03d2bf141c
Consider this command:
bundle exec rails r "include GitlabMarkdownHelper
puts markdown('<span>this is a span</span>', pipeline: :description)
puts markdown('<span>this is a span</span>')"
And the same in the opposite order:
bundle exec rails r "include GitlabMarkdownHelper
puts markdown('<span>this is a span</span>')
puts markdown('<span>this is a span</span>', pipeline: :description)"
Before this change, they would both output:
<p><span>this is a span</span></p>
<p>this is a span</p>
That's because `span` is added to the list of whitelisted elements in
the `SanitizationFilter`, but this method tries not to make the same
changes multiple times. Unfortunately,
`HTML::Pipeline::SanitizationFilter::LIMITED`, which is used by the
`DescriptionPipeline`, uses the same Ruby objects for all of its hash
values _except_ `:elements`.
That means that whichever of `DescriptionPipeline` and `GfmPipeline` is
called first would have `span` in its whitelisted elements, and the
second wouldn't.
Fix this by creating an entirely separate hash, before either pipeline
is invoked.
16 lines
437 B
Ruby
16 lines
437 B
Ruby
module Banzai
|
|
module Pipeline
|
|
class DescriptionPipeline < FullPipeline
|
|
WHITELIST = Banzai::Filter::SanitizationFilter::LIMITED.deep_dup.merge(
|
|
elements: Banzai::Filter::SanitizationFilter::LIMITED[:elements] - %w(pre code img ol ul li)
|
|
)
|
|
|
|
def self.transform_context(context)
|
|
super(context).merge(
|
|
# SanitizationFilter
|
|
whitelist: WHITELIST
|
|
)
|
|
end
|
|
end
|
|
end
|
|
end
|