64 lines
2.2 KiB
Diff
64 lines
2.2 KiB
Diff
https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/20284
|
|
https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/20820
|
|
|
|
--- a/lib/banzai/filter/sanitization_filter.rb
|
|
+++ b/lib/banzai/filter/sanitization_filter.rb
|
|
@@ -1,30 +1,25 @@
|
|
+# frozen_string_literal: true
|
|
+
|
|
module Banzai
|
|
module Filter
|
|
# Sanitize HTML
|
|
#
|
|
# Extends HTML::Pipeline::SanitizationFilter with a custom whitelist.
|
|
class SanitizationFilter < HTML::Pipeline::SanitizationFilter
|
|
+ include Gitlab::Utils::StrongMemoize
|
|
+
|
|
UNSAFE_PROTOCOLS = %w(data javascript vbscript).freeze
|
|
TABLE_ALIGNMENT_PATTERN = /text-align: (?<alignment>center|left|right)/
|
|
|
|
def whitelist
|
|
- whitelist = super
|
|
-
|
|
- customize_whitelist(whitelist)
|
|
-
|
|
- whitelist
|
|
+ strong_memoize(:whitelist) do
|
|
+ customize_whitelist(super.deep_dup)
|
|
+ end
|
|
end
|
|
|
|
private
|
|
|
|
- def customized?(transformers)
|
|
- transformers.last.source_location[0] == __FILE__
|
|
- end
|
|
-
|
|
def customize_whitelist(whitelist)
|
|
- # Only push these customizations once
|
|
- return if customized?(whitelist[:transformers])
|
|
-
|
|
# Allow table alignment; we whitelist specific text-align values in a
|
|
# transformer below
|
|
whitelist[:attributes]['th'] = %w(style)
|
|
--- a/spec/lib/banzai/filter/sanitization_filter_spec.rb
|
|
+++ b/spec/lib/banzai/filter/sanitization_filter_spec.rb
|
|
@@ -54,6 +54,18 @@
|
|
expect(instance.whitelist[:transformers].size).to eq control_count
|
|
end
|
|
|
|
+ it 'customizes the whitelist only once for different instances' do
|
|
+ instance1 = described_class.new('Foo1')
|
|
+ instance2 = described_class.new('Foo2')
|
|
+ control_count = instance1.whitelist[:transformers].size
|
|
+
|
|
+ instance1.whitelist
|
|
+ instance2.whitelist
|
|
+
|
|
+ expect(instance1.whitelist[:transformers].size).to eq control_count
|
|
+ expect(instance2.whitelist[:transformers].size).to eq control_count
|
|
+ end
|
|
+
|
|
it 'sanitizes `class` attribute from all elements' do
|
|
act = %q{<pre class="code highlight white c"><code><span class="k">def</span></code></pre>}
|
|
exp = %q{<pre><code><span class="k">def</span></code></pre>}
|