Commit Graph

17 Commits

Author SHA1 Message Date
Stan Hu f93b2e02a5 Run rubocop -a on CE files 2019-05-05 03:24:28 -07:00
Brett Walker 7e25ff3047 Catch possible Addressable::URI::InvalidURIError 2019-02-04 15:34:19 -06:00
Brett Walker 40983f4a9c
Show tooltip for malicious looking links
Such as those with IDN homographs or embedded
right-to-left (RTLO) characters.

Autolinked hrefs should be escaped
2019-01-31 16:52:20 +01:00
Stan Hu 8b4154b57f Enable frozen strings in lib/banzai/filter/*.rb
Excludes a few filters that require more work:

* lib/banzai/filter/image_lazy_load_filter_spec.rb
* lib/banzai/filter/syntax_highlight_filter_spec.rb
* lib/banzai/filter/table_of_contents_filter_spec.rb

Part of #47424
2018-07-23 02:39:45 -07:00
Sean McGivern 3a43cf426a Fix auto-linking with escaped HTML entities
We displayed the correct text as the link text (without double-encoding), but
didn't do the same for the actual link target, so any link containing an
ampersand would break when auto-linked.
2018-03-28 14:23:47 +01:00
Sean McGivern 058dd19360 Add ?, !, and : to trailing puncutation excluded from auto-linking 2018-03-23 15:51:28 +00:00
Sean McGivern cb55bc3c07 Match Rinku's behaviour for closing punctuation in links
Rinku 2.0.0 (the version we use) will remove the last character of a link if
it's a closing part of a punctuation pair (different types of parentheses and
quotes), unless both of the below are true:

1. The matching pair has different start and end characters.
2. There are equal numbers of both in the matched string (they don't have to be
   balanced).
2018-03-02 13:42:57 +00:00
Jarka Kadlecová 1a09d5cda8 Render htmlentities correctly for links not supported by Rinku 2018-02-21 19:37:08 +01:00
Douwe Maan bdbc7d967a Revert "Enable Style/BarePercentLiterals"
This reverts commit 96bef54154e669f9a3e92c3a4bc76c0be3a52e48.
2017-02-23 09:32:42 -06:00
Douwe Maan baafd8de26 Enable Style/BarePercentLiterals 2017-02-23 09:31:57 -06:00
Douwe Maan b7d8df503c Enable Style/MutableConstant 2017-02-23 09:31:56 -06:00
Douwe Maan a14ee68fe4
Merge branch 'markdown-xss-fix-option-2.1' into 'security'
Fix for HackerOne XSS vulnerability in markdown

This is an updated blacklist patch to fix https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2007. No text is removed. Dangerous schemes/protocols and invalid URIs are left intact but not linked.

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/23153

See merge request !2015

Signed-off-by: Rémy Coutable <remy@rymai.me>
2016-11-09 12:26:44 +01:00
Yorick Peterse dd35c3ddf6
Improve AutolinkFilter#text_parse performance
By using clever XPath queries we can quite significantly improve the
performance of this method. The actual improvement depends a bit on the
amount of links used but in my tests the new implementation is usually
around 8 times faster than the old one. This was measured using the
following benchmark:

    require 'benchmark/ips'

    text = '<p>' + Note.select("string_agg(note, '') AS note").limit(50).take[:note] + '</p>'
    document = Nokogiri::HTML.fragment(text)
    filter = Banzai::Filter::AutolinkFilter.new(document, autolink: true)

    puts "Input size: #{(text.bytesize.to_f / 1024 / 1024).round(2)} MB"

    filter.rinku_parse

    Benchmark.ips(time: 15) do |bench|
      bench.report 'text_parse' do
        filter.text_parse
      end

      bench.report 'text_parse_fast' do
        filter.text_parse_fast
      end

      bench.compare!
    end

Here the "text_parse_fast" method is the new implementation and
"text_parse" the old one. The input size was around 180 MB. Running this
benchmark outputs the following:

    Input size: 181.16 MB
    Calculating -------------------------------------
              text_parse     1.000  i/100ms
         text_parse_fast     9.000  i/100ms
    -------------------------------------------------
              text_parse     13.021  (±15.4%) i/s -    188.000
         text_parse_fast    112.741  (± 3.5%) i/s -      1.692k

    Comparison:
         text_parse_fast:      112.7 i/s
              text_parse:       13.0 i/s - 8.66x slower

Again the production timings may (and most likely will) vary depending
on the input being processed.
2016-08-03 11:38:46 +02:00
Paco Guzman 0c2da7f734 Don't parse Rinku returned value to DocFragment when it didn't change the original html string. 2016-07-18 13:11:46 +02:00
Robert Speicher 8558483417 Remove redundant `require`s from Banzai files
We're trying to avoid circular dependency errors.
2016-03-24 13:23:47 -04:00
Douwe Maan 2a20c0e590 Prevent circular reference error in Banzai 2016-01-14 11:30:28 +01:00
Douwe Maan 7781bda9bd Move Markdown/reference logic from Gitlab::Markdown to Banzai 2015-12-15 15:51:16 +01:00