From 6a2d24fc29aa2a55afc3065dadb77b41d9e79a9e Mon Sep 17 00:00:00 2001
From: Pirate Praveen <praveen@debian.org>
Date: Thu, 18 Mar 2021 23:53:47 +0530
Subject: [PATCH] New upstream version 13.9.4+ds1

---
 CHANGELOG.md                             |  7 +++++
 GITALY_SERVER_VERSION                    |  2 +-
 VERSION                                  |  2 +-
 config/initializers/kramdown_patch.rb    | 25 ++++++++++++++++
 spec/initializers/kramdown_patch_spec.rb | 38 ++++++++++++++++++++++++
 vendor/gitignore/C++.gitignore           |  0
 vendor/gitignore/Java.gitignore          |  0
 7 files changed, 72 insertions(+), 2 deletions(-)
 create mode 100644 config/initializers/kramdown_patch.rb
 create mode 100644 spec/initializers/kramdown_patch_spec.rb
 mode change 100755 => 100644 vendor/gitignore/C++.gitignore
 mode change 100755 => 100644 vendor/gitignore/Java.gitignore

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ce665eb7fc..9e8fe28664 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,13 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
 
+## 13.9.4 (2021-03-17)
+
+### Security (1 change)
+
+- Patch Kramdown syntax highlighter gem.
+
+
 ## 13.9.3 (2021-03-08)
 
 ### Fixed (4 changes)
diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION
index 353780b610..e409a9ea03 100644
--- a/GITALY_SERVER_VERSION
+++ b/GITALY_SERVER_VERSION
@@ -1 +1 @@
-13.9.3
\ No newline at end of file
+13.9.4
\ No newline at end of file
diff --git a/VERSION b/VERSION
index 353780b610..e409a9ea03 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-13.9.3
\ No newline at end of file
+13.9.4
\ No newline at end of file
diff --git a/config/initializers/kramdown_patch.rb b/config/initializers/kramdown_patch.rb
new file mode 100644
index 0000000000..5cb769cec2
--- /dev/null
+++ b/config/initializers/kramdown_patch.rb
@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+#
+# This pulls in https://github.com/gettalong/kramdown/pull/708 for kramdown v2.3.0.
+# Remove this file when that pull request is merged and released.
+require 'kramdown/converter'
+require 'kramdown/converter/syntax_highlighter/rouge'
+
+module Kramdown::Converter::SyntaxHighlighter
+  module Rouge
+    def self.formatter_class(opts = {})
+      case formatter = opts[:formatter]
+      when Class
+        formatter
+      when /\A[[:upper:]][[:alnum:]_]*\z/
+        ::Rouge::Formatters.const_get(formatter, false)
+      else
+        # Available in Rouge 2.0 or later
+        ::Rouge::Formatters::HTMLLegacy
+      end
+    rescue NameError
+      # Fallback to Rouge 1.x
+      ::Rouge::Formatters::HTML
+    end
+  end
+end
diff --git a/spec/initializers/kramdown_patch_spec.rb b/spec/initializers/kramdown_patch_spec.rb
new file mode 100644
index 0000000000..49dda9252b
--- /dev/null
+++ b/spec/initializers/kramdown_patch_spec.rb
@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Kramdown patch for syntax highlighting formatters' do
+  subject { Kramdown::Document.new(options + "\n" + code).to_html }
+
+  let(:code) do
+    <<-RUBY
+~~~ ruby
+    def what?
+      42
+    end
+~~~
+    RUBY
+  end
+
+  context 'with invalid formatter' do
+    let(:options) { %({::options auto_ids="false" footnote_nr="5" syntax_highlighter="rouge" syntax_highlighter_opts="{formatter: CSV, line_numbers: true\\}" /}) }
+
+    it 'falls back to standard HTML and disallows CSV' do
+      expect(CSV).not_to receive(:new)
+      expect(::Rouge::Formatters::HTML).to receive(:new).and_call_original
+
+      expect(subject).to be_present
+    end
+  end
+
+  context 'with valid formatter' do
+    let(:options) { %({::options auto_ids="false" footnote_nr="5" syntax_highlighter="rouge" syntax_highlighter_opts="{formatter: HTMLLegacy\\}" /}) }
+
+    it 'allows formatter' do
+      expect(::Rouge::Formatters::HTMLLegacy).to receive(:new).and_call_original
+
+      expect(subject).to be_present
+    end
+  end
+end
diff --git a/vendor/gitignore/C++.gitignore b/vendor/gitignore/C++.gitignore
old mode 100755
new mode 100644
diff --git a/vendor/gitignore/Java.gitignore b/vendor/gitignore/Java.gitignore
old mode 100755
new mode 100644