jro_apps/redmine Commit - r3498:8cdcf308bef6

Escape href attribute in auto links (#5179)....

Jean-Philippe Lang -

r3498:8cdcf308bef6

parent child

Context file:

r3498:8cdcf308bef6

Collapse all files

lib/redcloth3.rb +1 -1

                           post = ")"+post # add closing parenth to post
                         end
                         atts = pba( atts )
-                        atts = " href=\"#{ url }#{ slash }\"#{ atts }"
+                        atts = " href=\"#{ htmlesc url }#{ slash }\"#{ atts }"
                         atts << " title=\"#{ htmlesc title }\"" if title
                         atts = shelve( atts ) if atts

lib/redmine/wiki_formatting/textile/formatter.rb +4 -2

               module WikiFormatting
                 module Textile
                   class Formatter < RedCloth3
+                    include ActionView::Helpers::TagHelper
                     # auto_link rule after textile rules so that it doesn't break !image_url! tags
                     RULES = [:textile, :block_markdown_rule, :inline_auto_link, :inline_auto_mailto, :inline_toc]
                             url=url[0..-2] # discard closing parenth from url
                             post = ")"+post # add closing parenth to post
                           end
-                          %(#{leading}<a class="external" href="#{proto=="www."?"http://www.":proto}#{url}">#{proto + url}</a>#{post})
+                          tag = content_tag('a', proto + url, :href => "#{proto=="www."?"http://www.":proto}#{url}", :class => 'external')
+                          %(#{leading}#{tag}#{post})
                         end
                       end
                     end
                         if text.match(/<a\b[^>]*>(.*)(#{Regexp.escape(mail)})(.*)<\/a>/)
                           mail
                         else
-                          %{<a href="mailto:#{mail}" class="email">#{mail}</a>}
+                          content_tag('a', mail, :href => "mailto:#{mail}", :class => "email")
                         end
                       end
                     end

test/unit/helpers/application_helper_test.rb +5 -1

                   'sftp://foo.bar' => '<a class="external" href="sftp://foo.bar">sftp://foo.bar</a>',
                   # two exclamation marks
                   'http://example.net/path!602815048C7B5C20!302.html' => '<a class="external" href="http://example.net/path!602815048C7B5C20!302.html">http://example.net/path!602815048C7B5C20!302.html</a>',
+                  # escaping
+                  'http://foo"bar' => '<a class="external" href="http://foo&quot;bar">http://foo"bar</a>',
                 }
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
               end
               def test_auto_mailto
-                assert_equal '<p><a href="mailto:test@foo.bar" class="email">test@foo.bar</a></p>',
+                assert_equal '<p><a class="email" href="mailto:test@foo.bar">test@foo.bar</a></p>',
                   textilizable('test@foo.bar')
               end
                   "\"system administrator\":mailto:sysadmin@example.com?subject=redmine%20permissions" => "<a href=\"mailto:sysadmin@example.com?subject=redmine%20permissions\">system administrator</a>",
                   # two exclamation marks
                   '"a link":http://example.net/path!602815048C7B5C20!302.html' => '<a href="http://example.net/path!602815048C7B5C20!302.html" class="external">a link</a>',
+                  # escaping
+                  '"test":http://foo"bar' => '<a href="http://foo&quot;bar" class="external">test</a>',
                 }
                 to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
               end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages