jro_apps/redmine Commit - r2168:7776b5b6659e

Escape textile titles and styles (#2377)....

Jean-Philippe Lang -

r2168:7776b5b6659e

parent child

Context file:

r2168:7776b5b6659e

Collapse all files

lib/redcloth3.rb +9 -6

                 #   [ /"(?=[#{PUNCT_Q}]*[\s#{PUNCT_NOQ}])/, '&#8221;' ], # double closing
                 #   [ /"/, '&#8220;' ], # double opening
                 #   [ /\b( )?\.{3}/, '\1&#8230;' ], # ellipsis
-                    [ /\b([A-Z][A-Z0-9]{2,})\b(?:[(]([^)]*)[)])/, '<acronym title="\2">\1</acronym>' ], # 3+ uppercase acronym
+                #   [ /\b([A-Z][A-Z0-9]{2,})\b(?:[(]([^)]*)[)])/, '<acronym title="\2">\1</acronym>' ], # 3+ uppercase acronym
                 #   [ /(^|[^"][>\s])([A-Z][A-Z0-9 ]+[A-Z0-9])([^<A-Za-z0-9]|$)/, '\1<span class="caps">\2</span>\3', :no_span_caps ], # 3+ uppercase caps
                 #   [ /(\.\s)?\s?--\s?/, '\1&#8212;' ], # em dash
                 #   [ /\s->\s/, ' &rarr; ' ], # right arrow
                 # Search and replace for Textile glyphs (quotes, dashes, other symbols)
                 def pgl( text )
-                    GLYPHS.each do |re, resub, tog|
+                    #GLYPHS.each do |re, resub, tog|
-                        next if tog and method( tog ).call
+                    #    next if tog and method( tog ).call
-                        text.gsub! re, resub
+                    #    text.gsub! re, resub
+                    #end
+                    text.gsub!(/\b([A-Z][A-Z0-9]{2,})\b(?:[(]([^)]*)[)])/) do |m|
+                      "<acronym title=\"#{htmlesc $2}\">#{$1}</acronym>"
                     end
                 end
                         style << "vertical-align:#{ v_align( $& ) };" if text =~ A_VLGN
                     end
-                    style << "#{ $1 };" if not filter_styles and
+                    style << "#{ htmlesc $1 };" if not filter_styles and
                         text.sub!( /\{([^}]*)\}/, '' )
                     lang = $1 if
                         end
                         atts = pba( atts )
                         atts = " href=\"#{ url }#{ slash }\"#{ atts }"
-                        atts << " title=\"#{ title }\"" if title
+                        atts << " title=\"#{ htmlesc title }\"" if title
                         atts = shelve( atts ) if atts
                         external = (url =~ /^https?:\/\//) ? ' class="external"' : ''

test/unit/helpers/application_helper_test.rb +10 0

                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
               end
+              def test_acronyms
+                to_test = {
+                  'this is an acronym: GPL(General Public License)' => 'this is an acronym: <acronym title="General Public License">GPL</acronym>',
+                  'GPL(This is a double-quoted "title")' => '<acronym title="This is a double-quoted &quot;title&quot;">GPL</acronym>',
+                }
+                to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
+              end
               def test_attached_images
                 to_test = {
                   'Inline image: !logo.gif!' => 'Inline image: <img src="/attachments/download/3" title="This is a logo" alt="This is a logo" />',
                   'This is a "link":http://foo.bar' => 'This is a <a href="http://foo.bar" class="external">link</a>',
                   'This is an intern "link":/foo/bar' => 'This is an intern <a href="/foo/bar">link</a>',
                   '"link (Link title)":http://foo.bar' => '<a href="http://foo.bar" title="Link title" class="external">link</a>',
+                  '"link (Link title with "double-quotes")":http://foo.bar' => '<a href="http://foo.bar" title="Link title with &quot;double-quotes&quot;" class="external">link</a>',
                   "This is not a \"Link\":\n\nAnother paragraph" => "This is not a \"Link\":</p>\n\n\n\t<p>Another paragraph",
                   # no multiline link text
                   "This is a double quote \"on the first line\nand another on a second line\":test" => "This is a double quote \"on the first line<br />\nand another on a second line\":test"

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages