jro_apps/redmine Commit - r2190:35f5e3683895

Disable textile inline styles to prevent XSS attacks (#2377)....

Jean-Philippe Lang -

r2190:35f5e3683895

parent child

Context file:

r2190:35f5e3683895

Collapse all files

lib/redcloth3.rb +1 -2

              #                                vim:ts=4:sw=4:
              # = RedCloth - Textile and Markdown Hybrid for Ruby
              #
              # Homepage::  http://whytheluckystiff.net/ruby/redcloth/
              # Author::    why the lucky stiff (http://whytheluckystiff.net/)
              # Copyright:: (cc) 2004 why the lucky stiff (and his puppet organizations.)
              # License::   BSD
              #
              # (see http://hobix.com/textile/ for a Textile Reference.)
              #
              # Based on (and also inspired by) both:
              #
              # PyTextile: http://diveintomark.org/projects/textile/textile.py.txt
              # Textism for PHP: http://www.textism.com/tools/textile/
              #
              #
              # = RedCloth
              #
              # RedCloth is a Ruby library for converting Textile and/or Markdown
              # into HTML.  You can use either format, intermingled or separately.
              # You can also extend RedCloth to honor your own custom text stylings.
              #
              # RedCloth users are encouraged to use Textile if they are generating
              # HTML and to use Markdown if others will be viewing the plain text.
              #
              # == What is Textile?
              #
              # Textile is a simple formatting style for text
              # documents, loosely based on some HTML conventions.
              #
              # == Sample Textile Text
              #
              #  h2. This is a title
              #
              #  h3. This is a subhead
              #
              #  This is a bit of paragraph.
              #
              #  bq. This is a blockquote.
              #
              # = Writing Textile
              #
              # A Textile document consists of paragraphs.  Paragraphs
              # can be specially formatted by adding a small instruction
              # to the beginning of the paragraph.
              #
              #  h[n].   Header of size [n].
              #  bq.     Blockquote.
              #  #       Numeric list.
              #  *       Bulleted list.
              #
              # == Quick Phrase Modifiers
              #
              # Quick phrase modifiers are also included, to allow formatting
              # of small portions of text within a paragraph.
              #
              #  \_emphasis\_
              #  \_\_italicized\_\_
              #  \*strong\*
              #  \*\*bold\*\*
              #  ??citation??
              #  -deleted text-
              #  +inserted text+
              #  ^superscript^
              #  ~subscript~
              #  @code@
              #  %(classname)span%
              #
              #  ==notextile== (leave text alone)
              #
              # == Links
              #
              # To make a hypertext link, put the link text in "quotation
              # marks" followed immediately by a colon and the URL of the link.
              #
              # Optional: text in (parentheses) following the link text,
              # but before the closing quotation mark, will become a Title
              # attribute for the link, visible as a tool tip when a cursor is above it.
              #
              # Example:
              #
              #  "This is a link (This is a title) ":http://www.textism.com
              #
              # Will become:
              #
              #  <a href="http://www.textism.com" title="This is a title">This is a link</a>
              #
              # == Images
              #
              # To insert an image, put the URL for the image inside exclamation marks.
              #
              # Optional: text that immediately follows the URL in (parentheses) will
              # be used as the Alt text for the image. Images on the web should always
              # have descriptive Alt text for the benefit of readers using non-graphical
              # browsers.
              #
              # Optional: place a colon followed by a URL immediately after the
              # closing ! to make the image into a link.
              #
              # Example:
              #
              #  !http://www.textism.com/common/textist.gif(Textist)!
              #
              # Will become:
              #
              #  <img src="http://www.textism.com/common/textist.gif" alt="Textist" />
              #
              # With a link:
              #
              #  !/common/textist.gif(Textist)!:http://textism.com
              #
              # Will become:
              #
              #  <a href="http://textism.com"><img src="/common/textist.gif" alt="Textist" /></a>
              #
              # == Defining Acronyms
              #
              # HTML allows authors to define acronyms via the tag. The definition appears as a
              # tool tip when a cursor hovers over the acronym. A crucial aid to clear writing,
              # this should be used at least once for each acronym in documents where they appear.
              #
              # To quickly define an acronym in Textile, place the full text in (parentheses)
              # immediately following the acronym.
              #
              # Example:
              #
              #  ACLU(American Civil Liberties Union)
              #
              # Will become:
              #
              #  <acronym title="American Civil Liberties Union">ACLU</acronym>
              #
              # == Adding Tables
              #
              # In Textile, simple tables can be added by seperating each column by
              # a pipe.
              #
              #     |a|simple|table|row|
              #     |And|Another|table|row|
              #
              # Attributes are defined by style definitions in parentheses.
              #
              #     table(border:1px solid black).
              #     (background:#ddd;color:red). |{}| | | |
              #
              # == Using RedCloth
              #
              # RedCloth is simply an extension of the String class, which can handle
              # Textile formatting.  Use it like a String and output HTML with its
              # RedCloth#to_html method.
              #
              #  doc = RedCloth.new "
              #
              #  h2. Test document
              #
              #  Just a simple test."
              #
              #  puts doc.to_html
              #
              # By default, RedCloth uses both Textile and Markdown formatting, with
              # Textile formatting taking precedence.  If you want to turn off Markdown
              # formatting, to boost speed and limit the processor:
              #
              #  class RedCloth::Textile.new( str )
              class RedCloth3 < String
                  VERSION = '3.0.4'
                  DEFAULT_RULES = [:textile, :markdown]
                  #
                  # Two accessor for setting security restrictions.
                  #
                  # This is a nice thing if you're using RedCloth for
                  # formatting in public places (e.g. Wikis) where you
                  # don't want users to abuse HTML for bad things.
                  #
                  # If +:filter_html+ is set, HTML which wasn't
                  # created by the Textile processor will be escaped.
                  #
                  # If +:filter_styles+ is set, it will also disable
                  # the style markup specifier. ('{color: red}')
                  #
                  attr_accessor :filter_html, :filter_styles
                  #
                  # Accessor for toggling hard breaks.
                  #
                  # If +:hard_breaks+ is set, single newlines will
                  # be converted to HTML break tags.  This is the
                  # default behavior for traditional RedCloth.
                  #
                  attr_accessor :hard_breaks
                  # Accessor for toggling lite mode.
                  #
                  # In lite mode, block-level rules are ignored.  This means
                  # that tables, paragraphs, lists, and such aren't available.
                  # Only the inline markup for bold, italics, entities and so on.
                  #
                  #   r = RedCloth.new( "And then? She *fell*!", [:lite_mode] )
                  #   r.to_html
                  #   #=> "And then? She <strong>fell</strong>!"
                  #
                  attr_accessor :lite_mode
                  #
                  # Accessor for toggling span caps.
                  #
                  # Textile places `span' tags around capitalized
                  # words by default, but this wreaks havoc on Wikis.
                  # If +:no_span_caps+ is set, this will be
                  # suppressed.
                  #
                  attr_accessor :no_span_caps
                  #
                  # Establishes the markup predence.  Available rules include:
                  #
                  # == Textile Rules
                  #
                  # The following textile rules can be set individually.  Or add the complete
                  # set of rules with the single :textile rule, which supplies the rule set in
                  # the following precedence:
                  #
                  # refs_textile::          Textile references (i.e. [hobix]http://hobix.com/)
                  # block_textile_table::   Textile table block structures
                  # block_textile_lists::   Textile list structures
                  # block_textile_prefix::  Textile blocks with prefixes (i.e. bq., h2., etc.)
                  # inline_textile_image::  Textile inline images
                  # inline_textile_link::   Textile inline links
                  # inline_textile_span::   Textile inline spans
                  # glyphs_textile:: Textile entities (such as em-dashes and smart quotes)
                  #
                  # == Markdown
                  #
                  # refs_markdown::         Markdown references (for example: [hobix]: http://hobix.com/)
                  # block_markdown_setext:: Markdown setext headers
                  # block_markdown_atx::    Markdown atx headers
                  # block_markdown_rule::   Markdown horizontal rules
                  # block_markdown_bq::     Markdown blockquotes
                  # block_markdown_lists::  Markdown lists
                  # inline_markdown_link::  Markdown links
                  attr_accessor :rules
                  # Returns a new RedCloth object, based on _string_ and
                  # enforcing all the included _restrictions_.
                  #
                  #   r = RedCloth.new( "h1. A <b>bold</b> man", [:filter_html] )
                  #   r.to_html
                  #     #=>"<h1>A &lt;b&gt;bold&lt;/b&gt; man</h1>"
                  #
                  def initialize( string, restrictions = [] )
                      restrictions.each { |r| method( "#{ r }=" ).call( true ) }
                      super( string )
                  end
                  #
                  # Generates HTML from the Textile contents.
                  #
                  #   r = RedCloth.new( "And then? She *fell*!" )
                  #   r.to_html( true )
                  #     #=>"And then? She <strong>fell</strong>!"
                  #
                  def to_html( *rules )
                      rules = DEFAULT_RULES if rules.empty?
                      # make our working copy
                      text = self.dup
                      @urlrefs = {}
                      @shelf = []
                      textile_rules = [:refs_textile, :block_textile_table, :block_textile_lists,
                                       :block_textile_prefix, :inline_textile_image, :inline_textile_link,
                                       :inline_textile_code, :inline_textile_span, :glyphs_textile]
                      markdown_rules = [:refs_markdown, :block_markdown_setext, :block_markdown_atx, :block_markdown_rule,
                                        :block_markdown_bq, :block_markdown_lists,
                                        :inline_markdown_reflink, :inline_markdown_link]
                      @rules = rules.collect do |rule|
                          case rule
                          when :markdown
                              markdown_rules
                          when :textile
                              textile_rules
                          else
                              rule
                          end
                      end.flatten
                      # standard clean up
                      incoming_entities text
                      clean_white_space text
                      # start processor
                      @pre_list = []
                      rip_offtags text
                      no_textile text
                      escape_html_tags text
                      hard_break text
                      unless @lite_mode
                          refs text
                          # need to do this before text is split by #blocks
                          block_textile_quotes text
                          blocks text
                      end
                      inline text
                      smooth_offtags text
                      retrieve text
                      text.gsub!( /<\/?notextile>/, '' )
                      text.gsub!( /x%x%/, '&#38;' )
                      clean_html text if filter_html
                      text.strip!
                      text
                  end
                  #######
                  private
                  #######
                  #
                  # Mapping of 8-bit ASCII codes to HTML numerical entity equivalents.
                  # (from PyTextile)
                  #
                  TEXTILE_TAGS =
                      [[128, 8364], [129, 0], [130, 8218], [131, 402], [132, 8222], [133, 8230],
                       [134, 8224], [135, 8225], [136, 710], [137, 8240], [138, 352], [139, 8249],
                       [140, 338], [141, 0], [142, 0], [143, 0], [144, 0], [145, 8216], [146, 8217],
                       [147, 8220], [148, 8221], [149, 8226], [150, 8211], [151, 8212], [152, 732],
                       [153, 8482], [154, 353], [155, 8250], [156, 339], [157, 0], [158, 0], [159, 376]].
                      collect! do |a, b|
                          [a.chr, ( b.zero? and "" or "&#{ b };" )]
                      end
                  #
                  # Regular expressions to convert to HTML.
                  #
                  A_HLGN = /(?:(?:<>|<|>|\=|[()]+)+)/
                  A_VLGN = /[\-^~]/
                  C_CLAS = '(?:\([^)]+\))'
                  C_LNGE = '(?:\[[^\[\]]+\])'
                  C_STYL = '(?:\{[^}]+\})'
                  S_CSPN = '(?:\\\\\d+)'
                  S_RSPN = '(?:/\d+)'
                  A = "(?:#{A_HLGN}?#{A_VLGN}?|#{A_VLGN}?#{A_HLGN}?)"
                  S = "(?:#{S_CSPN}?#{S_RSPN}|#{S_RSPN}?#{S_CSPN}?)"
                  C = "(?:#{C_CLAS}?#{C_STYL}?#{C_LNGE}?|#{C_STYL}?#{C_LNGE}?#{C_CLAS}?|#{C_LNGE}?#{C_STYL}?#{C_CLAS}?)"
                  # PUNCT = Regexp::quote( '!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~' )
                  PUNCT = Regexp::quote( '!"#$%&\'*+,-./:;=?@\\^_`|~' )
                  PUNCT_NOQ = Regexp::quote( '!"#$&\',./:;=?@\\`|' )
                  PUNCT_Q = Regexp::quote( '*-_+^~%' )
                  HYPERLINK = '(\S+?)([^\w\s/;=\?]*?)(?=\s|<|$)'
                  # Text markup tags, don't conflict with block tags
                  SIMPLE_HTML_TAGS = [
                      'tt', 'b', 'i', 'big', 'small', 'em', 'strong', 'dfn', 'code',
                      'samp', 'kbd', 'var', 'cite', 'abbr', 'acronym', 'a', 'img', 'br',
                      'br', 'map', 'q', 'sub', 'sup', 'span', 'bdo'
                  ]
                  QTAGS = [
                      ['**', 'b', :limit],
                      ['*', 'strong', :limit],
                      ['??', 'cite', :limit],
                      ['-', 'del', :limit],
                      ['__', 'i', :limit],
                      ['_', 'em', :limit],
                      ['%', 'span', :limit],
                      ['+', 'ins', :limit],
                      ['^', 'sup', :limit],
                      ['~', 'sub', :limit]
                  ]
                  QTAGS.collect! do |rc, ht, rtype|
                      rcq = Regexp::quote rc
                      re =
                          case rtype
                          when :limit
                              /(^|[>\s\(])
                              (#{rcq})
                              (#{C})
                              (?::(\S+?))?
                              (\w|[^\s\-].*?[^\s\-])
                              #{rcq}
                              (?=[[:punct:]]|\s|\)|$)/x
                          else
                              /(#{rcq})
                              (#{C})
                              (?::(\S+))?
                              (\w|[^\s\-].*?[^\s\-])
                              #{rcq}/xm
                          end
                      [rc, ht, re, rtype]
                  end
                  # Elements to handle
                  GLYPHS = [
                  #   [ /([^\s\[{(>])?\'([dmst]\b|ll\b|ve\b|\s|:|$)/, '\1&#8217;\2' ], # single closing
                  #   [ /([^\s\[{(>#{PUNCT_Q}][#{PUNCT_Q}]*)\'/, '\1&#8217;' ], # single closing
                  #   [ /\'(?=[#{PUNCT_Q}]*(s\b|[\s#{PUNCT_NOQ}]))/, '&#8217;' ], # single closing
                  #   [ /\'/, '&#8216;' ], # single opening
                  #   [ /</, '&lt;' ], # less-than
                  #   [ />/, '&gt;' ], # greater-than
                  #   [ /([^\s\[{(])?"(\s|:|$)/, '\1&#8221;\2' ], # double closing
                  #   [ /([^\s\[{(>#{PUNCT_Q}][#{PUNCT_Q}]*)"/, '\1&#8221;' ], # double closing
                  #   [ /"(?=[#{PUNCT_Q}]*[\s#{PUNCT_NOQ}])/, '&#8221;' ], # double closing
                  #   [ /"/, '&#8220;' ], # double opening
                  #   [ /\b( )?\.{3}/, '\1&#8230;' ], # ellipsis
                  #   [ /\b([A-Z][A-Z0-9]{2,})\b(?:[(]([^)]*)[)])/, '<acronym title="\2">\1</acronym>' ], # 3+ uppercase acronym
                  #   [ /(^|[^"][>\s])([A-Z][A-Z0-9 ]+[A-Z0-9])([^<A-Za-z0-9]|$)/, '\1<span class="caps">\2</span>\3', :no_span_caps ], # 3+ uppercase caps
                  #   [ /(\.\s)?\s?--\s?/, '\1&#8212;' ], # em dash
                  #   [ /\s->\s/, ' &rarr; ' ], # right arrow
                  #   [ /\s-\s/, ' &#8211; ' ], # en dash
                  #   [ /(\d+) ?x ?(\d+)/, '\1&#215;\2' ], # dimension sign
                  #   [ /\b ?[(\[]TM[\])]/i, '&#8482;' ], # trademark
                  #   [ /\b ?[(\[]R[\])]/i, '&#174;' ], # registered
                  #   [ /\b ?[(\[]C[\])]/i, '&#169;' ] # copyright
                  ]
                  H_ALGN_VALS = {
                      '<' => 'left',
                      '=' => 'center',
                      '>' => 'right',
                      '<>' => 'justify'
                  }
                  V_ALGN_VALS = {
                      '^' => 'top',
                      '-' => 'middle',
                      '~' => 'bottom'
                  }
                  #
                  # Flexible HTML escaping
                  #
                  def htmlesc( str, mode=:Quotes )
                    if str
                      str.gsub!( '&', '&amp;' )
                      str.gsub!( '"', '&quot;' ) if mode != :NoQuotes
                      str.gsub!( "'", '&#039;' ) if mode == :Quotes
                      str.gsub!( '<', '&lt;')
                      str.gsub!( '>', '&gt;')
                    end
                    str
                  end
                  # Search and replace for Textile glyphs (quotes, dashes, other symbols)
                  def pgl( text )
                      #GLYPHS.each do |re, resub, tog|
                      #    next if tog and method( tog ).call
                      #    text.gsub! re, resub
                      #end
                      text.gsub!(/\b([A-Z][A-Z0-9]{2,})\b(?:[(]([^)]*)[)])/) do |m|
                        "<acronym title=\"#{htmlesc $2}\">#{$1}</acronym>"
                      end
                  end
                  # Parses Textile attribute lists and builds an HTML attribute string
                  def pba( text_in, element = "" )
                      return '' unless text_in
                      style = []
                      text = text_in.dup
                      if element == 'td'
                          colspan = $1 if text =~ /\\(\d+)/
                          rowspan = $1 if text =~ /\/(\d+)/
                          style << "vertical-align:#{ v_align( $& ) };" if text =~ A_VLGN
                      end
-                     style << "#{ htmlesc $1 };" if not filter_styles and
-                         text.sub!( /\{([^}]*)\}/, '' )
+                     style << "#{ htmlesc $1 };" if text.sub!( /\{([^}]*)\}/, '' ) && !filter_styles
                      lang = $1 if
                          text.sub!( /\[([^)]+?)\]/, '' )
                      cls = $1 if
                          text.sub!( /\(([^()]+?)\)/, '' )
                      style << "padding-left:#{ $1.length }em;" if
                          text.sub!( /([(]+)/, '' )
                      style << "padding-right:#{ $1.length }em;" if text.sub!( /([)]+)/, '' )
                      style << "text-align:#{ h_align( $& ) };" if text =~ A_HLGN
                      cls, id = $1, $2 if cls =~ /^(.*?)#(.*)$/
                      atts = ''
                      atts << " style=\"#{ style.join }\"" unless style.empty?
                      atts << " class=\"#{ cls }\"" unless cls.to_s.empty?
                      atts << " lang=\"#{ lang }\"" if lang
                      atts << " id=\"#{ id }\"" if id
                      atts << " colspan=\"#{ colspan }\"" if colspan
                      atts << " rowspan=\"#{ rowspan }\"" if rowspan
                      atts
                  end
                  TABLE_RE = /^(?:table(_?#{S}#{A}#{C})\. ?\n)?^(#{A}#{C}\.? ?\|.*?\|)(\n\n|\Z)/m
                  # Parses a Textile table block, building HTML from the result.
                  def block_textile_table( text )
                      text.gsub!( TABLE_RE ) do |matches|
                          tatts, fullrow = $~[1..2]
                          tatts = pba( tatts, 'table' )
                          tatts = shelve( tatts ) if tatts
                          rows = []
                          fullrow.each_line do |row|
                              ratts, row = pba( $1, 'tr' ), $2 if row =~ /^(#{A}#{C}\. )(.*)/m
                              cells = []
                              row.split( /(\|)(?![^\[\|]*\]\])/ )[1..-2].each do |cell|
                                  next if cell == '|'
                                  ctyp = 'd'
                                  ctyp = 'h' if cell =~ /^_/
                                  catts = ''
                                  catts, cell = pba( $1, 'td' ), $2 if cell =~ /^(_?#{S}#{A}#{C}\. ?)(.*)/
                                  catts = shelve( catts ) if catts
                                  cells << "\t\t\t<t#{ ctyp }#{ catts }>#{ cell }</t#{ ctyp }>"
                              end
                              ratts = shelve( ratts ) if ratts
                              rows << "\t\t<tr#{ ratts }>\n#{ cells.join( "\n" ) }\n\t\t</tr>"
                          end
                          "\t<table#{ tatts }>\n#{ rows.join( "\n" ) }\n\t</table>\n\n"
                      end
                  end
                  LISTS_RE = /^([#*]+?#{C} .*?)$(?![^#*])/m
                  LISTS_CONTENT_RE = /^([#*]+)(#{A}#{C}) (.*)$/m
                  # Parses Textile lists and generates HTML
                  def block_textile_lists( text )
                      text.gsub!( LISTS_RE ) do |match|
                          lines = match.split( /\n/ )
                          last_line = -1
                          depth = []
                          lines.each_with_index do |line, line_id|
                              if line =~ LISTS_CONTENT_RE
                                  tl,atts,content = $~[1..3]
                                  if depth.last
                                      if depth.last.length > tl.length
                                          (depth.length - 1).downto(0) do |i|
                                              break if depth[i].length == tl.length
                                              lines[line_id - 1] << "</li>\n\t</#{ lT( depth[i] ) }l>\n\t"
                                              depth.pop
                                          end
                                      end
                                      if depth.last and depth.last.length == tl.length
                                          lines[line_id - 1] << '</li>'
                                      end
                                  end
                                  unless depth.last == tl
                                      depth << tl
                                      atts = pba( atts )
                                      atts = shelve( atts ) if atts
                                      lines[line_id] = "\t<#{ lT(tl) }l#{ atts }>\n\t<li>#{ content }"
                                  else
                                      lines[line_id] = "\t\t<li>#{ content }"
                                  end
                                  last_line = line_id
                              else
                                  last_line = line_id
                              end
                              if line_id - last_line > 1 or line_id == lines.length - 1
                                  depth.delete_if do |v|
                                      lines[last_line] << "</li>\n\t</#{ lT( v ) }l>"
                                  end
                              end
                          end
                          lines.join( "\n" )
                      end
                  end
                  QUOTES_RE = /(^>+([^\n]*?)\n?)+/m
                  QUOTES_CONTENT_RE = /^([> ]+)(.*)$/m
                  def block_textile_quotes( text )
                    text.gsub!( QUOTES_RE ) do |match|
                      lines = match.split( /\n/ )
                      quotes = ''
                      indent = 0
                      lines.each do |line|
                        line =~ QUOTES_CONTENT_RE
                        bq,content = $1, $2
                        l = bq.count('>')
                        if l != indent
                          quotes << ("\n\n" + (l>indent ? '<blockquote>' * (l-indent) : '</blockquote>' * (indent-l)) + "\n\n")
                          indent = l
                        end
                        quotes << (content + "\n")
                      end
                      quotes << ("\n" + '</blockquote>' * indent + "\n\n")
                      quotes
                    end
                  end
                  CODE_RE = /(\W)
                      @
                      (?:\|(\w+?)\|)?
                      (.+?)
                      @
                      (?=\W)/x
                  def inline_textile_code( text )
                      text.gsub!( CODE_RE ) do |m|
                          before,lang,code,after = $~[1..4]
                          lang = " lang=\"#{ lang }\"" if lang
                          rip_offtags( "#{ before }<code#{ lang }>#{ code }</code>#{ after }" )
                      end
                  end
                  def lT( text )
                      text =~ /\#$/ ? 'o' : 'u'
                  end
                  def hard_break( text )
                      text.gsub!( /(.)\n(?!\Z| *([#*=]+(\s|$)|[{|]))/, "\\1<br />" ) if hard_breaks
                  end
                  BLOCKS_GROUP_RE = /\n{2,}(?! )/m
                  def blocks( text, deep_code = false )
                      text.replace( text.split( BLOCKS_GROUP_RE ).collect do |blk|
                          plain = blk !~ /\A[#*> ]/
                          # skip blocks that are complex HTML
                          if blk =~ /^<\/?(\w+).*>/ and not SIMPLE_HTML_TAGS.include? $1
                              blk
                          else
                              # search for indentation levels
                              blk.strip!
                              if blk.empty?
                                  blk
                              else
                                  code_blk = nil
                                  blk.gsub!( /((?:\n(?:\n^ +[^\n]*)+)+)/m ) do |iblk|
                                      flush_left iblk
                                      blocks iblk, plain
                                      iblk.gsub( /^(\S)/, "\t\\1" )
                                      if plain
                                          code_blk = iblk; ""
                                      else
                                          iblk
                                      end
                                  end
                                  block_applied = 0
                                  @rules.each do |rule_name|
                                      block_applied += 1 if ( rule_name.to_s.match /^block_/ and method( rule_name ).call( blk ) )
                                  end
                                  if block_applied.zero?
                                      if deep_code
                                          blk = "\t<pre><code>#{ blk }</code></pre>"
                                      else
                                          blk = "\t<p>#{ blk }</p>"
                                      end
                                  end
                                  # hard_break blk
                                  blk + "\n#{ code_blk }"
                              end
                          end
                      end.join( "\n\n" ) )
                  end
                  def textile_bq( tag, atts, cite, content )
                      cite, cite_title = check_refs( cite )
                      cite = " cite=\"#{ cite }\"" if cite
                      atts = shelve( atts ) if atts
                      "\t<blockquote#{ cite }>\n\t\t<p#{ atts }>#{ content }</p>\n\t</blockquote>"
                  end
                  def textile_p( tag, atts, cite, content )
                      atts = shelve( atts ) if atts
                      "\t<#{ tag }#{ atts }>#{ content }</#{ tag }>"
                  end
                  alias textile_h1 textile_p
                  alias textile_h2 textile_p
                  alias textile_h3 textile_p
                  alias textile_h4 textile_p
                  alias textile_h5 textile_p
                  alias textile_h6 textile_p
                  def textile_fn_( tag, num, atts, cite, content )
                      atts << " id=\"fn#{ num }\" class=\"footnote\""
                      content = "<sup>#{ num }</sup> #{ content }"
                      atts = shelve( atts ) if atts
                      "\t<p#{ atts }>#{ content }</p>"
                  end
                  BLOCK_RE = /^(([a-z]+)(\d*))(#{A}#{C})\.(?::(\S+))? (.*)$/m
                  def block_textile_prefix( text )
                      if text =~ BLOCK_RE
                          tag,tagpre,num,atts,cite,content = $~[1..6]
                          atts = pba( atts )
                          # pass to prefix handler
                          if respond_to? "textile_#{ tag }", true
                              text.gsub!( $&, method( "textile_#{ tag }" ).call( tag, atts, cite, content ) )
                          elsif respond_to? "textile_#{ tagpre }_", true
                              text.gsub!( $&, method( "textile_#{ tagpre }_" ).call( tagpre, num, atts, cite, content ) )
                          end
                      end
                  end
                  SETEXT_RE = /\A(.+?)\n([=-])[=-]* *$/m
                  def block_markdown_setext( text )
                      if text =~ SETEXT_RE
                          tag = if $2 == "="; "h1"; else; "h2"; end
                          blk, cont = "<#{ tag }>#{ $1 }</#{ tag }>", $'
                          blocks cont
                          text.replace( blk + cont )
                      end
                  end
                  ATX_RE = /\A(\#{1,6})  # $1 = string of #'s
                            [ ]*
                            (.+?)       # $2 = Header text
                            [ ]*
                            \#*         # optional closing #'s (not counted)
                            $/x
                  def block_markdown_atx( text )
                      if text =~ ATX_RE
                          tag = "h#{ $1.length }"
                          blk, cont = "<#{ tag }>#{ $2 }</#{ tag }>\n\n", $'
                          blocks cont
                          text.replace( blk + cont )
                      end
                  end
                  MARKDOWN_BQ_RE = /\A(^ *> ?.+$(.+\n)*\n*)+/m
                  def block_markdown_bq( text )
                      text.gsub!( MARKDOWN_BQ_RE ) do |blk|
                          blk.gsub!( /^ *> ?/, '' )
                          flush_left blk
                          blocks blk
                          blk.gsub!( /^(\S)/, "\t\\1" )
                          "<blockquote>\n#{ blk }\n</blockquote>\n\n"
                      end
                  end
                  MARKDOWN_RULE_RE = /^(#{
                      ['*', '-', '_'].collect { |ch| ' ?(' + Regexp::quote( ch ) + ' ?){3,}' }.join( '|' )
                  })$/
                  def block_markdown_rule( text )
                      text.gsub!( MARKDOWN_RULE_RE ) do |blk|
                          "<hr />"
                      end
                  end
                  # XXX TODO XXX
                  def block_markdown_lists( text )
                  end
                  def inline_textile_span( text )
                      QTAGS.each do |qtag_rc, ht, qtag_re, rtype|
                          text.gsub!( qtag_re ) do |m|
                              case rtype
                              when :limit
                                  sta,qtag,atts,cite,content = $~[1..5]
                              else
                                  qtag,atts,cite,content = $~[1..4]
                                  sta = ''
                              end
                              atts = pba( atts )
                              atts << " cite=\"#{ cite }\"" if cite
                              atts = shelve( atts ) if atts
                              "#{ sta }<#{ ht }#{ atts }>#{ content }</#{ ht }>"
                          end
                      end
                  end
                  LINK_RE = /
                          ([\s\[{(]|[#{PUNCT}])?     # $pre
                          "                          # start
                          (#{C})                     # $atts
                          ([^"\n]+?)                 # $text
                          \s?
                          (?:\(([^)]+?)\)(?="))?     # $title
                          ":
                          ([\w\/]\S+?)               # $url
                          (\/)?                      # $slash
                          ([^\w\=\/;\(\)]*?)         # $post
                          (?=<|\s|$)
                      /x
              #"
                  def inline_textile_link( text )
                      text.gsub!( LINK_RE ) do |m|
                          pre,atts,text,title,url,slash,post = $~[1..7]
                          url, url_title = check_refs( url )
                          title ||= url_title
                          # Idea below : an URL with unbalanced parethesis and
                          # ending by ')' is put into external parenthesis
                          if ( url[-1]==?) and ((url.count("(") - url.count(")")) < 0 ) )
                            url=url[0..-2] # discard closing parenth from url
                            post = ")"+post # add closing parenth to post
                          end
                          atts = pba( atts )
                          atts = " href=\"#{ url }#{ slash }\"#{ atts }"
                          atts << " title=\"#{ htmlesc title }\"" if title
                          atts = shelve( atts ) if atts
                          external = (url =~ /^https?:\/\//) ? ' class="external"' : ''
                          "#{ pre }<a#{ atts }#{ external }>#{ text }</a>#{ post }"
                      end
                  end
                  MARKDOWN_REFLINK_RE = /
                          \[([^\[\]]+)\]      # $text
                          [ ]?                # opt. space
                          (?:\n[ ]*)?         # one optional newline followed by spaces
                          \[(.*?)\]           # $id
                      /x
                  def inline_markdown_reflink( text )
                      text.gsub!( MARKDOWN_REFLINK_RE ) do |m|
                          text, id = $~[1..2]
                          if id.empty?
                              url, title = check_refs( text )
                          else
                              url, title = check_refs( id )
                          end
                          atts = " href=\"#{ url }\""
                          atts << " title=\"#{ title }\"" if title
                          atts = shelve( atts )
                          "<a#{ atts }>#{ text }</a>"
                      end
                  end
                  MARKDOWN_LINK_RE = /
                          \[([^\[\]]+)\]      # $text
                          \(                  # open paren
                          [ \t]*              # opt space
                          <?(.+?)>?           # $href
                          [ \t]*              # opt space
                          (?:                 # whole title
                          (['"])              # $quote
                          (.*?)               # $title
                          \3                  # matching quote
                          )?                  # title is optional
                          \)
                      /x
                  def inline_markdown_link( text )
                      text.gsub!( MARKDOWN_LINK_RE ) do |m|
                          text, url, quote, title = $~[1..4]
                          atts = " href=\"#{ url }\""
                          atts << " title=\"#{ title }\"" if title
                          atts = shelve( atts )
                          "<a#{ atts }>#{ text }</a>"
                      end
                  end
                  TEXTILE_REFS_RE =  /(^ *)\[([^\[\n]+?)\](#{HYPERLINK})(?=\s|$)/
                  MARKDOWN_REFS_RE = /(^ *)\[([^\n]+?)\]:\s+<?(#{HYPERLINK})>?(?:\s+"((?:[^"]|\\")+)")?(?=\s|$)/m
                  def refs( text )
                      @rules.each do |rule_name|
                          method( rule_name ).call( text ) if rule_name.to_s.match /^refs_/
                      end
                  end
                  def refs_textile( text )
                      text.gsub!( TEXTILE_REFS_RE ) do |m|
                          flag, url = $~[2..3]
                          @urlrefs[flag.downcase] = [url, nil]
                          nil
                      end
                  end
                  def refs_markdown( text )
                      text.gsub!( MARKDOWN_REFS_RE ) do |m|
                          flag, url = $~[2..3]
                          title = $~[6]
                          @urlrefs[flag.downcase] = [url, title]
                          nil
                      end
                  end
                  def check_refs( text )
                      ret = @urlrefs[text.downcase] if text
                      ret || [text, nil]
                  end
                  IMAGE_RE = /
                          (<p>|.|^)            # start of line?
                          \!                   # opening
                          (\<|\=|\>)?          # optional alignment atts
                          (#{C})               # optional style,class atts
                          (?:\. )?             # optional dot-space
                          ([^\s(!]+?)          # presume this is the src
                          \s?                  # optional space
                          (?:\(((?:[^\(\)]|\([^\)]+\))+?)\))?   # optional title
                          \!                   # closing
                          (?::#{ HYPERLINK })? # optional href
                      /x
                  def inline_textile_image( text )
                      text.gsub!( IMAGE_RE )  do |m|
                          stln,algn,atts,url,title,href,href_a1,href_a2 = $~[1..8]
                          htmlesc title
                          atts = pba( atts )
                          atts = " src=\"#{ url }\"#{ atts }"
                          atts << " title=\"#{ title }\"" if title
                          atts << " alt=\"#{ title }\""
                          # size = @getimagesize($url);
                          # if($size) $atts.= " $size[3]";
                          href, alt_title = check_refs( href ) if href
                          url, url_title = check_refs( url )
                          out = ''
                          out << "<a#{ shelve( " href=\"#{ href }\"" ) }>" if href
                          out << "<img#{ shelve( atts ) } />"
                          out << "</a>#{ href_a1 }#{ href_a2 }" if href
                          if algn
                              algn = h_align( algn )
                              if stln == "<p>"
                                  out = "<p style=\"float:#{ algn }\">#{ out }"
                              else
                                  out = "#{ stln }<div style=\"float:#{ algn }\">#{ out }</div>"
                              end
                          else
                              out = stln + out
                          end
                          out
                      end
                  end
                  def shelve( val )
                      @shelf << val
                      " :redsh##{ @shelf.length }:"
                  end
                  def retrieve( text )
                      @shelf.each_with_index do |r, i|
                          text.gsub!( " :redsh##{ i + 1 }:", r )
                      end
                  end
                  def incoming_entities( text )
                      ## turn any incoming ampersands into a dummy character for now.
                      ## This uses a negative lookahead for alphanumerics followed by a semicolon,
                      ## implying an incoming html entity, to be skipped
                      text.gsub!( /&(?![#a-z0-9]+;)/i, "x%x%" )
                  end
                  def no_textile( text )
                      text.gsub!( /(^|\s)==([^=]+.*?)==(\s|$)?/,
                          '\1<notextile>\2</notextile>\3' )
                      text.gsub!( /^ *==([^=]+.*?)==/m,
                          '\1<notextile>\2</notextile>\3' )
                  end
                  def clean_white_space( text )
                      # normalize line breaks
                      text.gsub!( /\r\n/, "\n" )
                      text.gsub!( /\r/, "\n" )
                      text.gsub!( /\t/, '    ' )
                      text.gsub!( /^ +$/, '' )
                      text.gsub!( /\n{3,}/, "\n\n" )
                      text.gsub!( /"$/, "\" " )
                      # if entire document is indented, flush
                      # to the left side
                      flush_left text
                  end
                  def flush_left( text )
                      indt = 0
                      if text =~ /^ /
                          while text !~ /^ {#{indt}}\S/
                              indt += 1
                          end unless text.empty?
                          if indt.nonzero?
                              text.gsub!( /^ {#{indt}}/, '' )
                          end
                      end
                  end
                  def footnote_ref( text )
                      text.gsub!( /\b\[([0-9]+?)\](\s)?/,
                          '<sup><a href="#fn\1">\1</a></sup>\2' )
                  end
                  OFFTAGS = /(code|pre|kbd|notextile)/
                  OFFTAG_MATCH = /(?:(<\/#{ OFFTAGS }>)|(<#{ OFFTAGS }[^>]*>))(.*?)(?=<\/?#{ OFFTAGS }|\Z)/mi
                  OFFTAG_OPEN = /<#{ OFFTAGS }/
                  OFFTAG_CLOSE = /<\/?#{ OFFTAGS }/
                  HASTAG_MATCH = /(<\/?\w[^\n]*?>)/m
                  ALLTAG_MATCH = /(<\/?\w[^\n]*?>)|.*?(?=<\/?\w[^\n]*?>|$)/m
                  def glyphs_textile( text, level = 0 )
                      if text !~ HASTAG_MATCH
                          pgl text
                          footnote_ref text
                      else
                          codepre = 0
                          text.gsub!( ALLTAG_MATCH ) do |line|
                              ## matches are off if we're between <code>, <pre> etc.
                              if $1
                                  if line =~ OFFTAG_OPEN
                                      codepre += 1
                                  elsif line =~ OFFTAG_CLOSE
                                      codepre -= 1
                                      codepre = 0 if codepre < 0
                                  end
                              elsif codepre.zero?
                                  glyphs_textile( line, level + 1 )
                              else
                                  htmlesc( line, :NoQuotes )
                              end
                              # p [level, codepre, line]
                              line
                          end
                      end
                  end
                  def rip_offtags( text )
                      if text =~ /<.*>/
                          ## strip and encode <pre> content
                          codepre, used_offtags = 0, {}
                          text.gsub!( OFFTAG_MATCH ) do |line|
                              if $3
                                  offtag, aftertag = $4, $5
                                  codepre += 1
                                  used_offtags[offtag] = true
                                  if codepre - used_offtags.length > 0
                                      htmlesc( line, :NoQuotes )
                                      @pre_list.last << line
                                      line = ""
                                  else
                                      htmlesc( aftertag, :NoQuotes ) if aftertag
                                      line = "<redpre##{ @pre_list.length }>"
                                      $3.match(/<#{ OFFTAGS }([^>]*)>/)
                                      tag = $1
                                      $2.to_s.match(/(class\=\S+)/i)
                                      tag << " #{$1}" if $1
                                      @pre_list << "<#{ tag }>#{ aftertag }"
                                  end
                              elsif $1 and codepre > 0
                                  if codepre - used_offtags.length > 0
                                      htmlesc( line, :NoQuotes )
                                      @pre_list.last << line
                                      line = ""
                                  end
                                  codepre -= 1 unless codepre.zero?
                                  used_offtags = {} if codepre.zero?
                              end
                              line
                          end
                      end
                      text
                  end
                  def smooth_offtags( text )
                      unless @pre_list.empty?
                          ## replace <pre> content
                          text.gsub!( /<redpre#(\d+)>/ ) { @pre_list[$1.to_i] }
                      end
                  end
                  def inline( text )
                      [/^inline_/, /^glyphs_/].each do |meth_re|
                          @rules.each do |rule_name|
                              method( rule_name ).call( text ) if rule_name.to_s.match( meth_re )
                          end
                      end
                  end
                  def h_align( text )
                      H_ALGN_VALS[text]
                  end
                  def v_align( text )
                      V_ALGN_VALS[text]
                  end
                  def textile_popup_help( name, windowW, windowH )
                      ' <a target="_blank" href="http://hobix.com/textile/#' + helpvar + '" onclick="window.open(this.href, \'popupwindow\', \'width=' + windowW + ',height=' + windowH + ',scrollbars,resizable\'); return false;">' + name + '</a><br />'
                  end
                  # HTML cleansing stuff
                  BASIC_TAGS = {
                      'a' => ['href', 'title'],
                      'img' => ['src', 'alt', 'title'],
                      'br' => [],
                      'i' => nil,
                      'u' => nil,
                      'b' => nil,
                      'pre' => nil,
                      'kbd' => nil,
                      'code' => ['lang'],
                      'cite' => nil,
                      'strong' => nil,
                      'em' => nil,
                      'ins' => nil,
                      'sup' => nil,
                      'sub' => nil,
                      'del' => nil,
                      'table' => nil,
                      'tr' => nil,
                      'td' => ['colspan', 'rowspan'],
                      'th' => nil,
                      'ol' => nil,
                      'ul' => nil,
                      'li' => nil,
                      'p' => nil,
                      'h1' => nil,
                      'h2' => nil,
                      'h3' => nil,
                      'h4' => nil,
                      'h5' => nil,
                      'h6' => nil,
                      'blockquote' => ['cite']
                  }
                  def clean_html( text, tags = BASIC_TAGS )
                      text.gsub!( /<!\[CDATA\[/, '' )
                      text.gsub!( /<(\/*)(\w+)([^>]*)>/ ) do
                          raw = $~
                          tag = raw[2].downcase
                          if tags.has_key? tag
                              pcs = [tag]
                              tags[tag].each do |prop|
                                  ['"', "'", ''].each do |q|
                                      q2 = ( q != '' ? q : '\s' )
                                      if raw[3] =~ /#{prop}\s*=\s*#{q}([^#{q2}]+)#{q}/i
                                          attrv = $1
                                          next if prop == 'src' and attrv =~ %r{^(?!http)\w+:}
                                          pcs << "#{prop}=\"#{$1.gsub('"', '\\"')}\""
                                          break
                                      end
                                  end
                              end if tags[tag]
                              "<#{raw[1]}#{pcs.join " "}>"
                          else
                              " "
                          end
                      end
                  end
                  ALLOWED_TAGS = %w(redpre pre code notextile)
                  def escape_html_tags(text)
                    text.gsub!(%r{<(\/?([!\w]+)[^<>\n]*)(>?)}) {|m| ALLOWED_TAGS.include?($2) ? "<#{$1}#{$3}" : "&lt;#{$1}#{'&gt;' unless $3.blank?}" }
                  end
              end

lib/redmine/wiki_formatting/textile/formatter.rb +1 0

              # Redmine - project management software
              # Copyright (C) 2006-2008  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              require 'redcloth3'
              require 'coderay'
              module Redmine
                module WikiFormatting
                  module Textile
                    class Formatter < RedCloth3
                      # auto_link rule after textile rules so that it doesn't break !image_url! tags
                      RULES = [:textile, :block_markdown_rule, :inline_auto_link, :inline_auto_mailto, :inline_toc, :inline_macros]
                      def initialize(*args)
                        super
                        self.hard_breaks=true
                        self.no_span_caps=true
+                       self.filter_styles=true
                      end
                      def to_html(*rules, &block)
                        @toc = []
                        @macros_runner = block
                        super(*RULES).to_s
                      end
                    private
                      # Patch for RedCloth.  Fixed in RedCloth r128 but _why hasn't released it yet.
                      # <a href="http://code.whytheluckystiff.net/redcloth/changeset/128">http://code.whytheluckystiff.net/redcloth/changeset/128</a>
                      def hard_break( text )
                        text.gsub!( /(.)\n(?!\n|\Z|>| *(>? *[#*=]+(\s|$)|[{|]))/, "\\1<br />\n" ) if hard_breaks
                      end
                      # Patch to add code highlighting support to RedCloth
                      def smooth_offtags( text )
                        unless @pre_list.empty?
                          ## replace <pre> content
                          text.gsub!(/<redpre#(\d+)>/) do
                            content = @pre_list[$1.to_i]
                            if content.match(/<code\s+class="(\w+)">\s?(.+)/m)
                              content = "<code class=\"#{$1} CodeRay\">" +
                                CodeRay.scan($2, $1.downcase).html(:escape => false, :line_numbers => :inline)
                            end
                            content
                          end
                        end
                      end
                      # Patch to add 'table of content' support to RedCloth
                      def textile_p_withtoc(tag, atts, cite, content)
                        # removes wiki links from the item
                        toc_item = content.gsub(/(\[\[|\]\])/, '')
                        # removes styles
                        # eg. %{color:red}Triggers% => Triggers
                        toc_item.gsub! %r[%\{[^\}]*\}([^%]+)%], '\\1'
                        # replaces non word caracters by dashes
                        anchor = toc_item.gsub(%r{[^\w\s\-]}, '').gsub(%r{\s+(\-+\s*)?}, '-')
                        unless anchor.blank?
                          if tag =~ /^h(\d)$/
                            @toc << [$1.to_i, anchor, toc_item]
                          end
                          atts << " id=\"#{anchor}\""
                          content = content + "<a href=\"##{anchor}\" class=\"wiki-anchor\">&para;</a>"
                        end
                        textile_p(tag, atts, cite, content)
                      end
                      alias :textile_h1 :textile_p_withtoc
                      alias :textile_h2 :textile_p_withtoc
                      alias :textile_h3 :textile_p_withtoc
                      def inline_toc(text)
                        text.gsub!(/<p>\{\{([<>]?)toc\}\}<\/p>/i) do
                          div_class = 'toc'
                          div_class << ' right' if $1 == '>'
                          div_class << ' left' if $1 == '<'
                          out = "<ul class=\"#{div_class}\">"
                          @toc.each do |heading|
                            level, anchor, toc_item = heading
                            out << "<li class=\"heading#{level}\"><a href=\"##{anchor}\">#{toc_item}</a></li>\n"
                          end
                          out << '</ul>'
                          out
                        end
                      end
                      MACROS_RE = /
                                    (!)?                        # escaping
                                    (
                                    \{\{                        # opening tag
                                    ([\w]+)                     # macro name
                                    (\(([^\}]*)\))?             # optional arguments
                                    \}\}                        # closing tag
                                    )
                                  /x unless const_defined?(:MACROS_RE)
                      def inline_macros(text)
                        text.gsub!(MACROS_RE) do
                          esc, all, macro = $1, $2, $3.downcase
                          args = ($5 || '').split(',').each(&:strip)
                          if esc.nil?
                            begin
                              @macros_runner.call(macro, args)
                            rescue => e
                              "<div class=\"flash error\">Error executing the <strong>#{macro}</strong> macro (#{e})</div>"
                            end || all
                          else
                            all
                          end
                        end
                      end
                      AUTO_LINK_RE = %r{
                                      (                          # leading text
                                        <\w+.*?>|                # leading HTML tag, or
                                        [^=<>!:'"/]|             # leading punctuation, or
                                        ^                        # beginning of line
                                      )
                                      (
                                        (?:https?://)|           # protocol spec, or
                                        (?:s?ftps?://)|
                                        (?:www\.)                # www.*
                                      )
                                      (
                                        (\S+?)                   # url
                                        (\/)?                    # slash
                                      )
                                      ([^\w\=\/;\(\)]*?)               # post
                                      (?=<|\s|$)
                                     }x unless const_defined?(:AUTO_LINK_RE)
                      # Turns all urls into clickable links (code from Rails).
                      def inline_auto_link(text)
                        text.gsub!(AUTO_LINK_RE) do
                          all, leading, proto, url, post = $&, $1, $2, $3, $6
                          if leading =~ /<a\s/i || leading =~ /![<>=]?/
                            # don't replace URL's that are already linked
                            # and URL's prefixed with ! !> !< != (textile images)
                            all
                          else
                            # Idea below : an URL with unbalanced parethesis and
                            # ending by ')' is put into external parenthesis
                            if ( url[-1]==?) and ((url.count("(") - url.count(")")) < 0 ) )
                              url=url[0..-2] # discard closing parenth from url
                              post = ")"+post # add closing parenth to post
                            end
                            %(#{leading}<a class="external" href="#{proto=="www."?"http://www.":proto}#{url}">#{proto + url}</a>#{post})
                          end
                        end
                      end
                      # Turns all email addresses into clickable links (code from Rails).
                      def inline_auto_mailto(text)
                        text.gsub!(/([\w\.!#\$%\-+.]+@[A-Za-z0-9\-]+(\.[A-Za-z0-9\-]+)+)/) do
                          mail = $1
                          if text.match(/<a\b[^>]*>(.*)(#{Regexp.escape(mail)})(.*)<\/a>/)
                            mail
                          else
                            %{<a href="mailto:#{mail}" class="email">#{mail}</a>}
                          end
                        end
                      end
                    end
                  end
                end
              end

test/unit/helpers/application_helper_test.rb +2 -1

              # redMine - project management software
              # Copyright (C) 2006-2007  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              require File.dirname(__FILE__) + '/../../test_helper'
              class ApplicationHelperTest < HelperTestCase
                include ApplicationHelper
                include ActionView::Helpers::TextHelper
                fixtures :projects, :roles, :enabled_modules, :users,
                                    :repositories, :changesets,
                                    :trackers, :issue_statuses, :issues, :versions, :documents,
                                    :wikis, :wiki_pages, :wiki_contents,
                                    :boards, :messages,
                                    :attachments
                def setup
                  super
                end
                def test_auto_links
                  to_test = {
                    'http://foo.bar' => '<a class="external" href="http://foo.bar">http://foo.bar</a>',
                    'http://foo.bar/~user' => '<a class="external" href="http://foo.bar/~user">http://foo.bar/~user</a>',
                    'http://foo.bar.' => '<a class="external" href="http://foo.bar">http://foo.bar</a>.',
                    'https://foo.bar.' => '<a class="external" href="https://foo.bar">https://foo.bar</a>.',
                    'This is a link: http://foo.bar.' => 'This is a link: <a class="external" href="http://foo.bar">http://foo.bar</a>.',
                    'A link (eg. http://foo.bar).' => 'A link (eg. <a class="external" href="http://foo.bar">http://foo.bar</a>).',
                    'http://foo.bar/foo.bar#foo.bar.' => '<a class="external" href="http://foo.bar/foo.bar#foo.bar">http://foo.bar/foo.bar#foo.bar</a>.',
                    'http://www.foo.bar/Test_(foobar)' => '<a class="external" href="http://www.foo.bar/Test_(foobar)">http://www.foo.bar/Test_(foobar)</a>',
                    '(see inline link : http://www.foo.bar/Test_(foobar))' => '(see inline link : <a class="external" href="http://www.foo.bar/Test_(foobar)">http://www.foo.bar/Test_(foobar)</a>)',
                    '(see inline link : http://www.foo.bar/Test)' => '(see inline link : <a class="external" href="http://www.foo.bar/Test">http://www.foo.bar/Test</a>)',
                    '(see inline link : http://www.foo.bar/Test).' => '(see inline link : <a class="external" href="http://www.foo.bar/Test">http://www.foo.bar/Test</a>).',
                    '(see "inline link":http://www.foo.bar/Test_(foobar))' => '(see <a href="http://www.foo.bar/Test_(foobar)" class="external">inline link</a>)',
                    '(see "inline link":http://www.foo.bar/Test)' => '(see <a href="http://www.foo.bar/Test" class="external">inline link</a>)',
                    '(see "inline link":http://www.foo.bar/Test).' => '(see <a href="http://www.foo.bar/Test" class="external">inline link</a>).',
                    'www.foo.bar' => '<a class="external" href="http://www.foo.bar">www.foo.bar</a>',
                    'http://foo.bar/page?p=1&t=z&s=' => '<a class="external" href="http://foo.bar/page?p=1&#38;t=z&#38;s=">http://foo.bar/page?p=1&#38;t=z&#38;s=</a>',
                    'http://foo.bar/page#125' => '<a class="external" href="http://foo.bar/page#125">http://foo.bar/page#125</a>',
                    'http://foo@www.bar.com' => '<a class="external" href="http://foo@www.bar.com">http://foo@www.bar.com</a>',
                    'http://foo:bar@www.bar.com' => '<a class="external" href="http://foo:bar@www.bar.com">http://foo:bar@www.bar.com</a>',
                    'ftp://foo.bar' => '<a class="external" href="ftp://foo.bar">ftp://foo.bar</a>',
                    'ftps://foo.bar' => '<a class="external" href="ftps://foo.bar">ftps://foo.bar</a>',
                    'sftp://foo.bar' => '<a class="external" href="sftp://foo.bar">sftp://foo.bar</a>',
                  }
                  to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
                end
                def test_auto_mailto
                  assert_equal '<p><a href="mailto:test@foo.bar" class="email">test@foo.bar</a></p>',
                    textilizable('test@foo.bar')
                end
                def test_inline_images
                  to_test = {
                    '!http://foo.bar/image.jpg!' => '<img src="http://foo.bar/image.jpg" alt="" />',
                    'floating !>http://foo.bar/image.jpg!' => 'floating <div style="float:right"><img src="http://foo.bar/image.jpg" alt="" /></div>',
                    'with class !(some-class)http://foo.bar/image.jpg!' => 'with class <img src="http://foo.bar/image.jpg" class="some-class" alt="" />',
-                   'with style !{width:100px;height100px}http://foo.bar/image.jpg!' => 'with style <img src="http://foo.bar/image.jpg" style="width:100px;height100px;" alt="" />',
+                   # inline styles should be stripped
+                   'with style !{width:100px;height100px}http://foo.bar/image.jpg!' => 'with style <img src="http://foo.bar/image.jpg" alt="" />',
                    'with title !http://foo.bar/image.jpg(This is a title)!' => 'with title <img src="http://foo.bar/image.jpg" title="This is a title" alt="This is a title" />',
                    'with title !http://foo.bar/image.jpg(This is a double-quoted "title")!' => 'with title <img src="http://foo.bar/image.jpg" title="This is a double-quoted &quot;title&quot;" alt="This is a double-quoted &quot;title&quot;" />',
                  }
                  to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
                end
                def test_acronyms
                  to_test = {
                    'this is an acronym: GPL(General Public License)' => 'this is an acronym: <acronym title="General Public License">GPL</acronym>',
                    'GPL(This is a double-quoted "title")' => '<acronym title="This is a double-quoted &quot;title&quot;">GPL</acronym>',
                  }
                  to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
                end
                def test_attached_images
                  to_test = {
                    'Inline image: !logo.gif!' => 'Inline image: <img src="/attachments/download/3" title="This is a logo" alt="This is a logo" />',
                    'Inline image: !logo.GIF!' => 'Inline image: <img src="/attachments/download/3" title="This is a logo" alt="This is a logo" />'
                  }
                  attachments = Attachment.find(:all)
                  to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text, :attachments => attachments) }
                end
                def test_textile_external_links
                  to_test = {
                    'This is a "link":http://foo.bar' => 'This is a <a href="http://foo.bar" class="external">link</a>',
                    'This is an intern "link":/foo/bar' => 'This is an intern <a href="/foo/bar">link</a>',
                    '"link (Link title)":http://foo.bar' => '<a href="http://foo.bar" title="Link title" class="external">link</a>',
                    '"link (Link title with "double-quotes")":http://foo.bar' => '<a href="http://foo.bar" title="Link title with &quot;double-quotes&quot;" class="external">link</a>',
                    "This is not a \"Link\":\n\nAnother paragraph" => "This is not a \"Link\":</p>\n\n\n\t<p>Another paragraph",
                    # no multiline link text
                    "This is a double quote \"on the first line\nand another on a second line\":test" => "This is a double quote \"on the first line<br />\nand another on a second line\":test"
                  }
                  to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
                end
                def test_redmine_links
                  issue_link = link_to('#3', {:controller => 'issues', :action => 'show', :id => 3},
                                             :class => 'issue', :title => 'Error 281 when updating a recipe (New)')
                  changeset_link = link_to('r1', {:controller => 'repositories', :action => 'revision', :id => 'ecookbook', :rev => 1},
                                                 :class => 'changeset', :title => 'My very first commit')
                  document_link = link_to('Test document', {:controller => 'documents', :action => 'show', :id => 1},
                                                           :class => 'document')
                  version_link = link_to('1.0', {:controller => 'versions', :action => 'show', :id => 2},
                                                :class => 'version')
                  message_url = {:controller => 'messages', :action => 'show', :board_id => 1, :id => 4}
                  source_url = {:controller => 'repositories', :action => 'entry', :id => 'ecookbook', :path => ['some', 'file']}
                  source_url_with_ext = {:controller => 'repositories', :action => 'entry', :id => 'ecookbook', :path => ['some', 'file.ext']}
                  to_test = {
                    # tickets
                    '#3, #3 and #3.'              => "#{issue_link}, #{issue_link} and #{issue_link}.",
                    # changesets
                    'r1'                          => changeset_link,
                    # documents
                    'document#1'                  => document_link,
                    'document:"Test document"'    => document_link,
                    # versions
                    'version#2'                   => version_link,
                    'version:1.0'                 => version_link,
                    'version:"1.0"'               => version_link,
                    # source
                    'source:/some/file'           => link_to('source:/some/file', source_url, :class => 'source'),
                    'source:/some/file.'          => link_to('source:/some/file', source_url, :class => 'source') + ".",
                    'source:/some/file.ext.'      => link_to('source:/some/file.ext', source_url_with_ext, :class => 'source') + ".",
                    'source:/some/file. '         => link_to('source:/some/file', source_url, :class => 'source') + ".",
                    'source:/some/file.ext. '     => link_to('source:/some/file.ext', source_url_with_ext, :class => 'source') + ".",
                    'source:/some/file, '         => link_to('source:/some/file', source_url, :class => 'source') + ",",
                    'source:/some/file@52'        => link_to('source:/some/file@52', source_url.merge(:rev => 52), :class => 'source'),
                    'source:/some/file.ext@52'    => link_to('source:/some/file.ext@52', source_url_with_ext.merge(:rev => 52), :class => 'source'),
                    'source:/some/file#L110'      => link_to('source:/some/file#L110', source_url.merge(:anchor => 'L110'), :class => 'source'),
                    'source:/some/file.ext#L110'  => link_to('source:/some/file.ext#L110', source_url_with_ext.merge(:anchor => 'L110'), :class => 'source'),
                    'source:/some/file@52#L110'   => link_to('source:/some/file@52#L110', source_url.merge(:rev => 52, :anchor => 'L110'), :class => 'source'),
                    'export:/some/file'           => link_to('export:/some/file', source_url.merge(:format => 'raw'), :class => 'source download'),
                    # message
                    'message#4'                   => link_to('Post 2', message_url, :class => 'message'),
                    'message#5'                   => link_to('RE: post 2', message_url.merge(:anchor => 'message-5'), :class => 'message'),
                    # escaping
                    '!#3.'                        => '#3.',
                    '!r1'                         => 'r1',
                    '!document#1'                 => 'document#1',
                    '!document:"Test document"'   => 'document:"Test document"',
                    '!version#2'                  => 'version#2',
                    '!version:1.0'                => 'version:1.0',
                    '!version:"1.0"'              => 'version:"1.0"',
                    '!source:/some/file'          => 'source:/some/file',
                    # invalid expressions
                    'source:'                     => 'source:',
                    # url hash
                    "http://foo.bar/FAQ#3"       => '<a class="external" href="http://foo.bar/FAQ#3">http://foo.bar/FAQ#3</a>',
                  }
                  @project = Project.find(1)
                  to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
                end
                def test_wiki_links
                  to_test = {
                    '[[CookBook documentation]]' => '<a href="/wiki/ecookbook/CookBook_documentation" class="wiki-page">CookBook documentation</a>',
                    '[[Another page|Page]]' => '<a href="/wiki/ecookbook/Another_page" class="wiki-page">Page</a>',
                    # link with anchor
                    '[[CookBook documentation#One-section]]' => '<a href="/wiki/ecookbook/CookBook_documentation#One-section" class="wiki-page">CookBook documentation</a>',
                    '[[Another page#anchor|Page]]' => '<a href="/wiki/ecookbook/Another_page#anchor" class="wiki-page">Page</a>',
                    # page that doesn't exist
                    '[[Unknown page]]' => '<a href="/wiki/ecookbook/Unknown_page" class="wiki-page new">Unknown page</a>',
                    '[[Unknown page|404]]' => '<a href="/wiki/ecookbook/Unknown_page" class="wiki-page new">404</a>',
                    # link to another project wiki
                    '[[onlinestore:]]' => '<a href="/wiki/onlinestore/" class="wiki-page">onlinestore</a>',
                    '[[onlinestore:|Wiki]]' => '<a href="/wiki/onlinestore/" class="wiki-page">Wiki</a>',
                    '[[onlinestore:Start page]]' => '<a href="/wiki/onlinestore/Start_page" class="wiki-page">Start page</a>',
                    '[[onlinestore:Start page|Text]]' => '<a href="/wiki/onlinestore/Start_page" class="wiki-page">Text</a>',
                    '[[onlinestore:Unknown page]]' => '<a href="/wiki/onlinestore/Unknown_page" class="wiki-page new">Unknown page</a>',
                    # striked through link
                    '-[[Another page|Page]]-' => '<del><a href="/wiki/ecookbook/Another_page" class="wiki-page">Page</a></del>',
                    '-[[Another page|Page]] link-' => '<del><a href="/wiki/ecookbook/Another_page" class="wiki-page">Page</a> link</del>',
                    # escaping
                    '![[Another page|Page]]' => '[[Another page|Page]]',
                  }
                  @project = Project.find(1)
                  to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
                end
                def test_html_tags
                  to_test = {
                    "<div>content</div>" => "<p>&lt;div&gt;content&lt;/div&gt;</p>",
                    "<div class=\"bold\">content</div>" => "<p>&lt;div class=\"bold\"&gt;content&lt;/div&gt;</p>",
                    "<script>some script;</script>" => "<p>&lt;script&gt;some script;&lt;/script&gt;</p>",
                    # do not escape pre/code tags
                    "<pre>\nline 1\nline2</pre>" => "<pre>\nline 1\nline2</pre>",
                    "<pre><code>\nline 1\nline2</code></pre>" => "<pre><code>\nline 1\nline2</code></pre>",
                    "<pre><div>content</div></pre>" => "<pre>&lt;div&gt;content&lt;/div&gt;</pre>",
                    "HTML comment: <!-- no comments -->" => "<p>HTML comment: &lt;!-- no comments --&gt;</p>",
                    "<!-- opening comment" => "<p>&lt;!-- opening comment</p>",
                    # remove attributes except class
                    "<pre class='foo'>some text</pre>" => "<pre class='foo'>some text</pre>",
                    "<pre onmouseover='alert(1)'>some text</pre>" => "<pre>some text</pre>",
                  }
                  to_test.each { |text, result| assert_equal result, textilizable(text) }
                end
                def test_allowed_html_tags
                  to_test = {
                    "<pre>preformatted text</pre>" => "<pre>preformatted text</pre>",
                    "<notextile>no *textile* formatting</notextile>" => "no *textile* formatting",
                    "<notextile>this is <tag>a tag</tag></notextile>" => "this is &lt;tag&gt;a tag&lt;/tag&gt;"
                  }
                  to_test.each { |text, result| assert_equal result, textilizable(text) }
                end
                def syntax_highlight
                  raw = <<-RAW
              <pre><code class="ruby">
              # Some ruby code here
              </pre></code>
              RAW
                  expected = <<-EXPECTED
              <pre><code class="ruby CodeRay"><span class="no">1</span> <span class="c"># Some ruby code here</span>
              </pre></code>
              EXPECTED
                  assert_equal expected.gsub(%r{[\r\n\t]}, ''), textilizable(raw).gsub(%r{[\r\n\t]}, '')
                end
                def test_wiki_links_in_tables
                  to_test = {"|[[Page|Link title]]|[[Other Page|Other title]]|\n|Cell 21|[[Last page]]|" =>
                               '<tr><td><a href="/wiki/ecookbook/Page" class="wiki-page new">Link title</a></td>' +
                               '<td><a href="/wiki/ecookbook/Other_Page" class="wiki-page new">Other title</a></td>' +
                               '</tr><tr><td>Cell 21</td><td><a href="/wiki/ecookbook/Last_page" class="wiki-page new">Last page</a></td></tr>'
                  }
                  @project = Project.find(1)
                  to_test.each { |text, result| assert_equal "<table>#{result}</table>", textilizable(text).gsub(/[\t\n]/, '') }
                end
                def test_text_formatting
                  to_test = {'*_+bold, italic and underline+_*' => '<strong><em><ins>bold, italic and underline</ins></em></strong>',
                             '(_text within parentheses_)' => '(<em>text within parentheses</em>)',
                             'a *Humane Web* Text Generator' => 'a <strong>Humane Web</strong> Text Generator',
                             'a H *umane* W *eb* T *ext* G *enerator*' => 'a H <strong>umane</strong> W <strong>eb</strong> T <strong>ext</strong> G <strong>enerator</strong>',
                             'a *H* umane *W* eb *T* ext *G* enerator' => 'a <strong>H</strong> umane <strong>W</strong> eb <strong>T</strong> ext <strong>G</strong> enerator',
                            }
                  to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
                end
                def test_wiki_horizontal_rule
                  assert_equal '<hr />', textilizable('---')
                  assert_equal '<p>Dashes: ---</p>', textilizable('Dashes: ---')
                end
                def test_acronym
                  assert_equal '<p>This is an acronym: <acronym title="American Civil Liberties Union">ACLU</acronym>.</p>',
                               textilizable('This is an acronym: ACLU(American Civil Liberties Union).')
                end
                def test_footnotes
                  raw = <<-RAW
              This is some text[1].
              fn1. This is the foot note
              RAW
                  expected = <<-EXPECTED
              <p>This is some text<sup><a href=\"#fn1\">1</a></sup>.</p>
              <p id="fn1" class="footnote"><sup>1</sup> This is the foot note</p>
              EXPECTED
                  assert_equal expected.gsub(%r{[\r\n\t]}, ''), textilizable(raw).gsub(%r{[\r\n\t]}, '')
                end
                def test_table_of_content
                  raw = <<-RAW
              {{toc}}
              h1. Title
              Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Maecenas sed libero.
              h2. Subtitle
              Nullam commodo metus accumsan nulla. Curabitur lobortis dui id dolor.
              h2. Subtitle with %{color:red}red text%
              h1. Another title
              RAW
                  expected = '<ul class="toc">' +
                             '<li class="heading1"><a href="#Title">Title</a></li>' +
                             '<li class="heading2"><a href="#Subtitle">Subtitle</a></li>' +
                             '<li class="heading2"><a href="#Subtitle-with-red-text">Subtitle with red text</a></li>' +
                             '<li class="heading1"><a href="#Another-title">Another title</a></li>' +
                             '</ul>'
                  assert textilizable(raw).gsub("\n", "").include?(expected)
                end
                def test_blockquote
                  # orig raw text
                  raw = <<-RAW
              John said:
              > Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Maecenas sed libero.
              > Nullam commodo metus accumsan nulla. Curabitur lobortis dui id dolor.
              > * Donec odio lorem,
              > * sagittis ac,
              > * malesuada in,
              > * adipiscing eu, dolor.
              >
              > >Nulla varius pulvinar diam. Proin id arcu id lorem scelerisque condimentum. Proin vehicula turpis vitae lacus.
              > Proin a tellus. Nam vel neque.
              He's right.
              RAW
                  # expected html
                  expected = <<-EXPECTED
              <p>John said:</p>
              <blockquote>
              Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Maecenas sed libero.
              Nullam commodo metus accumsan nulla. Curabitur lobortis dui id dolor.
              <ul>
                <li>Donec odio lorem,</li>
                <li>sagittis ac,</li>
                <li>malesuada in,</li>
                <li>adipiscing eu, dolor.</li>
              </ul>
              <blockquote>
              <p>Nulla varius pulvinar diam. Proin id arcu id lorem scelerisque condimentum. Proin vehicula turpis vitae lacus.</p>
              </blockquote>
              <p>Proin a tellus. Nam vel neque.</p>
              </blockquote>
              <p>He's right.</p>
              EXPECTED
                  assert_equal expected.gsub(%r{\s+}, ''), textilizable(raw).gsub(%r{\s+}, '')
                end
                def test_table
                  raw = <<-RAW
              This is a table with empty cells:
              |cell11|cell12||
              |cell21||cell23|
              |cell31|cell32|cell33|
              RAW
                  expected = <<-EXPECTED
              <p>This is a table with empty cells:</p>
              <table>
                <tr><td>cell11</td><td>cell12</td><td></td></tr>
                <tr><td>cell21</td><td></td><td>cell23</td></tr>
                <tr><td>cell31</td><td>cell32</td><td>cell33</td></tr>
              </table>
              EXPECTED
                  assert_equal expected.gsub(%r{\s+}, ''), textilizable(raw).gsub(%r{\s+}, '')
                end
                def test_default_formatter
                  Setting.text_formatting = 'unknown'
                  text = 'a *link*: http://www.example.net/'
                  assert_equal '<p>a *link*: <a href="http://www.example.net/">http://www.example.net/</a></p>', textilizable(text)
                  Setting.text_formatting = 'textile'
                end
                def test_date_format_default
                  today = Date.today
                  Setting.date_format = ''
                  assert_equal l_date(today), format_date(today)
                end
                def test_date_format
                  today = Date.today
                  Setting.date_format = '%d %m %Y'
                  assert_equal today.strftime('%d %m %Y'), format_date(today)
                end
                def test_time_format_default
                  now = Time.now
                  Setting.date_format = ''
                  Setting.time_format = ''
                  assert_equal l_datetime(now), format_time(now)
                  assert_equal l_time(now), format_time(now, false)
                end
                def test_time_format
                  now = Time.now
                  Setting.date_format = '%d %m %Y'
                  Setting.time_format = '%H %M'
                  assert_equal now.strftime('%d %m %Y %H %M'), format_time(now)
                  assert_equal now.strftime('%H %M'), format_time(now, false)
                end
                def test_utc_time_format
                  now = Time.now.utc
                  Setting.date_format = '%d %m %Y'
                  Setting.time_format = '%H %M'
                  assert_equal Time.now.strftime('%d %m %Y %H %M'), format_time(now)
                  assert_equal Time.now.strftime('%H %M'), format_time(now, false)
                end
                def test_due_date_distance_in_words
                  to_test = { Date.today => 'Due in 0 days',
                              Date.today + 1 => 'Due in 1 day',
                              Date.today + 100 => 'Due in 100 days',
                              Date.today + 20000 => 'Due in 20000 days',
                              Date.today - 1 => '1 day late',
                              Date.today - 100 => '100 days late',
                              Date.today - 20000 => '20000 days late',
                             }
                  to_test.each do |date, expected|
                    assert_equal expected, due_date_distance_in_words(date)
                  end
                end
                def test_avatar
                  # turn on avatars
                  Setting.gravatar_enabled = '1'
                  assert avatar(User.find_by_mail('jsmith@somenet.foo')).include?(Digest::MD5.hexdigest('jsmith@somenet.foo'))
                  assert avatar('jsmith <jsmith@somenet.foo>').include?(Digest::MD5.hexdigest('jsmith@somenet.foo'))
                  assert_nil avatar('jsmith')
                  assert_nil avatar(nil)
                  # turn off avatars
                  Setting.gravatar_enabled = '0'
                  assert_nil avatar(User.find_by_mail('jsmith@somenet.foo'))
                end
              end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages