Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
G
gitlab-ce
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
0
Merge Requests
0
Analytics
Analytics
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Commits
Issue Boards
Open sidebar
Boxiang Sun
gitlab-ce
Commits
0fed6884
Commit
0fed6884
authored
May 03, 2019
by
Patrick Derichs
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Fix url redaction for issue links
parent
204dca44
Changes
3
Hide whitespace changes
Inline
Side-by-side
Showing
3 changed files
with
28 additions
and
16 deletions
+28
-16
changelogs/unreleased/security-fix-project-existence-disclosure-master.yml
...ased/security-fix-project-existence-disclosure-master.yml
+5
-0
lib/banzai/redactor.rb
lib/banzai/redactor.rb
+5
-2
spec/lib/banzai/redactor_spec.rb
spec/lib/banzai/redactor_spec.rb
+18
-14
No files found.
changelogs/unreleased/security-fix-project-existence-disclosure-master.yml
0 → 100644
View file @
0fed6884
---
title
:
Fix url redaction for issue links
merge_request
:
author
:
type
:
security
lib/banzai/redactor.rb
View file @
0fed6884
...
@@ -70,8 +70,11 @@ module Banzai
...
@@ -70,8 +70,11 @@ module Banzai
# Build the raw <a> tag just with a link as href and content if
# Build the raw <a> tag just with a link as href and content if
# it's originally a link pattern. We shouldn't return a plain text href.
# it's originally a link pattern. We shouldn't return a plain text href.
original_link
=
original_link
=
if
link_reference
==
'true'
&&
href
=
original_content
if
link_reference
==
'true'
%(<a href="#{href}">#{href}</a>)
href
=
node
.
attr
(
'href'
)
content
=
original_content
%(<a href="#{href}">#{content}</a>)
end
end
# The reference should be replaced by the original link's content,
# The reference should be replaced by the original link's content,
...
...
spec/lib/banzai/redactor_spec.rb
View file @
0fed6884
...
@@ -13,10 +13,10 @@ describe Banzai::Redactor do
...
@@ -13,10 +13,10 @@ describe Banzai::Redactor do
it
'redacts an array of documents'
do
it
'redacts an array of documents'
do
doc1
=
Nokogiri
::
HTML
doc1
=
Nokogiri
::
HTML
.
fragment
(
'<a class="gfm" data-reference-type="issue">foo</a>'
)
.
fragment
(
'<a class="gfm"
href="https://www.gitlab.com"
data-reference-type="issue">foo</a>'
)
doc2
=
Nokogiri
::
HTML
doc2
=
Nokogiri
::
HTML
.
fragment
(
'<a class="gfm" data-reference-type="issue">bar</a>'
)
.
fragment
(
'<a class="gfm"
href="https://www.gitlab.com"
data-reference-type="issue">bar</a>'
)
redacted_data
=
redactor
.
redact
([
doc1
,
doc2
])
redacted_data
=
redactor
.
redact
([
doc1
,
doc2
])
...
@@ -27,7 +27,7 @@ describe Banzai::Redactor do
...
@@ -27,7 +27,7 @@ describe Banzai::Redactor do
end
end
it
'replaces redacted reference with inner HTML'
do
it
'replaces redacted reference with inner HTML'
do
doc
=
Nokogiri
::
HTML
.
fragment
(
"<a class='gfm' data-reference-type='issue'>foo</a>"
)
doc
=
Nokogiri
::
HTML
.
fragment
(
"<a class='gfm'
href='https://www.gitlab.com'
data-reference-type='issue'>foo</a>"
)
redactor
.
redact
([
doc
])
redactor
.
redact
([
doc
])
expect
(
doc
.
to_html
).
to
eq
(
'foo'
)
expect
(
doc
.
to_html
).
to
eq
(
'foo'
)
end
end
...
@@ -35,20 +35,24 @@ describe Banzai::Redactor do
...
@@ -35,20 +35,24 @@ describe Banzai::Redactor do
context
'when data-original attribute provided'
do
context
'when data-original attribute provided'
do
let
(
:original_content
)
{
'<code>foo</code>'
}
let
(
:original_content
)
{
'<code>foo</code>'
}
it
'replaces redacted reference with original content'
do
it
'replaces redacted reference with original content'
do
doc
=
Nokogiri
::
HTML
.
fragment
(
"<a class='gfm' data-reference-type='issue' data-original='
#{
original_content
}
'>bar</a>"
)
doc
=
Nokogiri
::
HTML
.
fragment
(
"<a class='gfm'
href='https://www.gitlab.com'
data-reference-type='issue' data-original='
#{
original_content
}
'>bar</a>"
)
redactor
.
redact
([
doc
])
redactor
.
redact
([
doc
])
expect
(
doc
.
to_html
).
to
eq
(
original_content
)
expect
(
doc
.
to_html
).
to
eq
(
original_content
)
end
end
end
it
'returns <a> tag with original href if it is originally a link reference'
do
href
=
'http://localhost:3000'
doc
=
Nokogiri
::
HTML
.
fragment
(
"<a class='gfm' data-reference-type='issue' data-original=
#{
href
}
data-link-reference='true'>
#{
href
}
</a>"
)
redactor
.
redact
([
doc
])
it
'does not replace redacted reference with original content if href is given'
do
html
=
"<a href='https://www.gitlab.com' data-link-reference='true' class='gfm' data-reference-type='issue' data-reference-type='issue' data-original='Marge'>Marge</a>"
doc
=
Nokogiri
::
HTML
.
fragment
(
html
)
redactor
.
redact
([
doc
])
expect
(
doc
.
to_html
).
to
eq
(
'<a href="https://www.gitlab.com">Marge</a>'
)
end
expect
(
doc
.
to_html
).
to
eq
(
'<a href="http://localhost:3000">http://localhost:3000</a>'
)
it
'uses the original content as the link content if given'
do
html
=
"<a href='https://www.gitlab.com' data-link-reference='true' class='gfm' data-reference-type='issue' data-reference-type='issue' data-original='Homer'>Marge</a>"
doc
=
Nokogiri
::
HTML
.
fragment
(
html
)
redactor
.
redact
([
doc
])
expect
(
doc
.
to_html
).
to
eq
(
'<a href="https://www.gitlab.com">Homer</a>'
)
end
end
end
end
end
...
@@ -61,7 +65,7 @@ describe Banzai::Redactor do
...
@@ -61,7 +65,7 @@ describe Banzai::Redactor do
end
end
it
'redacts an issue attached'
do
it
'redacts an issue attached'
do
doc
=
Nokogiri
::
HTML
.
fragment
(
"<a class='gfm' data-reference-type='issue' data-issue='
#{
issue
.
id
}
'>foo</a>"
)
doc
=
Nokogiri
::
HTML
.
fragment
(
"<a class='gfm'
href='https://www.gitlab.com'
data-reference-type='issue' data-issue='
#{
issue
.
id
}
'>foo</a>"
)
redactor
.
redact
([
doc
])
redactor
.
redact
([
doc
])
...
@@ -69,7 +73,7 @@ describe Banzai::Redactor do
...
@@ -69,7 +73,7 @@ describe Banzai::Redactor do
end
end
it
'redacts an external issue'
do
it
'redacts an external issue'
do
doc
=
Nokogiri
::
HTML
.
fragment
(
"<a class='gfm' data-reference-type='issue' data-external-issue='
#{
issue
.
id
}
' data-project='
#{
project
.
id
}
'>foo</a>"
)
doc
=
Nokogiri
::
HTML
.
fragment
(
"<a class='gfm'
href='https://www.gitlab.com'
data-reference-type='issue' data-external-issue='
#{
issue
.
id
}
' data-project='
#{
project
.
id
}
'>foo</a>"
)
redactor
.
redact
([
doc
])
redactor
.
redact
([
doc
])
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment