Fix description and GFM pipelines conflicting
Consider this command: bundle exec rails r "include GitlabMarkdownHelper puts markdown('<span>this is a span</span>', pipeline: :description) puts markdown('<span>this is a span</span>')" And the same in the opposite order: bundle exec rails r "include GitlabMarkdownHelper puts markdown('<span>this is a span</span>') puts markdown('<span>this is a span</span>', pipeline: :description)" Before this change, they would both output: <p><span>this is a span</span></p> <p>this is a span</p> That's because `span` is added to the list of whitelisted elements in the `SanitizationFilter`, but this method tries not to make the same changes multiple times. Unfortunately, `HTML::Pipeline::SanitizationFilter::LIMITED`, which is used by the `DescriptionPipeline`, uses the same Ruby objects for all of its hash values _except_ `:elements`. That means that whichever of `DescriptionPipeline` and `GfmPipeline` is called first would have `span` in its whitelisted elements, and the second wouldn't. Fix this by creating an entirely separate hash, before either pipeline is invoked.
This commit is contained in:
parent
cfc99bbd13
commit
03d2bf141c
1 changed files with 5 additions and 12 deletions
|
@ -1,23 +1,16 @@
|
||||||
module Banzai
|
module Banzai
|
||||||
module Pipeline
|
module Pipeline
|
||||||
class DescriptionPipeline < FullPipeline
|
class DescriptionPipeline < FullPipeline
|
||||||
|
WHITELIST = Banzai::Filter::SanitizationFilter::LIMITED.deep_dup.merge(
|
||||||
|
elements: Banzai::Filter::SanitizationFilter::LIMITED[:elements] - %w(pre code img ol ul li)
|
||||||
|
)
|
||||||
|
|
||||||
def self.transform_context(context)
|
def self.transform_context(context)
|
||||||
super(context).merge(
|
super(context).merge(
|
||||||
# SanitizationFilter
|
# SanitizationFilter
|
||||||
whitelist: whitelist
|
whitelist: WHITELIST
|
||||||
)
|
)
|
||||||
end
|
end
|
||||||
|
|
||||||
private
|
|
||||||
|
|
||||||
def self.whitelist
|
|
||||||
# Descriptions are more heavily sanitized, allowing only a few elements.
|
|
||||||
# See http://git.io/vkuAN
|
|
||||||
whitelist = Banzai::Filter::SanitizationFilter::LIMITED
|
|
||||||
whitelist[:elements] -= %w(pre code img ol ul li)
|
|
||||||
|
|
||||||
whitelist
|
|
||||||
end
|
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
Loading…
Reference in a new issue