gitlab-org--gitlab-foss/lib/banzai/pipeline/description_pipeline.rb

# frozen_string_literal: true

module Banzai
  module Pipeline
    class DescriptionPipeline < FullPipeline
      WHITELIST = Banzai::Filter::SanitizationFilter::LIMITED.deep_dup.merge(
        elements: Banzai::Filter::SanitizationFilter::LIMITED[:elements] - %w(pre code img ol ul li)
      )

      def self.transform_context(context)
        super(context).merge(
          # SanitizationFilter
          whitelist: WHITELIST
        )
      end
    end
  end
end
Enable more frozen string in lib/*/.rb Enables frozen for the following: * lib/.rb lib/banzai/*/.rb * lib/bitbucket/*/.rb * lib/constraints/*/.rb * lib/container_registry/*/.rb * lib/declarative_policy/*/.rb Partially addresses #47424. 2018-10-06 19:10:08 -04:00			`# frozen_string_literal: true`

Move Markdown/reference logic from Gitlab::Markdown to Banzai 2015-12-15 09:51:16 -05:00			`module Banzai`
			`module Pipeline`
Make pipelines actually make sense 2015-10-21 06:18:23 -04:00			`class DescriptionPipeline < FullPipeline`
Fix description and GFM pipelines conflicting Consider this command: bundle exec rails r "include GitlabMarkdownHelper puts markdown('<span>this is a span</span>', pipeline: :description) puts markdown('<span>this is a span</span>')" And the same in the opposite order: bundle exec rails r "include GitlabMarkdownHelper puts markdown('<span>this is a span</span>') puts markdown('<span>this is a span</span>', pipeline: :description)" Before this change, they would both output: <p><span>this is a span</span></p> <p>this is a span</p> That's because `span` is added to the list of whitelisted elements in the `SanitizationFilter`, but this method tries not to make the same changes multiple times. Unfortunately, `HTML::Pipeline::SanitizationFilter::LIMITED`, which is used by the `DescriptionPipeline`, uses the same Ruby objects for all of its hash values _except_ `:elements`. That means that whichever of `DescriptionPipeline` and `GfmPipeline` is called first would have `span` in its whitelisted elements, and the second wouldn't. Fix this by creating an entirely separate hash, before either pipeline is invoked. 2016-06-13 08:06:40 -04:00			`WHITELIST = Banzai::Filter::SanitizationFilter::LIMITED.deep_dup.merge(`
			`elements: Banzai::Filter::SanitizationFilter::LIMITED[:elements] - %w(pre code img ol ul li)`
			`)`

Make pipelines actually make sense 2015-10-21 06:18:23 -04:00			`def self.transform_context(context)`
Move Markdown/reference logic from Gitlab::Markdown to Banzai 2015-12-15 09:51:16 -05:00			`super(context).merge(`
Make pipelines actually make sense 2015-10-21 06:18:23 -04:00			`# SanitizationFilter`
Fix description and GFM pipelines conflicting Consider this command: bundle exec rails r "include GitlabMarkdownHelper puts markdown('<span>this is a span</span>', pipeline: :description) puts markdown('<span>this is a span</span>')" And the same in the opposite order: bundle exec rails r "include GitlabMarkdownHelper puts markdown('<span>this is a span</span>') puts markdown('<span>this is a span</span>', pipeline: :description)" Before this change, they would both output: <p><span>this is a span</span></p> <p>this is a span</p> That's because `span` is added to the list of whitelisted elements in the `SanitizationFilter`, but this method tries not to make the same changes multiple times. Unfortunately, `HTML::Pipeline::SanitizationFilter::LIMITED`, which is used by the `DescriptionPipeline`, uses the same Ruby objects for all of its hash values _except_ `:elements`. That means that whichever of `DescriptionPipeline` and `GfmPipeline` is called first would have `span` in its whitelisted elements, and the second wouldn't. Fix this by creating an entirely separate hash, before either pipeline is invoked. 2016-06-13 08:06:40 -04:00			`whitelist: WHITELIST`
Make pipelines actually make sense 2015-10-21 06:18:23 -04:00			`)`
			`end`
			`end`
			`end`
			`end`