##// END OF EJS Templates
Disable textile inline styles to prevent XSS attacks (#2377)....
Jean-Philippe Lang -
r2190:35f5e3683895
parent child
Show More
@@ -470,8 +470,7 class RedCloth3 < String
470 470 style << "vertical-align:#{ v_align( $& ) };" if text =~ A_VLGN
471 471 end
472 472
473 style << "#{ htmlesc $1 };" if not filter_styles and
474 text.sub!( /\{([^}]*)\}/, '' )
473 style << "#{ htmlesc $1 };" if text.sub!( /\{([^}]*)\}/, '' ) && !filter_styles
475 474
476 475 lang = $1 if
477 476 text.sub!( /\[([^)]+?)\]/, '' )
@@ -30,6 +30,7 module Redmine
30 30 super
31 31 self.hard_breaks=true
32 32 self.no_span_caps=true
33 self.filter_styles=true
33 34 end
34 35
35 36 def to_html(*rules, &block)
@@ -69,7 +69,8 class ApplicationHelperTest < HelperTestCase
69 69 '!http://foo.bar/image.jpg!' => '<img src="http://foo.bar/image.jpg" alt="" />',
70 70 'floating !>http://foo.bar/image.jpg!' => 'floating <div style="float:right"><img src="http://foo.bar/image.jpg" alt="" /></div>',
71 71 'with class !(some-class)http://foo.bar/image.jpg!' => 'with class <img src="http://foo.bar/image.jpg" class="some-class" alt="" />',
72 'with style !{width:100px;height100px}http://foo.bar/image.jpg!' => 'with style <img src="http://foo.bar/image.jpg" style="width:100px;height100px;" alt="" />',
72 # inline styles should be stripped
73 'with style !{width:100px;height100px}http://foo.bar/image.jpg!' => 'with style <img src="http://foo.bar/image.jpg" alt="" />',
73 74 'with title !http://foo.bar/image.jpg(This is a title)!' => 'with title <img src="http://foo.bar/image.jpg" title="This is a title" alt="This is a title" />',
74 75 'with title !http://foo.bar/image.jpg(This is a double-quoted "title")!' => 'with title <img src="http://foo.bar/image.jpg" title="This is a double-quoted &quot;title&quot;" alt="This is a double-quoted &quot;title&quot;" />',
75 76 }
General Comments 0
You need to be logged in to leave comments. Login now