   '!version:1.0'                => 'version:1.0',
                   '!version:"1.0"'              => 'version:"1.0"',
                   '!source:/some/file'          => 'source:/some/file',
                   # invalid expressions
                   'source:'                     => 'source:',
                   # url hash
                   "http://foo.bar/FAQ#3"       => '<a class="external" href="http://foo.bar/FAQ#3">http://foo.bar/FAQ#3</a>',
                 }
                 @project = Project.find(1)
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
               end
               def test_wiki_links
                 to_test = {
                   '[[CookBook documentation]]' => '<a href="/wiki/ecookbook/CookBook_documentation" class="wiki-page">CookBook documentation</a>',
                   '[[Another page|Page]]' => '<a href="/wiki/ecookbook/Another_page" class="wiki-page">Page</a>',
                   # link with anchor
                   '[[CookBook documentation#One-section]]' => '<a href="/wiki/ecookbook/CookBook_documentation#One-section" class="wiki-page">CookBook documentation</a>',
                   '[[Another page#anchor|Page]]' => '<a href="/wiki/ecookbook/Another_page#anchor" class="wiki-page">Page</a>',
                   # page that doesn't exist
                   '[[Unknown page]]' => '<a href="/wiki/ecookbook/Unknown_page" class="wiki-page new">Unknown page</a>',
                   '[[Unknown page|404]]' => '<a href="/wiki/ecookbook/Unknown_page" class="wiki-page new">404</a>',
                   # link to another project wiki
                   '[[onlinestore:]]' => '<a href="/wiki/onlinestore/" class="wiki-page">onlinestore</a>',
                   '[[onlinestore:|Wiki]]' => '<a href="/wiki/onlinestore/" class="wiki-page">Wiki</a>',
                   '[[onlinestore:Start page]]' => '<a href="/wiki/onlinestore/Start_page" class="wiki-page">Start page</a>',
                   '[[onlinestore:Start page|Text]]' => '<a href="/wiki/onlinestore/Start_page" class="wiki-page">Text</a>',
                   '[[onlinestore:Unknown page]]' => '<a href="/wiki/onlinestore/Unknown_page" class="wiki-page new">Unknown page</a>',
                   # striked through link
                   '-[[Another page|Page]]-' => '<del><a href="/wiki/ecookbook/Another_page" class="wiki-page">Page</a></del>',
                   '-[[Another page|Page]] link-' => '<del><a href="/wiki/ecookbook/Another_page" class="wiki-page">Page</a> link</del>',
                   # escaping
                   '![[Another page|Page]]' => '[[Another page|Page]]',
                 }
                 @project = Project.find(1)
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
               end
               def test_html_tags
                 to_test = {
                   "<div>content</div>" => "<p>&lt;div&gt;content&lt;/div&gt;</p>",
                   "<div class=\"bold\">content</div>" => "<p>&lt;div class=\"bold\"&gt;content&lt;/div&gt;</p>",
                   "<script>some script;</script>" => "<p>&lt;script&gt;some script;&lt;/script&gt;</p>",
                   # do not escape pre/code tags
                   "<pre>\nline 1\nline2</pre>" => "<pre>\nline 1\nline2</pre>",
                   "<pre><code>\nline 1\nline2</code></pre>" => "<pre><code>\nline 1\nline2</code></pre>",
                   "<pre><div>content</div></pre>" => "<pre>&lt;div&gt;content&lt;/div&gt;</pre>",
                   "HTML comment: <!-- no comments -->" => "<p>HTML comment: &lt;!-- no comments --&gt;</p>",
                   "<!-- opening comment" => "<p>&lt;!-- opening comment</p>",
                   # remove attributes except class
                   "<pre class='foo'>some text</pre>" => "<pre class='foo'>some text</pre>",
                   "<pre onmouseover='alert(1)'>some text</pre>" => "<pre>some text</pre>",
                 }
                 to_test.each { |text, result| assert_equal result, textilizable(text) }
               end
               def test_allowed_html_tags
                 to_test = {
                   "<pre>preformatted text</pre>" => "<pre>preformatted text</pre>",
                   "<notextile>no *textile* formatting</notextile>" => "no *textile* formatting",
                   "<notextile>this is <tag>a tag</tag></notextile>" => "this is &lt;tag&gt;a tag&lt;/tag&gt;"
                 }
                 to_test.each { |text, result| assert_equal result, textilizable(text) }
               end
               def syntax_highlight
                 raw = <<-RAW
             <pre><code class="ruby">
             # Some ruby code here
             </pre></code>
             RAW
                 expected = <<-EXPECTED
             <pre><code class="ruby CodeRay"><span class="no">1</span> <span class="c"># Some ruby code here</span>
             </pre></code>
             EXPECTED
                 assert_equal expected.gsub(%r{[\r\n\t]}, ''), textilizable(raw).gsub(%r{[\r\n\t]}, '')
               end
               def test_wiki_links_in_tables
                 to_test = {"|[[Page|Link title]]|[[Other Page|Other title]]|\n|Cell 21|[[Last page]]|" =>
                              '<tr><td><a href="/wiki/ecookbook/Page" class="wiki-page new">Link title</a></td>' +
                              '<td><a href="/wiki/ecookbook/Other_Page" class="wiki-page new">Other title</a></td>' +
                              '</tr><tr><td>Cell 21</td><td><a href="/wiki/ecookbook/Last_page" class="wiki-page new">Last page</a></td></tr>'
                 }
                 @project = Project.find(1)
                 to_test.each { |text, result| assert_equal "<table>#{result}</table>", textilizable(text).gsub(/[\t\n]/, '') }
               end
               def test_text_formatting
                 to_test = {'*_+bold, italic and underline+_*' => '<strong><em><ins>bold, italic and underline</ins></em></strong>',
                            '(_text within parentheses_)' => '(<em>text within parentheses</em>)',
                            'a *Humane Web* Text Generator' => 'a <strong>Humane Web</strong> Text Generator',
                            'a H *umane* W *eb* T *ext* G *enerator*' => 'a H <strong>umane</strong> W <strong>eb</strong> T <strong>ext</strong> G <strong>enerator</strong>',
                            'a *H* umane *W* eb *T* ext *G* enerator' => 'a <strong>H</strong> umane <strong>W</strong> eb <strong>T</strong> ext <strong>G</strong> enerator',
                           }
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
               end
               def test_wiki_horizontal_rule
                 assert_equal '<hr />', textilizable('---')
                 assert_equal '<p>Dashes: ---</p>', textilizable('Dashes: ---')
               end
               def test_acronym
                 assert_equal '<p>This is an acronym: <acronym title="American Civil Liberties Union">ACLU</acronym>.</p>',
                              textilizable('This is an acronym: ACLU(American Civil Liberties Union).')
               end
               def test_footnotes
                 raw = <<-RAW
             This is some text[1].
             fn1. This is the foot note
             RAW
                 expected = <<-EXPECTED
             <p>This is some text<sup><a href=\"#fn1\">1</a></sup>.</p>
             <p id="fn1" class="footnote"><sup>1</sup> This is the foot note</p>
             EXPECTED
                 assert_equal expected.gsub(%r{[\r\n\t]}, ''), textilizable(raw).gsub(%r{[\r\n\t]}, '')
               end
               def test_table_of_content
                 raw = <<-RAW
             {{toc}}
             h1. Title
             Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Maecenas sed libero.
             h2. Subtitle
             Nullam commodo metus accumsan nulla. Curabitur lobortis dui id dolor.
             h2. Subtitle with %{color:red}red text%
             h1. Another title
             RAW
                 expected = '<ul class="toc">' +
                            '<li class="heading1"><a href="#Title">Title</a></li>' +
                            '<li class="heading2"><a href="#Subtitle">Subtitle</a></li>' +
                            '<li class="heading2"><a href="#Subtitle-with-red-text">Subtitle with red text</a></li>' +
                            '<li class="heading1"><a href="#Another-title">Another title</a></li>' +
                            '</ul>'
                 assert textilizable(raw).gsub("\n", "").include?(expected)
               end
               def test_blockquote
                 # orig raw text
                 raw = <<-RAW
             John said:
             > Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Maecenas sed libero.
             > Nullam commodo metus accumsan nulla. Curabitur lobortis dui id dolor.
             > * Donec odio lorem,
             > * sagittis ac,
             > * malesuada in,
             > * adipiscing eu, dolor.
             >
             > >Nulla varius pulvinar diam. Proin id arcu id lorem scelerisque condimentum. Proin vehicula turpis vitae lacus.
             > Proin a tellus. Nam vel neque.
             He's right.
             RAW
                 # expected html
                 expected = <<-EXPECTED
             <p>John said:</p>
             <blockquote>
             Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Maecenas sed libero.
             Nullam commodo metus accumsan nulla. Curabitur lobortis dui id dolor.
             <ul>
               <li>Donec odio lorem,</li>
               <li>sagittis ac,</li>
               <li>malesuada in,</li>
               <li>adipiscing eu, dolor.</li>
             </ul>
             <blockquote>
             <p>Nulla varius pulvinar diam. Proin id arcu id lorem scelerisque condimentum. Proin vehicula turpis vitae lacus.</p>
             </blockquote>
             <p>Proin a tellus. Nam vel neque.</p>
             </blockquote>
             <p>He's right.</p>
             EXPECTED
                 assert_equal expected.gsub(%r{\s+}, ''), textilizable(raw).gsub(%r{\s+}, '')
               end
               def test_table
                 raw = <<-RAW
             This is a table with empty cells:
             |cell11|cell12||
             |cell21||cell23|
             |cell31|cell32|cell33|
             RAW
                 expected = <<-EXPECTED
             <p>This is a table with empty cells:</p>
             <table>
               <tr><td>cell11</td><td>cell12</td><td></td></tr>
               <tr><td>cell21</td><td></td><td>cell23</td></tr>
               <tr><td>cell31</td><td>cell32</td><td>cell33</td></tr>
             </table>
             EXPECTED
                 assert_equal expected.gsub(%r{\s+}, ''), textilizable(raw).gsub(%r{\s+}, '')
               end
               def test_default_formatter
                 Setting.text_formatting = 'unknown'
                 text = 'a *link*: http://www.example.net/'
                 assert_equal '<p>a *link*: <a href="http://www.example.net/">http://www.example.net/</a></p>', textilizable(text)
                 Setting.text_formatting = 'textile'
               end
               def test_date_format_default
                 today = Date.today
                 Setting.date_format = ''
                 assert_equal l_date(today), format_date(today)
               end
               def test_date_format
                 today = Date.today
                 Setting.date_format = '%d %m %Y'
                 assert_equal today.strftime('%d %m %Y'), format_date(today)
               end
               def test_time_format_default
                 now = Time.now
                 Setting.date_format = ''
                 Setting.time_format = ''
                 assert_equal l_datetime(now), format_time(now)
                 assert_equal l_time(now), format_time(now, false)
               end
               def test_time_format
                 now = Time.now
                 Setting.date_format = '%d %m %Y'
                 Setting.time_format = '%H %M'
                 assert_equal now.strftime('%d %m %Y %H %M'), format_time(now)
                 assert_equal now.strftime('%H %M'), format_time(now, false)
               end
               def test_utc_time_format
                 now = Time.now.utc
                 Setting.date_format = '%d %m %Y'
                 Setting.time_format = '%H %M'
                 assert_equal Time.now.strftime('%d %m %Y %H %M'), format_time(now)
                 assert_equal Time.now.strftime('%H %M'), format_time(now, false)
               end
               def test_due_date_distance_in_words
                 to_test = { Date.today => 'Due in 0 days',
                             Date.today + 1 => 'Due in 1 day',
                             Date.today + 100 => 'Due in 100 days',
                             Date.today + 20000 => 'Due in 20000 days',
                             Date.today - 1 => '1 day late',
                             Date.today - 100 => '100 days late',
                             Date.today - 20000 => '20000 days late',
                            }
                 to_test.each do |date, expected|
                   assert_equal expected, due_date_distance_in_words(date)
                 end
               end
               def test_avatar
                 # turn on avatars
                 Setting.gravatar_enabled = '1'
                 assert avatar(User.find_by_mail('jsmith@somenet.foo')).include?(Digest::MD5.hexdigest('jsmith@somenet.foo'))
                 assert avatar('jsmith <jsmith@somenet.foo>').include?(Digest::MD5.hexdigest('jsmith@somenet.foo'))
                 assert_nil avatar('jsmith')
                 assert_nil avatar(nil)
                 # turn off avatars
                 Setting.gravatar_enabled = '0'
                 assert_nil avatar(User.find_by_mail('jsmith@somenet.foo'))
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages