Merge branch 'fix/memory-leak-sanitization-filter' into 'master'
Fix a memory leak in HTML::Pipeline::SanitizationFilter::WHITELIST See merge request !6456
This commit is contained in:
commit
640ab3072f
|
@ -4,6 +4,7 @@ v 8.13.0 (unreleased)
|
|||
- Speed-up group milestones show page
|
||||
|
||||
v 8.12.1 (unreleased)
|
||||
- Fix a memory leak in HTML::Pipeline::SanitizationFilter::WHITELIST
|
||||
|
||||
v 8.12.0
|
||||
- Update the rouge gem to 2.0.6, which adds highlighting support for JSX, Prometheus, and others. !6251
|
||||
|
|
|
@ -7,7 +7,7 @@ module Banzai
|
|||
UNSAFE_PROTOCOLS = %w(data javascript vbscript).freeze
|
||||
|
||||
def whitelist
|
||||
whitelist = super.dup
|
||||
whitelist = super
|
||||
|
||||
customize_whitelist(whitelist)
|
||||
|
||||
|
@ -42,58 +42,58 @@ module Banzai
|
|||
# Allow any protocol in `a` elements...
|
||||
whitelist[:protocols].delete('a')
|
||||
|
||||
whitelist[:transformers] = whitelist[:transformers].dup
|
||||
|
||||
# ...but then remove links with unsafe protocols
|
||||
whitelist[:transformers].push(remove_unsafe_links)
|
||||
whitelist[:transformers].push(self.class.remove_unsafe_links)
|
||||
|
||||
# Remove `rel` attribute from `a` elements
|
||||
whitelist[:transformers].push(remove_rel)
|
||||
whitelist[:transformers].push(self.class.remove_rel)
|
||||
|
||||
# Remove `class` attribute from non-highlight spans
|
||||
whitelist[:transformers].push(clean_spans)
|
||||
whitelist[:transformers].push(self.class.clean_spans)
|
||||
|
||||
whitelist
|
||||
end
|
||||
|
||||
def remove_unsafe_links
|
||||
lambda do |env|
|
||||
node = env[:node]
|
||||
class << self
|
||||
def remove_unsafe_links
|
||||
lambda do |env|
|
||||
node = env[:node]
|
||||
|
||||
return unless node.name == 'a'
|
||||
return unless node.has_attribute?('href')
|
||||
return unless node.name == 'a'
|
||||
return unless node.has_attribute?('href')
|
||||
|
||||
begin
|
||||
uri = Addressable::URI.parse(node['href'])
|
||||
uri.scheme = uri.scheme.strip.downcase if uri.scheme
|
||||
begin
|
||||
uri = Addressable::URI.parse(node['href'])
|
||||
uri.scheme = uri.scheme.strip.downcase if uri.scheme
|
||||
|
||||
node.remove_attribute('href') if UNSAFE_PROTOCOLS.include?(uri.scheme)
|
||||
rescue Addressable::URI::InvalidURIError
|
||||
node.remove_attribute('href')
|
||||
node.remove_attribute('href') if UNSAFE_PROTOCOLS.include?(uri.scheme)
|
||||
rescue Addressable::URI::InvalidURIError
|
||||
node.remove_attribute('href')
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
def remove_rel
|
||||
lambda do |env|
|
||||
if env[:node_name] == 'a'
|
||||
env[:node].remove_attribute('rel')
|
||||
def remove_rel
|
||||
lambda do |env|
|
||||
if env[:node_name] == 'a'
|
||||
env[:node].remove_attribute('rel')
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
def clean_spans
|
||||
lambda do |env|
|
||||
node = env[:node]
|
||||
def clean_spans
|
||||
lambda do |env|
|
||||
node = env[:node]
|
||||
|
||||
return unless node.name == 'span'
|
||||
return unless node.has_attribute?('class')
|
||||
return unless node.name == 'span'
|
||||
return unless node.has_attribute?('class')
|
||||
|
||||
unless has_ancestor?(node, 'pre')
|
||||
node.remove_attribute('class')
|
||||
unless node.ancestors.any? { |n| n.name.casecmp('pre').zero? }
|
||||
node.remove_attribute('class')
|
||||
end
|
||||
|
||||
{ node_whitelist: [node] }
|
||||
end
|
||||
|
||||
{ node_whitelist: [node] }
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
Loading…
Reference in New Issue