Commit ca823aba authored by Ahmad Sherif's avatar Ahmad Sherif

Fix the leak mentioned in 504a3b5e by another way

The previous fix introduced another leak; as it made
Banzai::Filter::SanitizationFiler#customized? always return false, so we
were always appending two elements to
HTML::Pipeline::SanitizationFilter::WHITELIST[:elements]. This growth in
the elements array would slow the sanitization process over time.
parent 0fe33f92
...@@ -4,6 +4,7 @@ v 8.13.0 (unreleased) ...@@ -4,6 +4,7 @@ v 8.13.0 (unreleased)
- Speed-up group milestones show page - Speed-up group milestones show page
v 8.12.1 (unreleased) v 8.12.1 (unreleased)
- Fix a memory leak in HTML::Pipeline::SanitizationFilter::WHITELIST
v 8.12.0 v 8.12.0
- Update the rouge gem to 2.0.6, which adds highlighting support for JSX, Prometheus, and others. !6251 - Update the rouge gem to 2.0.6, which adds highlighting support for JSX, Prometheus, and others. !6251
......
...@@ -43,17 +43,18 @@ module Banzai ...@@ -43,17 +43,18 @@ module Banzai
whitelist[:protocols].delete('a') whitelist[:protocols].delete('a')
# ...but then remove links with unsafe protocols # ...but then remove links with unsafe protocols
whitelist[:transformers].push(remove_unsafe_links) whitelist[:transformers].push(self.class.remove_unsafe_links)
# Remove `rel` attribute from `a` elements # Remove `rel` attribute from `a` elements
whitelist[:transformers].push(remove_rel) whitelist[:transformers].push(self.class.remove_rel)
# Remove `class` attribute from non-highlight spans # Remove `class` attribute from non-highlight spans
whitelist[:transformers].push(clean_spans) whitelist[:transformers].push(self.class.clean_spans)
whitelist whitelist
end end
class << self
def remove_unsafe_links def remove_unsafe_links
lambda do |env| lambda do |env|
node = env[:node] node = env[:node]
...@@ -87,7 +88,7 @@ module Banzai ...@@ -87,7 +88,7 @@ module Banzai
return unless node.name == 'span' return unless node.name == 'span'
return unless node.has_attribute?('class') return unless node.has_attribute?('class')
unless has_ancestor?(node, 'pre') unless node.ancestors.any? { |n| n.name.casecmp('pre').zero? }
node.remove_attribute('class') node.remove_attribute('class')
end end
...@@ -96,4 +97,5 @@ module Banzai ...@@ -96,4 +97,5 @@ module Banzai
end end
end end
end end
end
end end
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment